��/��O���(�eM|�a��s�K�Q��B�N��{�w;<y�'Q�>�vP�ؗ�*Q��aF=7@F��.�{��my0����W���e���4y0n{��p\. ��P*#�iŚ�<����v����4H����u���=���A�xLq�8�^ s�ޱ�4�l�?6�|a�w'Z�*������Ѹ�}8��p�S|��+�>�����ҽ����"�䷴�g��Q���s#t�'��)�%䘈n�cی+������oV����M� Nl�Y!�d��*ֽ�7�d��Hy w�RCד;1�p^S����</vdy�l�}|���s���I�����l0 E���/6���yX�CA��1�8b�Gّ���X�R���kR< �~��UF�{ŗy��]�ő�2v�-$���i˜uҫ�lS���J�S"��P���u�];w,�z2~�ۑJ62�_��v_��i��LYQh����]Or�������~��ˈ�AKT�F�G�S_L���-�c�fҽ��g�lcL� d�&o�GΛ�7L���M)������ �a�"5Q�>��;�<�����rx�������WL_(���h�6���)Z��P�럂�{��{u�n���V�4���z8?]ʱ���4�f�C�B��6<�U����%�n�8��G�ԗY���������^R`9[�636۰���BHP���ГR˓E /_�rG_��a���f��'2-�߷��Eh��ef��6+��="��;X��!�V>�$�N��r6��V�s� F�1GH�]�$ ��շ��/|��C�wNs���c&��n*M��EN=ۜAC}P1�̣C��0��=���!��Zy��w���W���s�c�B�]�]XWf� n��"){��(!z��g�� D�P �v��W�N.31�#gX&"D� !���ڳn�G���6����p=��3�mH�����GV(�o���)$�:,k�L�ۻ:{Ժ}xm�� Ε]t�yO��� �L(��S�j�B�g��]�=�Sk֞Mf`��6�$^ �T�}���ˊ���T�J)�H����<r�g^���$e]����,�R��xZ����5O�k &S!��1��&5�w����丄������Z^�Jb��P4����:�'N��4Q�J�ݚ�h�w����4k�[�L�흹��(NB����tH+^^Zp�;ù}۔+�(ȭJ��-͜�G��`��?�ұ#�����g2-!�2�|�s�B���܄�P)q.@���q!�j�r �A�r�2PӖ���9��^��`�����k}�uP6]a����L��fRW���sO�������p�O�v���O��l��H��?�q�� ^B�x8��9�2xy������߃c�Գ���Lq���E��L�C�x)W������k�ϐܻ pB/�i�9 (.�l��v��!y���%�=*M�����I���u ��������{�b�p�ߒ�Ij�[���eZ�z]������H+T����rHw�����2��qA6>�d� �(�:��m��[���bGT�.�A�L9�cymXĝv�9�`-�L8���"�(F��"4e1Աg��?��z��B�ʙ'�NZ�f��%������4<L/8�y�i 啄�0�����Ss ����|8��@g��e�G�(�D�=���O������E偌Y($б)we�ć\����Y/LT�K�6�w����U�W���٬��:5����-�VL�D�Ln�!j��(���]Q���N��.?��=�[c9ζT�bc�f �bH�7�0E<���ư��*��w�6�n{i�� f�����V��m2@��~ճK�ot[�g@�/����mYI�H�� ���J�$���Ԇ�T��[J���h��&!�Y���rN��@}�wמ `��o��sW�j�� �ߪ.?y"}�<�?�Y��"��=�:��K<��b�h���T/�o��93�ې�էR+�U��-j>�������o뽿zC���o���,��3���f�I4$yr�� �9L`X�@�*���,¤ő0T�Q��̄�;P�_�Yz����B�h�>�un��2��G>����'�n6�>% 7F7�����ɗ>��1�y�N��Y�S>�����^�O��`)��w�pxY�c_-[��. ����|�:�O�W�J�0#^)�:aTy� �~'+�r��G����5'x��!y`ڽI� Ip�3� _�[�:o���cF��:�O���!c�c�Xw�أI��[("�mDj�;$����W�'��n$�ց��o��Q!/c�\�W�s�v����o�7�b�`(�w��q)j��--k�BW�����~?������|�:�jv�A ��7=���\?���l�� ^�%O�40�2��þ��!K��="�kg�C����� G�Dn�f3�͘O_� ����)�����#���7�?;�W���G����˪�%PY���X����r٢t =�r�v���_���R��;�qJ��ہA�U���_�,-?.��^=tC�v�X�����C:/�B�5ۑ)�����vV|rHd�����jU�GKj��A�9(St��*����cq#D�6wi���1Ȳ��� 5U�>Ňۓ�i�h�.�8m�2���L l:vc�m��o�\��m� Bi"\MzL�U�������Ҽ�5�bHA��VS��#x]�c�J(T̙T��>Wwjp����6���6*fH�>9֭����n�ޥ����si�����N]��\�65�R���K��]���EF�h�'��[��c�|;6����h2��j�"J1�(z������3���NV{�6��B���]���Q���2䈋�F��4� :��B�S�������a�eDM�;�~���J��<᭳z+*�Ԍ���!�r-H(#l�����25��E�]��E����@;O��B�� x{;�i�TG���h��|0��>��{C��M��\]�8v;�T�SE>g4�<,-�s�$q2\����Is_?�F��ڐ�on���֤*2W��JR����>W<�@|QϬ��PFY�#���@�������
Behavioral task
behavioral1
Sample
dfa42dfcd88ae3fca8d1e3790f9b2dbbedf96c8b900e8613a576fe56f7948ccf.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
dfa42dfcd88ae3fca8d1e3790f9b2dbbedf96c8b900e8613a576fe56f7948ccf.exe
Resource
win10v2004-20240419-en
General
-
Target
dfa42dfcd88ae3fca8d1e3790f9b2dbbedf96c8b900e8613a576fe56f7948ccf
-
Size
2.3MB
-
MD5
672526e71b85b4b0c156f6ff1c74f0a1
-
SHA1
e9df265037ede7405547d025c0a39d4b6c341c14
-
SHA256
dfa42dfcd88ae3fca8d1e3790f9b2dbbedf96c8b900e8613a576fe56f7948ccf
-
SHA512
0dadfc2d3ee38369931a0e7274d770faa9769ff20dbee0e3cfeef79637fec6a3826ecd9a61c612eb4d0aa2a877934cd67d0f9b1b8d6b0f6aa4f320e3f7ffaddb
-
SSDEEP
49152:QIYp/ljaqDCfGGzysNVtLH9tEffPDzCh74JR01HLpzKv:nYljcfGTsxLHbEfXDzkK07zK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfa42dfcd88ae3fca8d1e3790f9b2dbbedf96c8b900e8613a576fe56f7948ccf
Files
-
dfa42dfcd88ae3fca8d1e3790f9b2dbbedf96c8b900e8613a576fe56f7948ccf.exe windows:6 windows x86 arch:x86
cddccd93cb1a3cbe2de3f2a6336347b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumResourceLanguagesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseDC
gdi32
GetObjectW
shell32
ShellExecuteW
ole32
CoInitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
gdiplus
GdipBitmapLockBits
ws2_32
WSACleanup
vcruntime140
__std_exception_destroy
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-runtime-l1-1-0
_configure_wide_argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-stdio-l1-1-0
ferror
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ