L��ވ�M��RHd-�HL���y�A���F>-.:L(�'0 ��������U�\��lXH���u�"��dwl�H�p��@:���R�*�EMϘ�ҁSaBI��A[������!���yZ�Iʵ�D��z"n���\� d:r�jŲ�y�D���0��L�&�(��p�_)��4 s�`���p⠙(&cZ�>�����h����K�i��RHE���*~��襹�@�Չ�q��Z�8�T0|��~Ru�fߧ��j�����^ �s�l�����k�SwE��<r5���#%^�b����e4��Y�n��>�F�O�}���胡և2��0�e;�����d�� ��C�(���y}oQR�����܊ۖ�IU�LQ�)�P�7WN9�Iyu����6zws9̗�Y�"a KގF:��D�W�`DB�a�6s����`?$DSs\9����ۨ�9����+-�Ѿ:wD��)�A����Ϲj���% �����^��d�����F��S�B��#��O��X.��a:|BP��39~n�e��J xz�F�%�(�6�����T��k���7���S�RL�3��>�;�tv%� ujws��1>�i�#�7�ݽʂ��<�*c��gOCi4|�Zᮚ��1I$t},�+%h�֟�<H����R*��At�d�@�5�K����� �T���ڠVPRp��{I`bPo/�B��Z�ҪuiV� gk'5�Vtd9����ʇ���W���� E��yw�0��1��̦���#/�jI����Ju���֤�>,���a�c���8����Q�%/p�A\�k����0X�/����s��8�J@Gm�{V.˺U��,E�{����� o�,�m���ڀio�V�ʾe'�U��#!|�����7ޏj��Ky*n�;d��;t�k��f�����)���H��|DH7҈l�q��ѓ_�H�����j�qR�4]��t�|6N��ۓJ��Fo<|6�;�>:Y�3n�����T]��3�.���E'Ls�l�G;O�8oUß-���a��Z�_X�.��͙���3)��s��J�t�Af��yB�wFs�X��ޫ�{��:-VV��+�ӭ��R�樟���=ug��@��z����Z 1D��|��q��"�h�4�]��It0gKř�;Rva�������(��V��@UG������I�kc��w��ԛ���CJ�ɩ�l��I�%�gEBAl|�&�b�p�H��6��+����S��#b��h�H���^�E�����6�Z9P��1KAӵ61���3���������h�UU�>,c�Ԁ����| Dؔ�� �la��$Ր�y��gw�@��4 �r�bg��%ȰM�IF)��RtF*]ܞ�S�69ٳD;o�����k����$�u(=x�Q.�}ۙ-d�XK�?>\�Aݣ�D��7o�Iz��_X�^�Ov���� �(��A(q���Yd�s% q|���:%�wW�\���;v\.�]�72�My��m�%��K"M(�=�".���8�-�Xb��&�x@�2 ��v,˻�` ȀB�����>?�ub-t��y?goÀ�=S#����d��L��~�,�b�Q-��9��k�}'��!�#/1��V|+\��rml��у!`�ʱ�j�Q�+�0�?��]Qo�fk�����y\W= b&V$�Hy��}����3�O�O�FIR��N-���-��NV��$����n����`_V,��y-�߀&#�O�NE~�s5d�����:�$���*��ơ�7�������l�L��%����!(�)�Fo0+����6�R��9\�L��� l(Z�w�^D%9�xZ��x��Q�r��v���t�L(��_�Xڻ�|+����9t���-��@�3��c��dh���.$:Hҭ7�H0g��Xl�Ƽvnru3Bw���ѷ��q_*O�F��@~�6��N6Y����sm��K��S�X<ݓ�Aҹ��y��'���������\�U�рb�����R�N���Ey���Ӈ�ּh�T���Fh��;ʸB�5S˻��w�!%�t`3���4�!<���zG+_4n�s��r\l���%��� �� ���nJ�D�ks���Ϸ�*�s/���l��緀��/�s�DQ�=�!��?>���PJ��}+`�'�Xs8&��U&�(L��0�E }�!��Cn�fv&����y�ᔺ8�p$���vg�����������J�Q����=��I4���G��)�w�r^����&�<�6��%�'wy�J�^#A�Ow+6>7�M��A`�ܕ�^'l!Luc�/ ��������`�Uy�aq��;Kl��܂�m��`��'�34��r�GX �����<��w��|� ���V������8?Bt =5�c�������D��G��j|�����u�Mn�߳�B%WZ1���T�k��מ3����) ����/seM���\m�'EM���/\6@0��~�d]^MT�����fܟv�S1�1�[ԵWy�;�ߏ�e=�.�� �t�Q�n����ͿL��4�+*�����:l�V��H�,Px+�8/������K��$O �]��E��ӊh��f��dc�x����@�I�z�O���{���m���W~Ϸ���Odǥn?��3y�v���Њ���i"L�� ��l��'@7`?��Y/av3��8P��{q�uC���k�R��T���7Il/�µ�W��x��ѯ����O��.�7C�q�����#�xx�q=�Đ�5B܍����.��jGʖ/���(ʕ}���'+[��1��3"�Oh�]x2�1��E�T� @��р�E����k�%&qǔ�^�(%�{\MpA�a��P�V�v����z�}���f�m�\D<7��a��dY�3䢮�O�ֵ��p�n���E����Ǻ�X����h��g��A��+�I�Vs�3hp_~I7�D�K>G�{ǻ�Wzɯ�W�� �*�b{�Bkމ=�Pgʶ1�ȏT��bW8jX��h�y\Hn���\#H�qQ���R����w�r4#��D�0PmN�`!8:Y����ȁ<��lE��&I3��#��#�����B{ڙ
Behavioral task
behavioral1
Sample
794dd5011462cd2778088225f9ce3bee3b615469986a6bd68740458dd453c919.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
794dd5011462cd2778088225f9ce3bee3b615469986a6bd68740458dd453c919.exe
Resource
win10v2004-20240226-en
General
-
Target
794dd5011462cd2778088225f9ce3bee3b615469986a6bd68740458dd453c919
-
Size
1.5MB
-
MD5
0ce0aa90899fe2c4d5189afae50501f0
-
SHA1
a081279f6fbb975fc65ba7d73fa2e598cd575d41
-
SHA256
794dd5011462cd2778088225f9ce3bee3b615469986a6bd68740458dd453c919
-
SHA512
7776b0f23f6fc7e6dbfd6cee0a391a60f9d9221ddff5638525eea78d5edf35ce033cbbaeb8a59372a6f58986fe6fa4241b7c44f350297cd74de033cbafe2b1d7
-
SSDEEP
24576:zq22pkPCmpgVBTW1o+Xb9TgqKnbWF3xyWRLgwcpkxEsuWUB5KnM7zbO:mJkqRVGaqKnbs3oWlgCQB5jO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 794dd5011462cd2778088225f9ce3bee3b615469986a6bd68740458dd453c919
Files
-
794dd5011462cd2778088225f9ce3bee3b615469986a6bd68740458dd453c919.exe windows:6 windows x86 arch:x86
2634acae35f93ecbdad72096a91605e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
gdi32
SelectObject
shell32
ShellExecuteW
ole32
CreateStreamOnHGlobal
oleaut32
RegisterTypeLi
comctl32
ImageList_AddMasked
gdiplus
GdipGetImageGraphicsContext
ws2_32
WSACleanup
vcruntime140
memmove
api-ms-win-crt-string-l1-1-0
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_configure_wide_argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
ferror
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ