`\����ze0����H��^fc?�RsZhj7��]�J)�j1%qr�r#� T���ō�N�h��m-Xg�������n϶��1�ko�Zu.�LI��1�Z�u���t�������͆L.��ѱ)s@d�ȶ����Flx����dp�EM_�0�ٟ�XF���I>�.F�Tc֗���q�O���R��7\� Q��C�t&�I߂"ؕY=�� ��g�'�*D�M��"HQ#�r��Ω6���'`}h��'�����֑�%���T��LPL#?��Qö1*�k쥚������b��:e��G|�D?�D���|P5B<f6����rs�?VBJ/�<�2�ߪ���w�C��A%IP����NR���=�Q�=�X����ޤ�o;�0B2D�³��3�M�A��nȯ_$<-�1c��7$��[ƻ���LV�b9b���)�N� �L����(���� C�����a���ZL�}��F�m��J��-���i�3u-����;��V��w����T��sk�0ܢ��U4��O���`�Uk�A ��N�����ߵ���1�����{IliQ�=����E��E�[���u���V�D��m����W?��Lu�Fc �x5�+Qp�^����:N�-��TC�,�O���3}���{�3�Α�.@Ӡ�|���ʿ� ���o��&�ռ�d���ǿ���(~J�*d/EIʿ��}a�x�Vqf"I���:�Di��b �� ����N�m@W=�Σl�t���\LĨ�����O~�� ��A� �!�te ~�����v���V��)O��ΰ�C��TV:�#T�8�u�2�0h�Nl��b�2��X;�5~���t��ñn�@OX<w�wzε���6�A�v�zOa��M���a��1�Q�-�ػ6zC��Nڨ�ch�2�-��b*n���뺘�.��Z��� ��K�g)�qoe��$��Â)�n�_F��o����a�7�*3��ۛ����`�eu��g2HM�^��- ˠ��{I�ݧ�9tu��=nR T�(_���}����FĮ.̮�~o����oq8�����q�3�P�k�S���jw���,�aD��k/N� F������5�����V�]jo&�0P�7B�[mpn� &=;��b(B�'1���=����L�A�d�C�����E���_G��_lX&�A�zJWC -'Z[��&����is��>cz3M$�����*���9�U��[Q �+�&Z��DNk�!����2�J8��ƺ�i1q�&��Ddhu(��EjW�<W �2�B �J[hs 5s� Q&co�#�K��5B���qB��:�C�px���G��wl1�tg�[�D�y� 4�̡;O�B�ù@��|�K��g�7z!rκ��hy ��Y�U�'� ?T9�]<�n�`�ٵ�<nf='��?"ms�=��� �K�Y��#�iP�҇V)˝)�cf��轂����0��X3���~ )����4 �Ľ������9 et�ٗ��f����/zA��À��+w9���"�����8�g��g��1\��ZE��lB����O�$�Z[$_��$a?T���|�`ܨL��[.'L3njt^G����'�����)7�f�3�3ı�^z�w���=�4��7'����F� �Dj@����m��`��!>�T(yP|^��.}��a�)� `�^1���ds�f�C��?-2�����47�G�U4��oY�����'��L:��,�؆�M|���=�N@x���!+�p{�]I��E��٩m�#`���if���n��5|���TWU ��q��j��=ع��eܤx��~u�ʄVۘ�]��x�"X1�&�����1� 3u����l��\��� �G1�U�ި>|^.>��9�e@��3����SV`I �J�1��Ĉ���F�<�P(��NyK,[��Jq�hιu:���ǎ�]�e��J�!��f�1�`��Z�������8�����G{�Iȕ�=����Y�maW� �<B\��^��G�}��o���U���,�����sؼ��܅�a����h#l��`n��q"CU��]��d������g�ě\Xp_�����1�qFv��~��d\�#�Tտ�d�y��,�����Q���NUG�ed�#�y4��ʕ�`�����N���.����`(�@U�7ĕ� ������z%�@����aZ>y����H;P�+�רg5�}P�;��~w�?�pK�y9�n���c���L��X��������H�N,�⨦f~���Ԥ<�8�0�ҝ�ͥo�K}�(��{��M9ݖ�y�H@�[�b��,��ui'9��QL l���3_X�Ъ�`n�N��wV�cYb��LH! �J,�S�Ҭ�/���� �DF���Fu��� ��p� )P�J��Ȓvd)c��f��ʼnĻ�rnV*Jo�-�&�w�G9IU�[��h����^��<}�"A�e��ˮX�������ɏ�4O�}��V�H�yV�차Jû��#����ļ�� Ĵ^�Q�+Ѷ��s�6,n�V���_��*�>8���~����]d�h<�P/m�I��*�7��H ���F2� ߂Ay�n�����DkGe@�h���[ @~�j(��MĞF��8��a�����us�Aִ.��NRp���1�MX�ٴ\`����1�:�-1jd ^�! �����g�9�}�?-0Qp��~k�e�~I����N������OTh�@IT���*7��~NLȄ��X~n|')YYd��aRSX�v�����f��m�m�ZCf��p$�q#�&�io��Qod��#�vƩ���4����to"<Ts�|�z`�6�����!�A�����3^�y�u`����~R�g+Dc�;��5�^ᝁǙ��5�E攣#�����d�V>��ڹ���uƩ�&�0b��bc�V^zC�0U�1oQ�����ۍh����M5�#�Iߟ�L�����|+{S;�*E�VDSOr`��c��@�6��[9���,�{�%&���; ~P�ߔ)�]��B���a.�{Q��yX�A���=ʅ��0}�z�r
Behavioral task
behavioral1
Sample
d601a40983eb909da658e6abaeada995.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d601a40983eb909da658e6abaeada995.exe
Resource
win10v2004-20240226-en
General
-
Target
d601a40983eb909da658e6abaeada995
-
Size
66KB
-
MD5
d601a40983eb909da658e6abaeada995
-
SHA1
63bba62a2dd5adc582f4d6a6a11433e88467c00b
-
SHA256
c2bb0ff94dc65a8cdab6dd10e56a499bfc7b9cbf492f64b83ad85b22b11a12b0
-
SHA512
7efd3060b91d1430ce81b6e434fbb1ee96e31ca97ed131b668057bef700e4a70d0e6a1de51510d0c2053a74bea5f46e6c1231e278ffeb1e7fe266067ccdf4417
-
SSDEEP
1536:wrPJtUyRrswIAQQEsVAW8HuxJYDBX+vHbQYvmd8Yk:GJtUyrhIA2sz2kyBOPbQYvmGY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d601a40983eb909da658e6abaeada995
Files
-
d601a40983eb909da658e6abaeada995.exe windows:4 windows x86 arch:x86
790f9809af987a4bfd7e40de28a38793
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
PEBundle Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PEBundle Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ