��$�Ws�G��>Uį�؎c��l���wt5�dde~�heGM�l��u�_Ç�^�<�X��V_M[����xw �#>��b�v��i����ޢ(��%��ӫ�e��k�r�HUGw�=K�3��W7��H}���'�6��Fl��RP(��d] �08[ܒj�Ū2���3��Y��ܝ"��pzj:�x�|��]�N����==D}3�~���v�s^�1�ZO�����R�4�W .i7���@�A���f��=��FB���HY��3iXlZxʛ2�D���\a�6�����]������]:p�o��V��Eo���8S�1�P��]f���}���:��yN�\�!�a����~�!a�/`��V��K�\�)W��@!�K5���~�*�R_B�)N�[��#���T �'���qz+�3+�7pz����AI^X��UqM�(I��:Q�ᕐ�H�Ys�(�J��?pU�,�_�/��`�[��Z+��ya�{�}��{ ~�"�+�#���r�"w�ο��K��-��d��rb}l��=��]�LRѫʲ������)š��+�읛���t���B�*K�Ē�T-V�����DS����bJ'��E�j�^}hs.Oщ�53�c�[�L&-�\fRA\JȅQ�jjy驓�Xi�*><�)��2�ʮs#���F�bK�jkԊ����U|j4S�i��vA��J!��K��}�=�D�FX/�4���k� (wς��/��`�&11�d'�1�7��j1�����-W�ά�����dƴ����|�l*C� �v�O_�|�=lD�d���Q���@�PqH�(��@�QMT"$�;\y1&���q�c�g(�Q���j@�� ��[�����{���R�7��!�ֽRa 08�4hM�t��n�<4si)Y��}䗪Mv�%r]~:�N21��8��`m/5����#�f�A8�Aj��5�1�"ǧ�l��eVLZ�G+8��$| ���(� �]F�I�fj�KY(��04���� �[��?G����g��e�|��ʼn��.DldW�����e��d�k.�q���@�]._<]R�����a^̖�ө'�nMO��P��j�$_/�%��Q�f����\�g�%/ �*я�c҈DT3Ѷ��KA1+3��4��[6�2D[�=�{ H6#�B�| ��1�R��>*�7��;l����/�F�B����ۅ��N�#[u)��r����b�/�~)�.b�������%����Z��+dK.��x�,"��!@J���f�gC�V��% �� o& Y��u�<�����)ѳ(xM�7���VP����S�/4=s�S����l���<����,"����.ttG�ֺ/q��|w�Go���0Ԫ��J`�^�">�ߐ_C���0x�B]��!�u����j���x�A�5#������(���q��Ɍ�� �5Rh�a.l�9�u����Dua�6���>A����qҥ~���3n��x�D�)z�e�o�-#�m)��C4cũ5�j��y)��� ʁ]* �C�LZ^����}��|�C㰜0�1�EhX@r��5�UOxD��7Ior���ӢkDt��Q-q����y����� x�©��p_1/R��5#�� �Q�Y���;�`��錜X��o��Ab5xwl�⫫��N���������aO��a�� .�Y� 1�������J����P����U`c��~��]c�[qrާ:Q�=��JJb�|��+^��7�0A��;M�V�ً0(���e���K?~��=��k�mx��?+q��FL?l7�x�,K=��L����]�cܫ���Z��4��/d@���Y�����+\����n�=r.]�i�<���N ~�9�#$-��/�� 2�p�1�b��5|q�/ �c��Ys�3�a���U�l0HҪo^����hYĤ#x1����##d(UCw:��rf���[�`\�Xej���-F��*|����葒pP�s�T^y�(��{{��c�y��AD���9��X��z������*;z�4��n������艍�Vk]yͤ�y_"����cJ�:u�e����ay�3���������{u��A�)ԩa���d�ᙘ�*[�*��z�ϯ���i��XV?���eLoSd���P�P .n���J����,ۄ�K��o���������p��������L�\\�DY<Dmͱ���s<v~ns��D�ugT�gzy�Gxrw�s�x�B��>A��ڮ��4����x�ւ�Lv)G���T���m� �J�c�����];_��1W�Di�է�b��������Xx����/�n�����N�6<��-y�� ��yv�M �p|�a���(S[}:� �)�s���ͨU >�Yɣ[��k:��a:p<4��1� �0£KRP 8�o&G]����CG���w8f�*�e�jGn^����OOTu�zc`�y�@̳����;�5R,[�w��}�y�c���Qr,����i��eNz,��lQhaC�/����BL��`�w��V�qt4S��5 e)�O�⵿҉�D����"�Ө�r�����c�b�t���2��h m�9 Wt"������?ع��|��h���H��>m|Ԙ����cI�>��~���'θF���S�gs/� �v�^��<����oo&>p߶9T���;cќ���$r�I�$�o�mp��6�X��ggb��D��4]���HE�����(�~��m�Jo�T�}�������<$Oÿ�.��xX�.v�Y |H����bZ��窒�!n<}��7�����}f�O�r�����їv��06m�yl1���m,Q�)*+��8��Т���{����s�7l>�.if��̐�\���W�x�87:�����LɦDM��z�[aZ;��E�n�c�S�� #D�H#*�<�cfrW��� {����NG�+r����-d%qC�z}�U��T:��Li�{��{�/Il��KAP8��[Rm�ڠ��s|W�xa��"p}l���O<��h���sc���7��u��D,/U�!�U�R��nZ�����v���n���X�
Behavioral task
behavioral1
Sample
d7196b9bb598da42864f1a052745f8b1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d7196b9bb598da42864f1a052745f8b1.exe
Resource
win10v2004-20240226-en
General
-
Target
d7196b9bb598da42864f1a052745f8b1
-
Size
724KB
-
MD5
d7196b9bb598da42864f1a052745f8b1
-
SHA1
1479727651af25a250d9d6737e4d5ce584e99b5f
-
SHA256
fa010d0fd46d3e7479c139d25b4bc2f0121c516f2f5039319217678006def1d7
-
SHA512
8acf2dac7e21a35b50714738739d7b4c193b162f9259f6515fe176245a2ebf91bbe4eb6e26f38114bed1691e602f6015cee8abd25222a5d59d56c8ae4a7be480
-
SSDEEP
12288:fSRFRBN5HFXU7oVXErG8Qu3EYZ1UT937FLLVdY7Y7b/inP+QO260h:KRFRBN5HFk7JK5MUT9JfVS7+qn6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d7196b9bb598da42864f1a052745f8b1
Files
-
d7196b9bb598da42864f1a052745f8b1.exe windows:4 windows x86 arch:x86
313181f4bc1668e980805e24afb8ae6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord535
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 712KB - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE