���b\EP_��T)m���<���C�\�����R��+0?�2��ݟ� ���9�D�߀wخtO�0��T��}z�@�;�~��+\m�M�L��>Uf9K4�8��.��`p����{C��R��u���7R�9�-����/�(�כm'X��/T��{[,�6[0���j�O6�!a�%��� h�hxl%sN�k����n�#�t?=}Û����P&A�I���������Na�T~I��T�a��q�"" �BтH�I���!��ƣk�UXχ)w\�+��x��S��R�e��������E��,��gQ�iu�2 ~�]u�����k��V��?O闿������8TD4�7��o`�'����I��@�����>�o����L����Z��=&���e]�r��Ɋ�M.���MpFl9Q�����ϣz�Q��D�xcɺ�G���D�c��(�rf���bGM�l���~�ڗ���U)��P^������/���l��^�ԟ��ݭ�'�A]���ܯ&��:o���n�@��/3\��~�X�I�I���=���c�W����5��JV���f��sw�q81��Jz6I�ܽ��Ii_��3@_�B��/4`~��x��(�s��+X�}h�&|�����&�]�Q@Ᵹ.{�9JE�]�Z�1�������;ꗎ$aE1oo7�#*N;�]�>~�K��VK�L^��R/s�P�&}������$���$`����jFs�]?X�V�Y2Tх0�= �-R;�ܫ�� C7�Kh-���hj<�`G�}�>}��y���bh��j�hOd�:I���X0|��Az1������`��q��Ɖ���2���#�Œ��P ;�ӂ����cTH;Vh+!t���a ū�лPs�>��`���HX���ჍyϿ\k��T�.~��W (Aԇƹ�:��^����[x��W�]����o͕A����^�)�3l��%W�n����6Νd]�$�?�'ܯ�m�5�?�Z����e����|?�,i�#Sܪv ��L�ŷ]>ˆ9� >�Ȑj��2��\5�H�6�<��<2�۪j�H��j)6�������U��v�)W�a݉���3ǿR\�#k�/����ǚ_B>�v��Q�.il����Ԩ�;W��J���� `�R���0�����;;7�?��΅d�J�ʳ�7x���&�̧��$���]���BQ!�N|3������j��uw��+X��� �kjsF�^, *2��?����{.�G���_m�T#�Adz�ш1BN��?���-GT"�a2Lo|�bXd��̸�buǠ_n�X�-�|�*�/�J(�_4wyé�;� ���<~l�=,&�݈hE��b8����؎�z����y�D�C ��~�l���Щn�?�{TXdj�r�<K�|S�u��*�(G���� To��-�'�� ��������ғ�[�Nx'L���mٿ� P˦u��K?b�=�]x��ABh2��ƥ�$�����G-����r�hj��<N�CKv�N�Q�!���w6}e=��۬J�ˮ��=fs��<��P���V:hٓ�8)�^.+&�x��&0��@҃���b�%���Q5���InlW����a�D�&Wdv5�I�~��]�(ٯ>�="|o�����G�ʴn���.ڔ�3�\t0�z/�]��NF͞-����d ��g�?��\��i�q\�+7�OC��[�u4F�"�>��W�X�����5F�� ���1���f�X;��R0[��;�:62Qů�Z��^J�t��,"���SuSAM���r�pyC�۰<�\=p�?D���S���E�:/��Hjw���e�z@R�?=<�G����|�z%�Ⱦ�]��/9�+s%,��,%xj����JwRA)n�ů�+���`�e@\W��������,��#�����x:s��>�W4��(�������'R��Sm��->gmS�M"�� -�OD=nL�l<Q�Co���)�/(/�@��A�L�bpD]y^������E�0{&����E�f�&�i��D�t���ka��(h/�G���J ���}0?�oD��]��Й�0ngJ�>�k�wO8�k��jI2��Ԑ�dR <�9etnw�WXVR+E�M�'d�j����kj��I:����Dv5&t����ęj�O@�>>W*V��*�������;�c���z0-��!Wa���H;9lK�9��&]#���!f)s3��{;�R���]c��S@�L�����Sb*y2�Q�;�$ԅ�G"�q��L/(��~^� �wچ�H3�S�E�Q��N�x��8aQ���j�����Mj{CL����}<�Ax�R�`�eM {S���D4pt�dy���yH���K� ?���vae�p��&��{Ғf�!cy�p1��;G�d�D�@��ߑ�YMA�<�z"rx���]��y���0n�|^� �㕓2a�w���y��1�2�T��vq/z\$�!@){ߣ%����+�[�7\e Nalb�z7c�H��gOS.�_�S�&P��~�e�>�R&^c�L���9I[���K{�Eە�ds+��(W"�z�7�}����&C�q0b;'�j�4�_Rtr�^*T�^��J�(��,�v�N��(��E��[������ꃥ�x��L�S������+��۵�q�I�D`�Ny�̐�= �t;D��*/� <��2ȩG����+�)���=�u\v ���ě㤎� *�X�W���=Wo֠�R�٩��7�ۮ��a-��?�G�k�xS�@���p�Ƀ팦��6����KX�So:y�/ct��y1#���&���zǿl�E�`i�&�I�Z��-�Q�"L 8��Aԛ]c�=_��-����8J��7`�p���8�ߚ�G95dFԃBV�eu� ��� >sXQ�HG�}���~�h��������,��ڗ���%��,��lG�hq�'���#"�}���ьi%iWUU�)�G����1�����B�^���m,��k���P䞜��2%:�Y�9�Z��䤜����嫕'�@�<�d!T��_�_��z��۠ēF1�����1��-�m�y+%!t� �M�
Behavioral task
behavioral1
Sample
caafd74580eba5512bac18b545508e2d.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
caafd74580eba5512bac18b545508e2d.exe
Resource
win10v2004-20231215-en
General
-
Target
caafd74580eba5512bac18b545508e2d
-
Size
712KB
-
MD5
caafd74580eba5512bac18b545508e2d
-
SHA1
ba96d56c3e945eab66ff28af9a01845fac96429f
-
SHA256
17d7dbb51b7485068c9328d19192cf3aa506e369995d01b826bbe5fd51996e65
-
SHA512
bf79b0871336cf582a80887f6f3888fd2242b91644be7836066083a783d8f4dfe6130c0319a8a2be8a864ce515068c26612e463aaedd701b0685d423877ab367
-
SSDEEP
12288:Ew5sTxIBGnaKSG8817EM0d2PzE7Jrlx7FukjFCBSiPpRxhiHPo/cASB7gmMGmzB0:EcsTxIgn5SG7pEf2PKJrl2kxCBVRxhV7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource caafd74580eba5512bac18b545508e2d
Files
-
caafd74580eba5512bac18b545508e2d.exe windows:4 windows x86 arch:x86
aa2023af729a28e2f0380307022a466c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord714
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 700KB - Virtual size: 699KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE