V�H������ĵ�|����=h�I���m�6|��j��h���7��:@�p[2��n$5Q��I�-kDvS�o�S�o�b�)m\٣� p�$����O���8g��iP�h@�� ��������|�����p�)�S�^3#��7k��%M�^Խ�y���V�x����AO��p �q�����C�p��0u�pvR&���%�;\��i�,��BA�Ն@��̮.�~w�[�o���3�~3OaJ�/�C?J�vif��NbT����,P76�iϱ��ˍR���6B{�.��X/�r�ø�����3��^��o�BT�zA����P~qC��E��-�n7�����%nؗ�u�|��7�i�{)v���F�XhgvU3J⍢GO����"�U�*s1r��4M�1X��ͥ�� `:���yzq'm"���FB��<�X ����*~�����4P����&��x����[-���N[5�Q�3������.���<^�����'�Z�s�M����$�뭿��/�`j����3�B���{�'(ߊ�]H�O=�5��[;@�t�G���4�b'���r^���/ �r�}�>��؊8�`OD�"B�q�.�Ju��I�n��`6~���{X�����rX�j":Ŏq�A8�u0�V��jn�dH�=����5�N�!��$ZKJ�m�(��P;K��, �� A3{�ު�"�{�7���c(�f����Zh{�G7�.(Bk�'�a���!U���TXäl�sv�};���_U{QE��X~�q-���_6���R��<���@����j��S&����g�S�^�]qHZ�� J��g�]��:��(���~ }���_s���bQٟ�3�����0�v��H�����Pk�P���^w�c���F�ai>��+0T܇�ޖ��ըm�(�\v`�QĻX\�+��A�Ylٽ㝘�R_O���Wn�u��p�V���+|��Z�M���:�±l���A�4��^�6m�rPGomC��f�i�ps����JK����_ahj���u��k���I�h��hm>[)h% ���v���G���x������o�@|EX�1� ���_�h�v�,�g(U^H_WJ^�R��DG7�D�|��<�B������)g�L��C5��T��oS��p���FC�acM��m=�=�R)5���hZb5�-��%Ú�-w*�.�K�qWs��#O�B�i��Q�P*��r%ײ}G�T!q7��=�����J7�5C��N\v/�Em9jfENo1aoȰ�B�,k��@�� ��mz��*�T� G����Y��+r��~�w��;�=�� �~C�>�X�p2�{u�f���U�o�+h:��-��+1�@���R�����D)a�i��}ޮJ���o&����a�X��ez=�{q*��3����ߝ#�m-����"S�!�7�=�C�=��J�\{zL��y�� ��|G��M�'t�]2x�i%��8�!K�B�pN!�w&����ſ�I0��|�*�:�����`�|��{":o�}8�/���ț���l�d�ȭh�R}+)���;z�#$����b������()��k��ՠ�@�������5�O�i�7��.�k��ji�pJ��5oB��A���=��P;F��$�b��^����&�����{��r6ie�-}"��߅���s*����X� W�c��?�i��qH �Dχ*^���7���qdH������_Me\K%ߛ}[u���i�{��(�M��XK8���C~I(����e��E�ذk����խ�X���ƍ��6 �☉i����t����//�PNՈ�L�V��b��aL�� 6㙝�d.a\�$vIv �6'䰤#��uAލ)oR��ѻf��2���>�Ag>f���>��K��F�?ӌ9 Wy����B�ƙ�BN%�S�)'��4��+��.���gk79!~��VVp�1����� �=�����W��,DGq�^�.�o��S�l:��d'�����`BQ�<;��\ ����0�Z����z��#�<0?/��$��^=����E{5��9~ر*�����^%����k��|$E䦡�u��2.A�ט*�D����n�#�~�M��>�����:Ѷ�1�!hks�f:�Q����8Ww�\�%1 �_֑�j�j�<7���Θ;r�L����.L(.��ɩD��0��vAz�vj*�Db!��Dv5q>p�K8��֡ ���;���EN)�f?�������^��)�1��9o�[{t?o���$�y�y��K�Ł Cm�h|Ma��s�Ù��֥`��u�Ը��ϕd3ӏ��d��n̑89�I-��h���z'�����'��-�J�E�d�4�јW�-���p"˃"*���L^p�? @��^��l�9���8��O���"Tۧ��w瞠"lV��U[?����w2/j�,d<�b?ML.�<�B�k��M��dm��ξ����!�0Iz&:-�+�������D��{z�t ���)����缇��)E�������}[�M�8%U��N�W ���������Y)��k$Z>E�������G� ��k�"�M� �H��ܚ#"P�I�)V��Z�ޗ*(����Y#!�o��Y<k�6T !KN�}>���=��۵�$�����w��6$ՆnF7�J��;T���e\�_�&��a ��?ß��`Jd��-��v�����,me�ө^~��y�خ�pXT�뻤� � _w'�B����*����NI��t��k&�P�j��9I�@��*���?� �2O~�ꠥ���`O�09'���o�n�LB~r0���q�L��C�>p"�z�7����+�����~D�X����RSQ<��rf@��9�iԡ�_��!b��pE����؛���Exd �붚O�$%� MUqv�,F�� OH;r����p��� :s�WP^'��Yt�2�Y�@J�=qE�F��|�d��V�e����D-�%�����F��'�)@<�t����M�@N�>RP���`r��w�M�q,�IaT�J/�����8�ٖϘ�Ã������4w�?&� �����Gz~%�P�"�'a�\Mv�n���
Behavioral task
behavioral1
Sample
d7a0da513a0728e0c7b41b9a2ca57e05.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d7a0da513a0728e0c7b41b9a2ca57e05.exe
Resource
win10v2004-20240226-en
General
-
Target
d7a0da513a0728e0c7b41b9a2ca57e05
-
Size
696KB
-
MD5
d7a0da513a0728e0c7b41b9a2ca57e05
-
SHA1
a9b02cd45713fd908b6dee14b01d5e77e4a35258
-
SHA256
22a20c3529f3ae8325bbee92e8fc9dce05e96f5b4d8f844f2eb346b438703c41
-
SHA512
f85c2f92a4f22bf1e5b56dd2c5576876211fe4ee86434f5ee4b347a3a8ceedae4b2fce3baccdc2d3e392818f9786c11979957d89fe2403ec15f3e5f71fb490c9
-
SSDEEP
12288:f6IC8YPXp74I/jY5QNYHoHJqenWz7dgRbT4t3km9kCSG+COftv/b:f08YxXjTOIHJrWz7dWbwkmaN5ffpb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d7a0da513a0728e0c7b41b9a2ca57e05
Files
-
d7a0da513a0728e0c7b41b9a2ca57e05.exe windows:4 windows x86 arch:x86
d0971f93e4874330df2f50bc4b87a51a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord696
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 632KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 680KB - Virtual size: 676KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE