-�A�μ�����5ӢmA�^���jn�۲W �L̆��H\v��'s�.�zIrfO1���Ӽ>v�T���y��mXG�I/�Le��N�=~#�@��7�����_� �hKR���Sd=�T���[�wԜ��3[i���i�Cf�6ď �W֨L�!PN��&�:�'�.�D���W2��oj�ʇn{�cL�s�\��>�"-{K`�ozKg�[��uO7��r���RU��Ȓ������f���]2��CA��E�.!<�6�h0�^K��jvPO�bV���δ�W���A$�P,��D�"����M|���`uZ��(�D��ex���L����cpB-�o`�zF0��x<�ǏGt����4Yؑ��/�#v^��]G��g� �N&D?�����s.z��踶$o��_G0�Q�h8��#@�C5�nߩ����$��{�~UD�N`��۽�U� ���!K�JB�@�2@��T?{��//�B���I|�;q9l�@�/��߫��6)@�RL��s/�R1΅�Aw�1�������x�m�0Gi���ּp\+2k��@ �Pśވ]�p����{��@��Ζ3�I��a��֗�B�@�~e5�����4 ��$:�!��z�N�����H��������JL�����xb��T� ��D�@$���|�U����GZ:ΧD���Z�ܯ�~3��{:�tK�����!�vn�Z+[��F7�]nǽO>�-T7�5����GG �i���[�`&=�o*Bz�%�H���Y��M��)#kn�^�w S�CM�OP7�[��rJ�U����rp"zy�4�{z�^ei�1��Y ���`m�f´��e���o�0u�5�;�&�O]0ے���5�� �Y��7���d�崰g�t]����~�!�&4�,m� �q����k���D9�����i�@DbU�r��W�b������Yٛ�̊��UH$��R���gq����ߞ{㈩ɇ�HA����@ `E��p˛F+UjGW������{.��I�%T���a�j�mc|4��G�}�Df�^��7ی���{ʼm �O,�a���C4�>��gZgd$e���)�Q�)��]�<*FJ�)Q �s �^����`�5��ܛ+�h��,�V���5�Z�!�����_3�؍\�� .�$�d���5������"zm=��� ����&�*إ����`��kV�>g����a�r��B����M4��E�=�Je�j�I��{zצVB8�.j���!o_��X����>���� �v�ƾM�h/��Wӎ�vb��&�����Ã^3Dz�W]�_$:.��<q3�b�h<I�ı4�̂���H���$�z��Ōp�3����X��� ��<k���7��w���r\�p]�NMw��!(��c�|��� Jܡ��L*�2�Ϗ �{��:r�����]�e1�dV"d���u�i3JD�®h��T���e�v�.�IƐ$LL�GmmPz���^ߦ~T���<��QS�rnP� G ��GRPd��dF*6�z������8nĥ�쫨�[�%�Ƨy}�"^���X��x�(wZ!<���}t��\%�a�^2�<?;�W wgO��8����0Q�����#_@F*J[�R������+�wKa����,��Ŧά{z�iV�D�Qe��\ʖ:�.�!Nn^��R)?(z$��^������Q�~���"Æ�����.5[ �`Μ�1^��=,$3sQ����L� ?�i�����5c�n;�'����8�[#��jtϒC�s����*���E�ȍ�/�x(,��z�Y�����1鿆�ؖ ���wv��>�%�������Rm�J_��-���Ϭ�S. hWS��oA�NA�MN���) �!OcEj�&�K�]���V^��K���(�Gy;D�o�}`����۾��M��X /Hj� $�~Y� ��ɰ�v\�����qɛ�q`��X�9r����M�o���`�����Y�٨����s��c�^��C�L.9�{H���ըH �:������> VuMP�Ul�kl���`l��b���~kF���9�`�Lz@-�7�=̋�M���tk��������<�Lsr;Ԑo�d��j��5l�{gj'��>^g�j��W���Z�U�����V�D���[[�繅�>S�ZN�0�ц��*�xi���є�]E�~�] �� y�`�׆��8_]3��H����J��煾%�-,�M�Y�N�����������uhg��`8 ��`�q�K���w�n��'��F;IƸ��@,�7`7}dw��` ���-�wzH�}�;2d�dL�=�� �Vsbi;�wd���oɥz��5ы��H�@�Cs$j�����s>x�c����ǖZ�A:�1����H�崀U<�8@J���=̈� ���C ��è�m�5�i�_�X��ú��~������n���{\t1=s�n�764 �5 r��.�?�h��C��L�� r�C�-�'Χ��)�� ~�pƩ��;�R��Ϊ��b�L�o�ל�����u?@o4����xH8�Ur�t���Z/��d���#���*��VpeÏ�[�$�������V��/�cR�;�����T�S��]����_����~��]jY�N�S��+��o˓H���?�_� ��g�w��t+�E*4] ݥV!W�a{Z����(��7�j�#���C@iِ��30HU��1+�� J��ܽ�tt-?G��K��qwk��D�ˬ]tk0���>T�/2����8Q�� ��7��EE�#/@l�4.S����s^t��8Rf03l�/P6L�U4b��#L.UPQ뿱V�{wW��;S�z��H��EC�w4�#Q�b��a�m҇;��|�'���6&�Z�VԎ���2e��cX}A���N�wl/�F��� ��wb�j&���R�HCi���C�Y�)V{�-Y����e�M�z `HJ|���?e�pH�"v�+�W�kh�"ء(�]0�h����E���?�x4]�D]!XE%>�1fhiS 5�`����)�L� 3��X����G���)-�V��6��R�{d��]y
Behavioral task
behavioral1
Sample
cb203bf5c85ab6b038f364814733b2c2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb203bf5c85ab6b038f364814733b2c2.exe
Resource
win10v2004-20240226-en
General
-
Target
cb203bf5c85ab6b038f364814733b2c2
-
Size
732KB
-
MD5
cb203bf5c85ab6b038f364814733b2c2
-
SHA1
2da84e86c7f4a76b77757c0463c567cc857a24ec
-
SHA256
70552f346f3952977ba3ab34f39784465cbbcd346a7ffab96db3d4ada6e601f4
-
SHA512
13af9886cfcfa2bceba31dd4ec55a6c33ab7ba2d69d4e5f72fb16e41c461f40ac8f04eb49f95b06b3bffd2d13b7d3124759e1a3855e6ba36a594049d1e0518b6
-
SSDEEP
12288:mMMX4cW2h1GhptECnPbpKnwJ2hJHIBZiOdauU5GsBCN06q7hXCJqyvViQyGPapJh:mPX4s1GhptECPIwayBZz46TN0bEJZdiQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cb203bf5c85ab6b038f364814733b2c2
Files
-
cb203bf5c85ab6b038f364814733b2c2.exe windows:4 windows x86 arch:x86
74ae3f73e8cb677bf238fa3b3a4c41e0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord593
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 720KB - Virtual size: 719KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE