z�;�ӑ�N�G��ҹ�=�W�+�dŪE��6o�LE8t���{��HjB��eY��Zc�Hʐ&�h�Ů���ʻ�t���D��uٻ�&�����1����ݞ���Ѝ9�G ,�����˝��; 9�� �+�J���<$GRR���ZgM몑�@���^��!x"����Ư���Mt���}�B�|�@p�`�D��h��������X�vdߤQ,>s���c�_�E� ?`�n2�?6�cm�]�,�͒��Br��q��g�������&Xc���Go%�&�ޥd�B�6��6�w�p�^0�E h4�Mk �I��S�\ N��#�q���&t$����a0;�2b8O��&GW��3R^ca�O��$���M��Y�&� �H������2FGp�?<X@���C�b^������cR�6�x�G����[�j�����-1�+&���a��w��~����;�s�4�jښ3[�~���k�݃`��ϗm�%���0��_��L�B7����>��&?4�lI��AyC�@�F�����0��U�'��ڈ�1 ����0��OW�~ ��}� |��g����E���l����|1���L���]P�������a��œe,T3o�9�n&��;*Fzd !Ocx�,T|_�J��D��/�w&�,!� �wtk[R������B|4�����܀)�b��q���"@�fCI188@Z ��cݹ uω$�3.uh�4̎N*MA��%��a��{V.�|�b�j;���Md���1a�[�!�(��n�?B�Ds(lʙ� ���"�Q�ZԘ�kǘ�Y�BxV��Q7�x�>���ͫ�����������kS�1�3o������6#\v��*���C%R~:<��3�E�g,|�D���l�Xz0<߂�����V���ޞ�S�)��?ɓ+QNRH&�L�g�9��A7 Ʀ�a�冸f���$6m��/��62�PDǞgH�C�R� � �j��~m$������y��.k������H"?a�d�ʎ���>?go����L�b���" �8���v=5���3�$���X!�� �AL���ZR�_�� ZJ�P!CV�������|�q*й��J7�46�8���.>Q)������l�;��HZ�T@��/�ܽ�5U��룍�����[y6EY�'�4o��%� ��Qҡa�^Le�u�T�%5�]���3�t�5�Xk�3����Ò ���� *&�jnXА�zR$u�E��v�z�1v�gJ����/�Ll+S�>:G�4� �+3�wry���2���&3��ޓ� )K�"2�s�>��c涜���nb-��s�LG�}L㷊��2�~̺�ri����gd�焙�܌&�d�*I6fC����o���V}� C(f b��y7���ky�5{t�pr��ŵ�����������W��FÓ�m����2GVK*���AA�<D����%ύ�������i�Cʉ���EB<s�l�Eڍ6�F^�]ȋ�K�.V7���ς#��E�H�Q�S�ޝ�)���̑&}W W �aj�����DM��_̂�d�]��=��}�P���D���|���Fw*��*,���t�f�H3àF&�נb�t�ǓL�X��k�;`3�v�a��/3��T�.�`;г'��\�Hi����^�c /�og���\�x> 2��.����Z��z��۲��x�����5�C�?���d����XÑ�8���T�;t3���W7fpi���s�wm�|�Ҵ���c�����!�Nz #�����y���B8�3[���œ�e���L�ĕ,�lQ`�*���dD��Syt7�╀�Z�� ���.�g�.ѝ�)a�����ݏ�:������l���5L%�������rYs:��E�f!R>�xm�$����dy�20�#��4&0�?��}=��[Šdв�� 2[Ҕ��h����/m_X��>\q*r�#fҰ��| n� ���=�L��rrU�w��6bx,�s;�"Ȗq�a��Fxա��'��:4��|�kFq�C�uڤ\?2�ir�,��Α��u��z`����*x�c䢇?f���K50] �=&}�Ԃ6 �/@,m�E 8*\�g��|Xw��b��������ϩ�"����̃d�.�Z, $A�~��ߊ�����Xt��wa����w�����J����������"C�P=/��T`���tt�#�H�saJ�����2���EG��T0��������Ӹ. ]4�̗������P���|��\�(d�o�Rx&!�� )���9ڿ�����@��4�I��,�� �]�ݨ�X8�T�����ɒƩ�<Iy��F�[d\M�q����|���3_b����ì�,O���㹉��k�~�%�Q�튼�\��67����T��Xԅ�ݗ��n2W�J��h��qs�\.&�N���+QMj�5��2;��N���3���g�{���pF�@��sTj�>�3�����!�1�t����r(��� �4�THo� ɻ��;z��������^>�X��@���[P��[�#Vң��2��^��^{jZ�Z�������G�GZ�p�'����"aX;<���ƚ���ڻb��K����y\p1�Nw]��:��?2�{���H�圼��� �DsT�s>��d��5]�f NG���Dm��p[Mx��E���S{W��#_�SQ�dpUKD}{aw��j`�D�"�������°���W]-�+B��;�z�r�ۇ�S�wN(��%_L�9c<��m�{k�7���q���c�S�sD�Mτ��6EF���������d�B�y�քC[T���Bx�V��d���k2"(����I�G����J���oA*���!���o���֒�vN�C�M6�hY3����rf큜u�#���`h�\�u����Sa��̗�Ҁ<������.�$l�+Q��w"R��p�.z5�&)�LA<m���e}m'�Lu'e0VI~�m�lϩ3~��iQ��.��>�2`wV����u%��'��:^�4�Y:���m;�7�_,��U� �
Behavioral task
behavioral1
Sample
cdf792807736f42b4fd634932755e519.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cdf792807736f42b4fd634932755e519.exe
Resource
win10v2004-20240226-en
General
-
Target
cdf792807736f42b4fd634932755e519
-
Size
712KB
-
MD5
cdf792807736f42b4fd634932755e519
-
SHA1
e3c7bd05ea648cbf2223675a7c955e18dd791d1b
-
SHA256
2cc0c09f7f04b81c058ec49f7dbbfa8e31f0d96f671938ba684784ba35aaaf49
-
SHA512
7ee89272032e1874fcd75ca389c14efcf5d3c53f04f9f57ab978bb8fd1da08a0b4adbf8a361efe4f1804db9d7cc73f73b07f4f6352744c4268e1db00dcc295c7
-
SSDEEP
12288:taAwLhZ8yR7aUrwLciq/J2eFy3xS3TAT8grTb2PrvblX90bjTLuXtw3oFEsn1uI:tA8JGwc//03qATzTqP1NILbo1u
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cdf792807736f42b4fd634932755e519
Files
-
cdf792807736f42b4fd634932755e519.exe windows:4 windows x86 arch:x86
d3208bfbc02bd1fd7e89b1692c0a8d66
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord561
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 700KB - Virtual size: 698KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE