a�-Hbm��6Z�W Χ�yX$�L�\t��n%���*<us����:���ze��M��=�� N���ޱ:oAR8P��\��Q)�h�38��j,��p����)&ڑ�o6 �ӝu�,D�i��ջ'��g�����d�L82-�q�1�����W�aq�&�[� G����6�v�D��r��h(��l�1O��&E]���>��:>���/��7[���R��}ײ����� �MO���#+Ja�#��>(m�)��E�8fýF���lI;f}�����I$�:����uJ <�gvwF�ͦjY�[@I�=m�����i�!2����P(��q}���&�4`����m1��j"i{�Ch\p�`��%�d&�f0v_�I�1?uD�oF��l��jR��>���꺡�سɖ�/M��"R�er��"�N������R���'W���[�Cy��b=�W�K`g^�\���(�n�����C���m)a�⍐Ap�A��NB9DdD���ȫiG���̵��0���͵l����1sO-}��Y}��I#/��^�K��4�3���{��G�ֵf!�${�����|�V����Oq��q� 53��Z4����Y2u5�x���� �d�Q4�^�BT� §�!�H7��l�[}y-d�*�97�h��K���Ҩ���x����� /T��闷���N���z{YZFj�������Ka��� �$wdt-N�nG�;N7��M1B��y�\���4�l����'o���-���:{dc�m�!������dzF����8j�8�9�R�� -�R�1�����1�}B3��~�ۤ=l�F�̋g����q�C���9!Ց0���i��U�q8Di|W�x����:7BsY�����|Sސ_�`��y'�K���|����ʥ��+��llY6��h>��q|�S�E�;�A��������R�G=d)-qs�|�ٱI�����Ƣ���|كЪ��g �Ư����cX����N��C�"sqx��{e��}�ng;m�1��:���)���t%��wgΦr���������!�i'V�Ʉb�H�LW3Ж�F=��H�|����雤[tֿ�%����9+%�]�p�D(�+��1Wۇ��u�QVչ���"db���JȊ �a��5�ȬDny����p��R���б"$;��}���D��t>\^��m��4�����(u�/�\n_��6-�_�r��fJ�aOܑ��@d�Y��eL�z�J"-����P~�sW��o�������#��A����xO�i�V�<j*~n��7��xPХ�k^��������~��*r w{�`�\��N�N���<����-q��@?)n�dh~Q�7����]�G��/6c7�n<&"^�ʼ���f�Ro���a�ݠ�������Y�3k@WW�0ʹ�����u���G�z�|��E@��<ϟι�>nd���7cO�:���2��瓢��L�I ���\�X;�c��+��)�Xd�z1��"�L��5f�z�������S�3�$�7M�섧i|��Ӈ��&Ѿ/�Gg�L�$?ƞ�^� ��jk���ϴ��h��������]-s6īnN�@��1�H�ψ�f$���\j"JhÑ����L����_����vm��������+���:^4C�'�O���1������+%^*���D�F��oC�b%�w�Io�����%��'2ZUÀ*���ɥ��'h�[��<ѻ3ϲ�U/0�!]M���q0b�qWF�a���=@vm�D[b��oh�tۗdg�L����D�N�<�1X5�~����j ��Y� �&+���A"�=�1KA-�_U������A��,�L�����!C��,�x ��W%K3\f��>��ӄ���:���N��և[wVAH�����|�]1�PTw��� �/�M3�n�w� $��^��`�m�EAhnv�o;p��l�� �±�HPP1���hoK�QO������= ��I�bE���j��Eb$Vt����MU��γ�� ���2vd9=|~�������%�������ӥeQb ��RA7�ڔ(˜b��ӏ�N�A�ق .��}�Ч���Қ���y��ĝ9?�������%��!#�b�ò��0;�κ�N [��cHc��i� #i�EI�(�4`)�,��`O��̞�,!E����Xe�sS�k��ȓ��`�#�t�����������G�Ƶ���c�^�+S�q�2�o�9����2��;�����+�F1�~ n�ɀ�~��^�>H�`��sҊ����,>c����9nwz�F'C M�Q�$I`�ko�>���9��`i�{�nJ�p!K����(�_$���Dc)35&��ߚ8�C�l��:̨2��p��2PھW�DA��0Ӿ�����p&�!i�>�:���� x�^`�R=��0mP[����m�+�#d @��?~�r�|���\�>& U VP,��R�T"����Z�w͠6?)Ʀ���Q�0�i���8n���)H�s��j)�<I���f�H�2樎}E�^�#��5���\�E�_�.���@;�*L5*��Lk������I�8�&�0_L�*'� ����=2�x��W�X��0����.�w$�:�SJJ��,5�X��7]�:�9] ��e��4��4���=���#�;��1�ʄ�-�x\� ���R�Ґm��)GT_�m�3dY���v�qsM��c����I��E�ڴ�t_dɤ�B$\p�r������פߌ�% .a�sH �F�Z�i*�,!��M��37��e"��ot«�[!t�V�u�>t��6�$)�`6Ms��M8����45x<Uߋ�� �'��ư �����m����ӑ��P��)�\�-6 ־1�V��bVטJ�w�Ѳ�����_J�K�xrf sUR��x>Dwj2�U�"�:�DG�n)��eTG� t�a��Б1BD0]��*��*q��H�r�U�e� ��Z&>f`w$���CsA��W4,?"��x��R����qY�I���dۧb-���y�� n�B�O~��c�*y`�,Ky�AJ%z=�y&d�rc=���m*>
Behavioral task
behavioral1
Sample
c4c58bbd0c35c30345a9adec8fc40a17.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c4c58bbd0c35c30345a9adec8fc40a17.exe
Resource
win10v2004-20240226-en
General
-
Target
c4c58bbd0c35c30345a9adec8fc40a17
-
Size
112KB
-
MD5
c4c58bbd0c35c30345a9adec8fc40a17
-
SHA1
184c27620c5351fccd334f6a14e616bdd9f9ed2b
-
SHA256
e82eef4f71f22d495100b8cce2e51e155126cab3fc25a82fcdba59d7e923ff18
-
SHA512
c20693adc581b40992b0ec1f2f93781f47273d9d185580acc8a54eba20d3bab25b97b8a2be161be8b8ef8fe84a0edf9a05948505e3b8a74d24d08f9e2fe7b299
-
SSDEEP
3072:lD1pENcM/YHWEF73oEoguNARFHYqdibqWcuHX+:lRpENBYtF7SyHRibfR3
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c4c58bbd0c35c30345a9adec8fc40a17
Files
-
c4c58bbd0c35c30345a9adec8fc40a17.exe windows:4 windows x86 arch:x86
e593591001d4f4bb05c98a06f18a17fa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
_onexit
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ