�䞊#���kt�����F�+�B�Y\�,:�i��x$VȞU��5�EB�eH�[��g4K(�ٔ����\��m���e���(����S��c�S伏�w�=�'{Q�>xjX/B�I�hHn�.q��V.kn\�[zT����ޟ��N6G ��R� ֚dE{?<3Z>� �+�*�� ���Xh����ތE�Ih�1K�k��+E��k鎯��Vyj�|{����(Tߢ���ѫ�f8����'a��������-��7�t �������hU���IoX QjGz^��q��B��^蛛.W��S&�x9i��v\X��KP#�C�<0����f��?ÖZ�0���)Ll�����_��·���/j7�S��C�� �T�q��e�� ��sn�N?.�Iz�$�X��Vz���A13< D{C��6�F��c�������\O%��W� ��R!DR6VzPSc�:�J���7�n �tj[��Ť2��pO�ʀ�Հua��+���4zT����X���o=�m����c ��(g:W�QAg�\�H��`�8b��Ĝe�ӡ�1E���|�.�,��}���ɯW~]�����XK��o� 7��V������F35���#�(G�a]'H�<�3<�x��,���L��rwik#��L�]� �ꢔqt5�_ݻ>�o4�K-��%�$�a9] ��Ih:5D�0��۩U9=*�r���ֿ��D�t[�X`^�Jc���\8�|r՟*!�8_�v���5p�._�w�Cqf(n}L� f}[q�1m"�=��į��bB��AڢU�sي��aޑ��{RD��V�y@���%��@�� Zɢ��r��yz�2>�,�o����f~�Fz,"2��bN�7v����BִP�O����nRO�tB�c�hP�)HQ�'pKBrk�p,�1�C�x��[8O�ۧF2d�Ϸ�o��l�8L���bZ\�=�M���*>S؎M�k}:U���m#.���� �'��^d���x:��� �f�}=5�]ċl��g���@>c#�G�mY�w�V�َ�<S�T��sJl5����j���H�/�92" �F~zL��x{1BT����<�Ŏ���K"�(I�Pp��z�K�[ S�(<܆$��Kh8�!��p츆(�D�B��E�(i������1���Q�%>���U����d�hj��QR[�������,H���I�6�%!q��A��m�o�΅p2��������5=\��L�-Y�̯N��^?�a����D'����ށ�����9TY#�W�@ڸ"�.�����h�P�ND�IDH����D��$�pˏJK߲G�ս��h���z��$�$�ر��� �Ko����'v�z����S�>3\����I,�ibǿ��b��n]Ty��íF&���: <\�-�@vo��rөy�λ�]k"[����#p-������JRc���o��[��#�V54iPۚ8uC����\���G�3�ث'/�LW�����)��(I����'%Zyܔ�X��y+��qnԼ,H\&��!�qrD!�Z�x���z9糹��7R��ϱ$@]N�%w|i��0��z�}�k{"i�O�)9ͨwʾ��l��@�����p�6�%��梀���.�����JJ =���@B��+��D��\Pnv$M���C�����\͕ܹ���/!�����E���*g-�r��o�#3� q0���X_� ʄyV��r�������������ߘl�d/�UgA���ޓ&��ӯ���{���\ ���ׁ��{+g���.�<kM���C�l�?��z���C�=�o#}�>�eA��F#7��~3����z�m=����Ax����9��vmH��E��6]L�,���81Oɛvnܺ�!��5D�%�N���c:��uʜ9/�9%46��?�Z%�~1��UJ��E�&,��B���z�|Ozz~K+�A�OH�"-���c%�C�fR�����N�6����~�X�D(�Gu:yD砼w�Sp���Ek�@J� t���#�H����/@���z���h7�x����s��n̎%���k�O&�C�����݄��݇$�h��wN]�����>��/������.}$�T\�_��y ��PrF�V%����n&��K ���FKJ?�]:�:Lx�x���d��goWXҔ|^�6��`����~�he�as���T���;�ᜣX�r��hZe���gs�s`3X�d�� ��:�é�~d��k�jyB����K�B(��-����e&�鿤��S�`�,=��̜���3�1"����q�$9���2����e�*9��_ԥq����y��7~�J�$|�U#)�ڂ�5a�� �Rȩ��'r���)P/�o�+����a��l�'��#������"���F �T{w������c��08����-֢'� �� Ѷ�hidi���M��)�jl��.�0�y��2��9@ �}���@X��QZ�+�� �������P!��� ���7���̽���� r���&��lE�k�=�$7�ț�4L�N�8鿂G$��GJ�g �~�⁀�/vPk�s��D ��j���و�P��#�� ��'�]_X�^b�����'�3O�n}���!��u&ͻ{Գ��l���EJ��I7{�)��L�z�R�\vV� r�(0ջ_c���t�+��]���h��VAw��ڌ���m�X�� $��B�C[�l� 5:�*�i��`$ڎ��Fh6q�Bc�Yg�hg�xh�����RQ�j�� ���D�l�_n�:u;b��4�r��S�$bd�Z�J�0bWZ���\�1�r"��KƂ����Cb���Tz��,���v� {�+S֎1����6�M!�a� ��.S��eH�,-�]#Y���������f ���6<� U�2+�3����/�Ņ��?P*�z����i���H���|=��+�i���V'L����g�]h ���ĺ����ᥞ��Z l�G�Z��,�բL��/ ��g�a�����=}�����^C6%fa�3�p�c%���T�ᰘV���e;��rn���s,��I���aW,O��^Ef���.��ʙ�(���
Behavioral task
behavioral1
Sample
df7a4fe8b1812caa4cc3ddb36fde5332.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
df7a4fe8b1812caa4cc3ddb36fde5332.exe
Resource
win10v2004-20231215-en
General
-
Target
df7a4fe8b1812caa4cc3ddb36fde5332
-
Size
712KB
-
MD5
df7a4fe8b1812caa4cc3ddb36fde5332
-
SHA1
0b50ce0689acca10329a2cfc745a98cc1bb6ed6e
-
SHA256
d25b7b04e36daa5856778307b18cb5f394f14440ba08f9ba627c2a47a44dd4ba
-
SHA512
05cacf237781f2cd514bdb172995ef05ed16f35ecc5e90e875e8de4b76fa4760a6f4fd73e812dfa0290b4105eae507ea4b25d10bbbfd934f3176d0d23ae38fab
-
SSDEEP
12288:Rfd3J25+szfiuwgc7YDSRGkqIK0ge4+6ipaJCXbbuxpKsa/Sz3K+X7:JdU5/fius7GSRhqhXxJYuxpra/W3K+X
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df7a4fe8b1812caa4cc3ddb36fde5332
Files
-
df7a4fe8b1812caa4cc3ddb36fde5332.exe windows:4 windows x86 arch:x86
999f0ae4ca3dbead6359b6974f056340
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord546
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 700KB - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE