�H������N:zb�Sdg��,���u�Ցa���ϻ�y�bjy����9�����Opz���p�U�1N#�1�1�ZǟہR&���|�z3�c���� ��ɔ�ž5}^FC����+�������Кb����8��/%+�n�z������� �����!�u��G0p/vI0���-qs�6.\��3[�w��k�Pu�_� t˘�B�~�U�ۖ$B�u��*}~آ��j�!F�(>����C�������-xh�vs��b�',�3�#��%=G>�0�]�O����lbSM�tR�&�����gߧ�l����%��"���.�x������Bs7�>�/�;�lq������y5����SÇ�v������'|6��s��F�V�j�z��rٹ�ջ�-��0��MY��H$����K��?&m�H�̟�*�{Q�#e5V.������dJ��fQ���4ձ)�B�~N���c���=�D��z�`%��K^)�,�A`�BϼPat���k��s���q���hu�h��l�*��P��M��,�=P4�@_�c�2��%�x�G���A��=^N���Qx9��4� ��:��ԁ*��pTx?�,�#�7����tu�2 �ac3!re���x�� ���:���GF�� �!��hxhZ�BE����;�~)�=��РM7 (FGg�����0U��"$q�>�3O�p� gܫh;�V����CRiD���}M�]�)���.�xi(\�Y�]9�eq����D��x�Ȉ+��ޚ��p��y���f�02 �t֫�т��#�<T�q�ο��|X�����'��|�@J���������� �x -�/O���d�Uj0�ְ�nb�UF��@��O}m�L%�� �Q����Ϫv�@dE�7����B�M���Y��1�1_R��<�����כ�{�ys��Uڗ�����R*�RX(^�{�}Q�*HxW|$Y�! ��G�o��i������өFd�w�7D #�Х*�?��5w//�.�L?�べ�X��zN��v4�!T.��:���hD���P��l�Ж�� y�����G[������� �����J���\�__ ǯ��k��BQ#����*)�FH^�%o.V�|���Y�$�ȃ>��"H�m˼�?ӣU��V���1�/NѝF�7�b��"V"�[������;7/b��1���Q��9r�5��glzڟ�//KoJ��tIk^�壨�V��_ ��`�@����� 2��v�T�?� Ë��Tؖ���]��>�c`�s3]c1��k7�H�fsh:����⻝��BZW���{���О�xÇ4�Y�/k�[0����7��͉4��>�))���[-Y��/��{\{|��Sd�C���$�H��n)�m��4�r���s��%xȪ^�6߇�����,,����ځ����Du6��P��H���3��Ϩ�QSjt��̺V���Zk'��B��n�{~Z�-p�{!ZƎ]i$�xS��u�F�i��X>Ӈ$�eg�JT8� F} *da� SJ�ğ�&�������X<)�t�>�V�ou��>��Б���.1V3��}�$.�k)hdc�pE�>�����[�-�p����� `���R��;r �>1�FTԫ0=T�wc�J�Q(�]6���Lr�*5ȅ��7#����i ��AV�f�4��_��'�W����}�W1��A�H�+SL5+�Q��)/�D�T���+J����GU��5S :RG���J��&bhׅ������C���"���Oe�^<��y����%��4�qC�9j��^��G�t���I�����N�J+�2���sV�� ��?�=m�)��k7���gZ�|'��US��hU�|W�&6�����)��v��?*H���t_�n�ܝ���@�h��ª�?̬�Џ1��*_����B����̅�a�C߮B0K���;�ϼ���Sж��}5�̣��*�[��ZY�#��� ��_]Qʩ(]Vl� @��4C�f��h�t��\>�B�S�>�slK��w���N�'�-τL� �6� ����A�����7б 作y�7�^��ۦ�&���H <kI,��o�0�J�/����O���[ ���e4�ǍvUF�v��b9 P���m�����rQS68C��`�L��K�� N,l������<Ua���H���/��2����P'�|n� ��g�����S���vß��Dg��7W��2�T��}���>m������܃�0^���<.���|y�*�Ԋ�6]�K�DP͈0$f)�VɯLY�>6!"�h��Z�?�XÊ0����# �B_ ���R!k�X�q�a�ڈ�*�n���W����1 ՄS�?N���pΙCl�Ńݸ� m��)�p���n�/2��-�!q?��:be��:I�� �z��@���\��z�0����{�W��`'��|�f��<��� �gb{�MU���:��/���3���T@CP���.�����c�Sg�ۢ�y�*���������Yc� �vyM���4�Q��e�p`�(�ރ���'�Y_��^�s6Ȼ>�u0jϘ��>�^���7����N��I��O��d��Nď8�e>�T�H$���qq�C�Fd��Q3��,v�d�OAãh����>��^���C8�fr�r�����8,�_�����r��Hۺ���{������Tg,��!����~�>��x�50a;4]V������~C��QE ��ɝ�O$m�6�{n�<�Jo:�����1��"�=#�c�'�Uf���q�`!���t��:ᏽ��'�[�]J��K��9���_Y�v��"pY �p8_�'נ=o�^���ڛ<wZk{���I�z�>0V����D��b 8��D@PUV OH�S3� ��L4I�YT����X+�^=��Z��c��t���h��+��^���� �������t{�� @��8�������J<k�b-+����Fe����e2�:PĀ��tl��<�1osn�B��W�{�Ux@v �Y3e�Bv�'������SP�$��r�d�~3ri�$��D�F��a�0��� N�v1���Y��m�" ��Tj��s�7
Behavioral task
behavioral1
Sample
875365392d9801b4f6de67e52acf09517dd1741e5b90f0385a803bee8904cf90.exe
Resource
win7-20240215-en
General
-
Target
875365392d9801b4f6de67e52acf09517dd1741e5b90f0385a803bee8904cf90
-
Size
816KB
-
MD5
c26e7efeef74c075d9224d58b5f61f1b
-
SHA1
6761f620d9658e00201353ccc1959c2018d86a35
-
SHA256
875365392d9801b4f6de67e52acf09517dd1741e5b90f0385a803bee8904cf90
-
SHA512
af7f4a8722058ec2ee4bc0d5c52ad8de8388c6316c2af6ffc3b032f52b8067cdee053feb96dff2d6ad51aba2cbaba13c71618cc97f5ccef2ba9472aa89d32726
-
SSDEEP
24576:vS68YscYEzpDOCcbhQCKlrDkXCLw30Q48Ty:vdVscYEz43bnmrDkS44
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 875365392d9801b4f6de67e52acf09517dd1741e5b90f0385a803bee8904cf90
Files
-
875365392d9801b4f6de67e52acf09517dd1741e5b90f0385a803bee8904cf90.exe windows:4 windows x86 arch:x86
7af8944db07024b863969c0eb21e2a55
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
gdi32
SetROP2
winmm
waveOutWrite
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
DragQueryFileA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_BeginDrag
ws2_32
ioctlsocket
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 780KB - Virtual size: 779KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ