�u���:�Á�6LD��� �u]0�}�Pk�+]���җȂF�S�EWZ��d匶d~���[.e�&�^^H�I��^i:�~-�Q~�]w�ʠP)HSޅ"�*��ֺ���ذ�������g 1 �P���tH� 5��5���s���6���YJ��_�(�.Ԧ�� ���<_�d2�axY��%���W����;c�lOR����z{X]�tcA������h�[`t����h|&K�s�/\wy����������η��$��[O,���P�P�fSE���K���'�I[�.���*�ޥv/9��W�$�� ������z�W�H{�����,���u���+L�Ҳ;� ��&�P ��c���� ������<ġ�ɮ�3�#'�ě.�1�]������ iЊ?��Y��F��m/�_^��#w�|�9�w�E �������k���+bd!�@��x�ӝʗY�� Mknb�!�@_��bp���&��K's ���e~+�WW���N�/`��j�ވ�B��}���@�|�F�y��#eޥ�3N�/#�v6��ڗ��W����8�H�$��CK=���T*?�>�T�̪�;�x ��js�dw�uo����������dGչd�����y��_��k!�H��qD6V�I���I#?���7v��[c�8���m룽X�M�<�~�=?�,�jt�EۨC��F�}�+�n��ҫg��Ϳb�N`*���!������z����A1I����K)[��<U+�}���"'6sM����(��y�5�Ż����ߪ��5�)��x��с ��9�LlЖ˿����~��瞬�*�x�b�4�Qڣ/�+m��!:��P��z��,����x}�j���U\s�<��Ď�!!�:��4��v����0����f���;2J8�!�� �1��hhs�"��&��f�@��#��*�Uv�,�z��u���B��0�����{w��e�+�`$�q6���\Ō��G��?J��HPG b����6�Հ�ړf��j�QMl��?����$P�����ư��K�\9����JQS1��Rr!����m���K��ߤ`g��ݣk�h� �#z��]�"��Ši��(DyL)��W��[�p-T�m cAos������M��E��ƾ����Iѕ�p���^P0T�������qUP3�>�v�E�3<L����S�`��rR��,�t9[�oC���L������4_H�Dv�J)���X I��)������ýa��(捩*ɇɟ`�m�1B=2����`g 3DO��p��}n���GSs�6�����s|����R- 0ǵ��MOw2���kJ�/&��|Ʈ�>wiEZus�@(�9�,��A0��\pl�������i�W�vd�)F5_�9�J���r���tV����?@�@�lS@� �+o;�EV��8����6hF���3�-����q�'l���J����2"�擼�D��cƜ�J����No��y_���`j[X�z��|�w������H���M�4Cq��"�,��|��,��mt۲R���)� �F� RM�]DA���;�4�<m:� t!��iq���BH�Rv����9 ���VOH|'�=+G/�xnB����A��)���2��Z�SP��,�ZSZ�m����-Vjj �+Ez|���RU��A���7ίB�祸y��JÀ��GG��ĝOf� ��L����h�~�����$gP-<> ������@ѽ�®>����'߭��Rg�@XLaR����'�֚35l�5�5���I�H Ď�64�{����?�d�C�z���'+p�S%NTEz�@��O�nj� (�Z��t^9K!�pf������r�,�-0�y �MK2���ݐsA^����+�o�m98�����=���FK$�\d�;�Z������_�� X:���G��{��<���֦.�OJ�^������91-��z������P{:�x��h�Z���˔���� ��py#�"�����'�Y��Z�$k��!��7�a-)�M�D�� ����c��@�K)xH9��י�+�����/{����L�Յ�a �(�~��鈣��3���A�V��j��%��=���[~,��l�H��.��Z��$o����q��Yx�ҳ?!ٚ�œ�c���;u@e^��`�V�֠�ׂi���ciw��<"ۆ�Ls����^�Ǻ�����e�� &�H��yt�mέ7���Ju���h��r�.���V�WV7��;����Ä\x�\����nwx��mSc2����e`&ڡݡ�u�r�1�� ��s��a������=X�.��2}r�;ȡBB�s ���X�u�6sP��V?'�|r��+��,M�覲�s��y!�}�����aV�S+��_���ijܒ�w��ؽ��t/u���Ա���O�wy,ṋѧazh�X�`yd!M-5-ʋ&�u�J��A�Os���ξ�ƴ��fL����n�@u��PP��ܚ�Me�tK3x��Ͳ���Djo���S� W�o�Hhl�p�|�us�g�����?�R)u�>P���2ia_�1ZY�J-�Gp�� [,X��uw��g�_I3JX̻��Cjcٶ$TH�.��m�43� @���?b�AS G!��Y��ծu����3���oY\�����f;��RF���P��`�u�*����,�g��������sBW0����'�������3Ȭ��%����r��wF��jj���O%�v;�8������1��쮋�͎�n�K����^������U��©h>��º�� T��[�j��%��C{`�E3��92>u"#����>��7����/��,��n�x/��$��sNK7U��T�|����D��>kzC��)u�76H�ؿe,}k�8������%�j� &fE5|�m,�\'�d�B厘��)*�4�¹$���~�w��<�ș6���2"�G���st�~nyzZ�v�4(/��N��A�4����PA����D���t&H�˒�q;4m���hR���n���� ��O8d��ϭƛH�|�0���Q�Z�B=��m�Ț��̚�jȧ/��f>��Ƹ��uB*�0�S���O>�bb
Behavioral task
behavioral1
Sample
e654254f022ba58d45661916f7244381c78ab35292329f2773a4b9c5f69d0e1f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e654254f022ba58d45661916f7244381c78ab35292329f2773a4b9c5f69d0e1f.exe
Resource
win10v2004-20240412-en
General
-
Target
e654254f022ba58d45661916f7244381c78ab35292329f2773a4b9c5f69d0e1f
-
Size
2.6MB
-
MD5
a774bd133dcd92e701010d261e1308ed
-
SHA1
2b2ddf907b2d9204c66450bebf11a45f0216ab98
-
SHA256
e654254f022ba58d45661916f7244381c78ab35292329f2773a4b9c5f69d0e1f
-
SHA512
d840ef2665c07358d1744a101eae2535986d03deb098b5400cc93ec021470a215508a827cfd17d95be5658334e37448988004363094e0ac0153a4d91f546cd14
-
SSDEEP
49152:AUhDxBuMZCBblsvj60ba2/5wBDxeF0bKuieMiIBZX65y0o7OOL1:AUhNBuMcdlYTbz56tOlo5yniOL1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e654254f022ba58d45661916f7244381c78ab35292329f2773a4b9c5f69d0e1f
Files
-
e654254f022ba58d45661916f7244381c78ab35292329f2773a4b9c5f69d0e1f.exe windows:5 windows x86 arch:x86
ff4b2e8305f36ff37d840e49495893cb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuCheckMarkDimensions
gdi32
CreateRectRgnIndirect
winmm
midiStreamOut
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
socket
wldap32
ord29
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 649KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 963KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 255KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ