�gq�7����ftk"ڻ6�8���4ł�ʀ�^�?84���q�Wi&̌���E��2�Ě}���o���\p������"����e��`��~r���%��<q�Z~���XW����vr��a�~��0���bAø�ful���j���$p:��~��E�������mN�=��u��R������(Z�?�i%�17r�{f.�zH zn��ƻ_B�\�����,�VT��k5��O����^���? ���y��P/���V;���#��D)����.=��<���9����=�w �_^}�u/i���ttM�c��g��8I��\^ى *�l]Rj>}M�cT�-2�ߨ�_2ډ����(���B;�$�i�-C4���ux�e�ޘ��;D���;���-��.��� �gӉ�$�g��:; �c<�R��:�|gl�<��Q�s�+���{o�r����Ig[r3�|��$�r�ߥc��a�sQ��]���=x����A����d8�x8��[kV\:z'&�����J �j-�ۑ(kU/�E N1��44�1�<t���d�����K����y�f�;,=Iui?ז�?{H��0��=�S���:��(3�L~C��ǖ�4n.Gy㤸��� �KdX]���әx���4/1��7�7�K��v�ʝy�^R-$����Q$�:c��I��+h̶VR��IjA�Z."�8���ai�>�AI�f�Ly�ډ���1�K��=�lq�r��GOB!;j�������Jn3������S�~RSpăI)q��Ŀ1@�($���-����Z�?$� EUo*�O\�Ե��\`�iq�8��������pk���4H2�ᇡvf2)d����ƫ;����K�<>կ�����{uZ�f@������qTUӰ�����E&Q���ؙh?+�n�D�¢1��n�`_��d��Cm���U`z�cAQ�A�8�J=�6�.$ϖ�d��U=���Kp1 �2���<��\t\�o����TU��63����D�@V���4����rb����*�a�+��%QX�l������˛��3�D���7�7�A��I�.���F:w�o���<��O�5%��^j��|���I�(tfj9mV��E�)|o��~�}%*ww���#��t�l6��G����;�oЉd��h���6�N(��hz1����bi����Ueg ~�Z ���+���d;�i��A�X��&>����������ѥME!����a��QF���?V�`$>����n?0"���+����d²�~�������x�(�r�&��5���� U�IW���5ˋmh��[�4�<�d�KT�(�##�xԻAR�u�����dh��"�ndE�'U9�Z5��3Kxe��m�E�!'��J!�_ �I���s=����hjd���+G�晆kPG�qB?45ѳ�[��o�D]�O��K���8q"�H��7�O���t�!�K֓V1բ?M,L��gCNW���؞XS%E�**�:�m��O�!��@Xzr\���h�LPR��X�4�zڦz}O�#` �/�Ĉ�E��������[g��!�tВ�#@P=�$��B����������<����7�� ���z��������,�|�й�ځ,�� ���|������<����༣���se]cS����fc)���!�_��*�_l[t]�MԫC����f�2�i�ψ�V4�4p�p-�k���.Ȝ<~��Tcd����N��;��CK6���}��g(Z����F�\�2�WWi#��kĻ9�f��Y�/��}Ol������u��J�0lV=˼�t��9'SX�j)�1���x��� � �t25�5����EW���tU���r���_&M�씚S+D�JMP�qu�N���zYb�q��;~����g�Ş�; �t��_��h*����m��� K��ꀴ�ns�8�,Y6Φ��JM�ʢ��gr]Ѱ�`��F�đ� {�ݏ�6����Z�l�i��b]�m���R�t���������-�Qs�tn����~��<�+Q��b�:�j���+h��3����YL'����ak�JD�M����L^�iw-`�\�_�rD���q���>v����˘m�Kߊ��1�`f����+,����w���t��a����T3����3�~>��#�EJ������P.��-�m1�b��lޣwYf�բB�����0���{$zf1�lU�œ�ܪ��R ��k���`s(��ހ�4b���-s �' �0W;�3T�cS�7��Ta���Oo��!����=;np10�2�c��C�[���,�kM����^��D?���Y t� F%֨��8���d��5ýNH�ڲ� �W1�*�6���هF"�e��-d����Bڳ�ی|jg����%v#���_6.?�9 |E�ra+�%�m���c_��m8�"x7�G� ����$�w�e<Q�ע��X����} \�!x�YQƄ�AŤ�_�/� ö-P�p^s�|�nnr�%�������1](��vW�lw�ǒ��5���@�/��V�������s��{w ���EIn� {@�S��ֹ��n�B>y��8�r�e��B5S��K�e�ͽ���aB�?���Yu�]�,�m�ݲi̶m� �[.�k�$a�[%�������(@6���Ak���YI����o�$X�0j&e���ǵ��(��@��x�n�s0V�N�Un����<�z�9&vc�@���V�URʸB��L`m�g�闱��u�K��eH-$����~��"ʡ��)����nD��om��'��O�']hɨmvqĂ�ދ�����������Kt�.�^�kE��� �Y)3����h��f3Wg�{p$H�m�+a�ED:�*���aX��rh�@C -Ȏ��+ �t��hA�/F�!��!jE��� jD�o��n�G��.�M�-@��Դ��}�A����KM�9|�h�&Y*��K"��Ý�~��>�!�'sNͺ4�ӝÈ��t҆�6�x=G2a0t{�K� �� �l��;5�
Behavioral task
behavioral1
Sample
a7a6c8ce8650705a2dec218cd5713bc7b52954ce73d10330842ba9c1c3e66f73.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a7a6c8ce8650705a2dec218cd5713bc7b52954ce73d10330842ba9c1c3e66f73.exe
Resource
win10v2004-20240508-en
General
-
Target
a7a6c8ce8650705a2dec218cd5713bc7b52954ce73d10330842ba9c1c3e66f73
-
Size
1.2MB
-
MD5
8f4f6d1aa9bf713d1519d4a41e06f8cc
-
SHA1
8e50b6a4ffbbd6c8f82596daa4d3425d27278b5d
-
SHA256
a7a6c8ce8650705a2dec218cd5713bc7b52954ce73d10330842ba9c1c3e66f73
-
SHA512
d33d57b1e7791b9ed8171c043bb8c1b20e0fc4a8604e53973983a5afeb95040dc194f960d527bfaed179c10400876ca97dc409bfa00c11f992bf97f7f0ea00b2
-
SSDEEP
24576:lQ3Uv9DldKagfRYiwyS/akUPougPNtKk7e/8JrJl9si4F:O3s9D7KfpYByS/akUPoH1dJsBF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7a6c8ce8650705a2dec218cd5713bc7b52954ce73d10330842ba9c1c3e66f73
Files
-
a7a6c8ce8650705a2dec218cd5713bc7b52954ce73d10330842ba9c1c3e66f73.exe windows:6 windows x86 arch:x86
930dee546bd214f664833c1dd9eb3577
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadImageW
gdi32
DeleteObject
shell32
ShellExecuteW
ole32
CoCreateInstance
oleaut32
SafeArrayGetElemsize
comctl32
ImageList_Destroy
gdiplus
GdipCloneImage
ws2_32
WSACleanup
vcruntime140
wcsrchr
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ