Iկo�N^'s�nG�����OTY���ml�70�]��|��'��1��z�� 1G�oI�����Kg��7=v9�c��h�"g�NU/2Ão��Z���@�v�hev`9:m1 K�M�3�yN��H鯻 � V8�I�=F�ijs3�1�g�u�h|��4���pN�2ʚ���(�$���z!��*�:��o����|�����%��܍�*T�>\ף����^�4!���if�>�L��lz3��9�Jo�{�Tox�t'��lj���]@_vd!�rdB;��T��nPp���,T���ŝ��V+Yu=P�Z�a�K3����2���i�m������Na�1?�7��zo��% �`��y�������U�=La�N�v���m1���h/��l�r[`ӮLh��N�`�l9�s���wݰ�:7>:��V�'�0g�6r6�1)�wğ�I��Jd��*J�Q_o�*sވ�8eOv�>džx�I�3ŭ�`$.�i���h@�Tw����S���#�*��v%%ۯ�\D[%���ȗGq�a�:��/�����x��З����g�h�����7�x IX�>M�3~��.X�7�&K(����9�Au��MQF�����T��_��ќ�1�^ZhL�S�>Ik�C v��t Xi&W}����w~�� �W�<��,.lϕ������^`��y��"Ȣ7 ����ڽ�P� u�Cm����`�T�A��:�Kn"UH���ā���b� eJ�%}="댤+fx H(h�0�N�^�P ܄��j�r��˚�R����"u���guk��k�bv���B�&��-Z��?gPT�q7�>,�2M��_>>���0�>ړ�e��xO� C��>������YS/,��g�L4az5��*��a�)�*�MS�-GL��EaUx��1hl1�u.|է"��*7���"�U9A[�~���V 5�~�1��h�4�#�nR�H�( ���㠿q��C�'�������!�|X\O��G�����۬L���5�q�ۛpvs�;�`��Y!�oG6��5�wb�E�:��ZY���6%����ۈ���Tku)2P]��`��jwz�5���q&1Ӵ�[iB���90��P7�t�� X���t�VR.�@�Vz��dn~6h��� �ƣ�}��� *l&�7Qʗ(ʦ:}� �~2a�z3�? �?��VC�6��S� ���{����E���[��v{ki�nj�3�/�7��Z�K��[e�}��JNtG��ةw!�`Gv�L~��0۴�&�0�f�"��p�&�Ȅ�$U�(pDL�P���� ��^��4��pU��(���y����ջ�ȟ3�c�f �4�0��'��v��S�-0�yzc��U'��UP���[5�۴%�7/��gre��<�snR6��-.�ƃ8U/��V�T�r�C}#ׄ �g��t�]$&;{���$�?�p���j����.�hC��x�������k�G���D|��yo]lІ�$�Z�})���{��7K�TdJ�� ��Xx%�7 ���E�R��Tң騑��Θ��Z��/<JU�ै%��և����#��s���;���`��wd�Rq"�r�l�*��ha�G�4&%ۋ����� �l= ��!��2_�!�_T8q����~lXn̓�^U���K�g�M �{*�jD P�mQ���0�1���C~�MW��;� *m �(���t§�@�۔���R�튼�*(�K����X^�,���9K hŬD���`lY��0�Uî���{��R��r���C%KYP�Ģ���q� 2�h^.�*�4.7��㰌or W����.����Ы�ru�?4���}����8�4����Ժ�}տ�=_{XQh!��5���G����0ꦩ�6.�?T����]�p4�W�R�tq*����q!_5�|�4j�?/�%�R9R��F?�z�.�m3̧$F<�9�S �Y��ϙ\���9�2��)�BE)���e�%����6�(l��żb��3Y�%9�5Б) �I�w�<���t�:�a��1��?���#C�+}.��oT�un���\�\y���h4��2<OG[���a?�יǭi�-SDu�Z tc��!�ӻ��N��ߖC*dٙ\����rq8+���|t���zJ�k�V���I��"i�M��kF���|W�@(�\k�1��u���V�7`��=�����A*٣�[Go��Yd��Y�aU�v�7{T?0���].<�1i�`aۊ�DW�sQ����}ᔾ&��L��i�b>$}ũ0������|�X6��OK(�O�2*�7+��y�>r�_N�P7�T7���N�r8��@f5��Bl�����ks�W1�ŌH��q��nZ�;F+aL���q"�m�P���3���h������G��zRS�М�)/���jN7��s�i: >��gv���a��I6��"�p|x/�s�'��@r����T�SPj�CV-��𨱨y̽ ���+�.�F�,��{�l_W�T���P����p�i�[�ъk�K!� �=>p��X;�4�.���x�6D�n�Pf2@ x! �PT����|4fi�%%>|�Y)5[��K�?�=),<�*�ڦ�E)G�����g3@E9���W�ŷ��ӽ�"���K�*C�����0Z��w��Ҟ����П0S�tQ3��B�Ov�)����g��q����Ì� �����O�xD��nN�gv��u�B�!�NJ ����t�Hf����8%Ԗ�i���kR��ˤ�tL�g9���R�]ف�Ț�©��8��� �iCQ�ֹ�P�����g��9)>�4��TnU�5��!��pw�ȋ���:�<���4�v�l�:���bj?o��Iy^��RW萸*m��o��V��O�(��R?Q��v8��1�9���|�0����;��9� �g� B�@#��P�np����_1�����ؐ~zl+f��`���h��*< bA�[*~�I(���헾G�y�`�k�T�k�v�#�F��J�Ե�kt=&��"���i��='N˭y� ׂ����{l?)-Ty\�>�Z%��]�1��& �����0��7�z��ᥕ��_I
Behavioral task
behavioral1
Sample
cb5ceb4928631f4b7430ffa98ed9bc39.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cb5ceb4928631f4b7430ffa98ed9bc39.exe
Resource
win10v2004-20240226-en
General
-
Target
cb5ceb4928631f4b7430ffa98ed9bc39
-
Size
724KB
-
MD5
cb5ceb4928631f4b7430ffa98ed9bc39
-
SHA1
34243238445cb7dbd1a1363fa98b0b27d020910d
-
SHA256
097bb357c088a5925f4e5984b210d62adc50cf178ab746247099ce98960ce0b9
-
SHA512
b007c24ea501e66ba15ebd2d846d6946c8a65e99e8dcb8269e3b8e4618787277ad06802891dacdb629905f44cba140a0a316e7d048a06d4bebe025c82b50bc3d
-
SSDEEP
12288:XbnC5QeFpY6GHApJTEtKPosDXXC+fM9WxnJh7RubOH4R+c9:XUI3ApVEswsNE9WxJh70b0Ne
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cb5ceb4928631f4b7430ffa98ed9bc39
Files
-
cb5ceb4928631f4b7430ffa98ed9bc39.exe windows:4 windows x86 arch:x86
82922cc468979f0c2bd36ef7601ab33b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord578
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 676KB - Virtual size: 673KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE