X��3�P�Ne�'�!��el��NcA$��d��53���� k��4�w�+[ǟ����r����Q��B�f���(�!�Y���d=d *w�S*_�!�cN_�_����Rl�������c2T5+dxϠ v��Y�� ���k�!|��0�V'�U`������䎓�;����K���S�ļQ��|����'���#��Ͱ�s'�NY��x��cI��ki~�0���B��0��G�V���?�$����X��)�M�L���#�e��:��!8��B�0�O�VP���$&љ��k�<�s����${R������� j�Q� L[+X�[�EA��\f�p��4�V u"o�cGMo.8'�'�L:k%g����!�|�D �^�Ȏ�,afU+s�1|R�"��Y+���QJ���՛�����r��(���[���9�"QbJ��l����R��~�/�Y֑�SҠ�ᤜ����uI�q�oP���L�<;� LA8��[ʧ�:�=;!�_�'�$P K�����̕� ,���R�e�@���X ��m��Oĉ�?-:�U?��4��9�mx}����GφKA,����g�@�_��_d�'����L��Ѵ��/%b�WCQ��F$��QL��=��f(##�1����n�C��Al*_�h�Йk�SW0�"��U=���i�B�{�*���h�T�DW\����vr�=`�e�!��wY�>8���p�Q8"��*�I�0Yۊ�"�=��g���:�7� ѝs��c;"&)���V�=5�ZEP�O[q���ga����^{�����֣��r��qUO[%����K����!4�����-��G�����a�h(�c�Koj�P6��'�#�M.*����s���z��h�豜���O���q�#4���M�$m��55xm�>`�/t������Ŧ���t������%�v�W+j霹�D,��ՒYh��{�_�6'�,_�{j�ʞ1�Thh;��zt���x��V,&OP��UW�rX�ҭ+anS�羖�i᷁���- 8<2�D��?�M灱�Rh�)ѡ��T@K9s^PN5��j�6֚C��9��",+}���4�v7��������H� �,2�uH�Q�ks�x�OƿT����a@�%���M�= ,W��j&� U���F�w�]���l�u�Z���FW���O��iDu���knO���߯�W])��i������q�.�M���S��11QI���̭�`ٿ�z/l��3�Cܥp�le�E|�*�������ϲ����Q6&�'���N��L�3���3]��<�E�s|D{ㆬ�<���V��R�%r�����f����X�e�H)��$'�v���Ľ~̡r��h��N������k=G&+��JƧ7�]�C��,�s����{r��r���S��l�>�NV�IԢ�+R�NKm;�Gi[O�Q�*�7,��<D)����F<ݟ�����sW�G� �5GYĘ���8 ��̭P&�i�Q�l<�XQ(�4��]l�>r�������� %v�`��r����s"�+�5�>{�Y,~y'��F5�z�v0F~��dR��Q���Vx1�:�c�ڇݭĔ ��i�P��J�+�0Z�& �Om*]���|����ya�℉��GQ&`�H��G�l��g[�ý^�*�|�Ǎ��$�r7���u���f8�\y�V��v^��|I�eP��2�����?������f7�´u�e��C���dT�Qⳬ?8�Rd��z���F��KU;�����+ i=���Z�Ί�h"me�I��w�w��5�ܘ{�5�qHkWW��Ǟ�8ATQH�u1�4�(�b"7���֘&�2��[����R��ۛA)�ԑ�;���u:&6��d�4�]o�Hw~q��\ �iK�AV3�s�u��S�1؟��(d.s����h"������%��s��ʨ���n$����V� ���h�X�~Aܜ���SS�H�Q�T-�Tވ1i2��,;���3B�U���� ؤ��ldZ���cSS��h�Ov�Yr��* 0�"zwVɞ�W�6$ZMU���ݮ� *�JB߱�-�5�v��<ε2�����\x齩�pT���M*�|��b}��rE��詽�U��!�3�`h�s��+uo�Y��n��?�)�� ��Y���O ȹ��g,�;fC�ڦTl�|Ӣ�vE�F�x2�����b�����I�� �V�6[�6/|>!�o�'���}��)X�e�����z�n��ģ�`a��-aY��2VTE7��%�!����n���;�b\=|%kn���K:/��gV ���m��ChϞ�|Y/�ZRX�$%�N�rVM�������m��Hxt��A���*;�=��< u�l w�W��Z�q�i��'��|���9�F�GDP�QwLr��H�y����lyCF{U�_i]F]�TIvd"Ͻ�x��x�`G~ ���d����&B�zo=�0�w���T(c9�C��9�2�g#��ꑢ�� �ʒ���88Xu\R���妰��-�J��,9�o�jd��_֡\����n������Nw���=�o�����ۼt���@�F;e�H�Hj�sr��1m�� mlkw���;-���������ʿG��)1v��mu$yg�I�QE�� e�S�ܾS���U����&_(D'���U�x�Yn0��nu�h2�M���P�����4}7ОH��L� 6D��3�)�+h�¯H&)�26Ӑ����Z�BB�$+T`����9Lh71�J��Y����-�(b�)��(�Y�*W��z@��\F�Xb�%��H���9�����H)y��H�3�B.���Q�����_�6@;���h9D/�.:{�;mt�F���z{�Bha9V3Q�4����$0�����k=�k���$�A ���IRy��;��6���l?$*�����ђ8��m$\�R��I�|�[��8��%�6+i�z���X9�q��,�tgc-tul�\�MЪ"��m�,�����\����X���R������KȅM�Ҷ�����S��ڭ�Ʒ���]�_¢�Ѿj�T��Rl�
Behavioral task
behavioral1
Sample
dfc1437a8f833c8ccb70b301d195179b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dfc1437a8f833c8ccb70b301d195179b.exe
Resource
win10v2004-20240226-en
General
-
Target
dfc1437a8f833c8ccb70b301d195179b
-
Size
732KB
-
MD5
dfc1437a8f833c8ccb70b301d195179b
-
SHA1
30c40f1c94fc3b1a57144de8112b241bd85dcb8e
-
SHA256
83bd0836a5eb9b2af1546935849e042c884d1d7ca4270c149b81db8e325f230f
-
SHA512
96ef5549096464c3dfa73f659dc6cb0715afd1b5aee5d595e497ff794da2c48d063657c6712ada73ee17130cc62165b22664a57a11fee828c2f69b8b15db6194
-
SSDEEP
12288:4b80tCk3l+ixadK+GB7YYMeSursaDTANHA5A/in4NvmUJjlRtmW7kcyGHk+u:44alV7+GB7WWb3ANHNU4tflKAdpu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfc1437a8f833c8ccb70b301d195179b
Files
-
dfc1437a8f833c8ccb70b301d195179b.exe windows:4 windows x86 arch:x86
f96440580f44ff5191d3849e5b520878
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord600
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 684KB - Virtual size: 683KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE