c�j�iU%�f�<��S���tS��<H�C��:��]��L ���#�V�yϽ�>��q^#v��(H�\�T�2���yF�c#�"Ϯ���v��\o��*˪��T�+x�WB�c�|%���k8ks�n����>n�aPsU���uC�� ��pb+. }�c<�mF��ħ��e�:;�0�q����=�^��z��ϙVo��BAF�ŝ���Ҝ��I���/��gh�F�%��IqK(y&��="�dE�ƒ �� �"�]�4Q*GAz�m�UZhL��o�չS����Χ���L#<��<ٳ��(��Ѧ��Ǥ��=1ޞWǃ��<��}I�z���$��g���@��=��A;�$�z��Ş�P� ���C�,��� γWO+$6����ը|JPE����Gj�� u ��J�B�|B_}��)�dA�����Or]��X3�U�����%8�`�z��;i����E��/?����̅^��0�q�F�E�Bͺ/�7�q��Dwª�O<,v��gO�>4�/e�{�{K���qYY��ЌȊ�cO'��}���ߜ�b� ��בh��{���{G�s'$�*�L�tHU����$�8ϱ����y�ȅ�K�8��OH�]�'f��Os��jr?�] #�U�b��2*�#;_M�a7ĕ� �� ��������0XV-����fI��5�M�6��-��]N�}���c�P𞟪�v5���܌��S�ҴEX����[��2t�~�Uλ����Q>'D�L�O����+�����J5��ڷ��1:��2���`���� �*b�����S����2�S�_���I�`q��[�g窟�Nd&ya-9���M1�t�o�VĪ��MC��Y,l~��F��t�E���l&'h�X�ZlX�������\(�/�gE��seg+�M]��J��\�F��i�̈́�'��<V�����H�]�%���Z�s�P䯌���E�u6>��m�}r���ȬI4�e�K�a@Ɠ�f¾��vǃiƫD@[�*��|�@?�Wv��%��x�ν�CF�mHT_D��^Dm0dNx�E������J�� ��w���n���O�.��+jnno�J)����\�o ��ܜpf�A�m%X0𱩒����Oء�8p�G ���k�i�yH���C頻<�Z(��Ҳ����1�ޗT-?=���L2���n�A��)�+���b����f+�v]L�I��t��5K�zWL�x^�c����N�Z�W9�v��qI}�8��c|1g(��>�A!� H��'9���ڇQw�����0@�K��n:���m��PuQ%>��� T5yuW4yArOG�i�m?B-�ˮ �'>M9>R�R�������Fs=V �ȭ[����V���x���-��褽B��7��,�]<A+�뻟9Pt�Z�>�A��p~Tګ�1�z<��������0��뭌��������/�#<?�o��H� �q����5��p�\�d��xUD��ȩ�5�Q���}��������Z�N�|4�x���ǝR$�p�,I�,���D){-e-��0����pS�Pp�־_�%9�>�]��n�?�c(�����-w��ݒb�z�a��V,�)�p$�h�p���硊�1�,��">�{�8"����⎲����@���q��8~���SF+��2��]�_��6���̟M: �|6_Q#��N}{�O>iȭOZZ ����z����� ��>Y@�Ou���E�����\��K-���llP�t�}������-�p�ɫ���0��m��`���:������V��G&!ݮ���N�P�8F$�J n����$��\�����Ś�}�=�{�m�C����}�y�tZ!�}�(���h�UԱyX��c+ܡ�T��{���#����O��E�#6�������OH��<��l$���$. � ��qm�rp�������I'T�/�&�/��I�ɳq��6��_cN!�&2U�,Q")����&���KP�tp�}�ĻI��Dh0���j4�<?���PS��+C����W/�b�op�l8�����Ɨ.�����z��_;t厹����4s�1��zh�M��k��3�T�넥(��7R0֊�>�a��E�a'O�l�*���]5�"s`ܱ��x�u.�ޞ���� �� ]�P!;�o%e�+��4���Gk��Cހ<�ʧ�D��q�W��7L�>�C����� l���qBX�0�ײ��':9���q�a�ppЂ��#��6%}�#>�%��f:�Ei���:Rz� ��;4��+�|��q��_5�c�!�c�}��nت���v:d��^n���J�ςG9z��Gl��_ht r�'�T��p� JV�����!)�����+�?G���@�H��QB�J��� ^��[�U��I�����E�VTy�oi�ޢ�߸w���P�}�Z G��A���2:�k�-hu��>�IX�l��7q����8_}�۾̮ ���Sm��}���x���)<� �I�_�� ��*����A���ձ ^�#Z�=����_�i��pyw*�<�[�! ��&嫱� �>�� �t)�42�DqE6�0z�hsם�zg���E�!g[�)��'�2D@/����Ш��.'t�y�&W�|��;�^=�����Ij�,I�Hp+r˛���{�tS� j���;Db@����)0������wK�^�S��.b3�8��o���l-�P�020?Ǚv�6��iz�K̸�W�I� ��ˈ����k�H,�^� "����k�D�p�P�71���f�'l��f�dN�[��7��d1O�m�Tz�v��FG�#n���NO����ˬ߹,�������x��E���(��{��� ���[�'5R� �7���'ծx�~i��.��_�������8z���e������q"f�D<�� ��ӹ��<a�L(.��K�Y��YAP��yK��q�G[s��5K���/��N�����s{4����Nu�����f���������!�>p)^#a��Q6Qj��Q��$��6 �͗���P��ʩ��vZ��L��m(�'�
Static task
static1
Behavioral task
behavioral1
Sample
e43f2ea77f14012d4fbf7688e9f84f9a52028ed2e4decae8d5835b6f2d1a2575.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e43f2ea77f14012d4fbf7688e9f84f9a52028ed2e4decae8d5835b6f2d1a2575.exe
Resource
win10v2004-20240226-en
General
-
Target
e43f2ea77f14012d4fbf7688e9f84f9a52028ed2e4decae8d5835b6f2d1a2575
-
Size
965KB
-
MD5
6e9c5dc9e7cfea61024bc4c9619cb466
-
SHA1
d6b8cb2fa982d3838d250dd66fe4d8a130552b11
-
SHA256
e43f2ea77f14012d4fbf7688e9f84f9a52028ed2e4decae8d5835b6f2d1a2575
-
SHA512
2b610275fa93790d0d7fcbec84b43f4701905be2b4d2a6f2b3cb35407ea693303161a0cef48f3843df2963ad1ad68ca4d48d3723017e0a22da96e91e26a9dcaa
-
SSDEEP
24576:qDtlsCLuwRk3RcCIlxwrgojt9W6AbDhPZH9fu1n:UtiCS93RSqkvbVRwF
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e43f2ea77f14012d4fbf7688e9f84f9a52028ed2e4decae8d5835b6f2d1a2575
Files
-
e43f2ea77f14012d4fbf7688e9f84f9a52028ed2e4decae8d5835b6f2d1a2575.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 370KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE