V���+ƈ�+���u�*��w��P�+̌�⌮G���M��f���%ADk|���3����s��]�^�-�V��Y�}��:Q|�8*�a����?�] J��+�{��"���p�z��S�a��W��5�^3m��\A����v�Ì�Kӕ��ۢ�wfm�����-'�9��� ��A%N�:�β8OZ�2_����G�s�KM��%0��#&�1Nsbm7���ns�=�`��+���'� I�V��s��$�� u�Qƻ��dH}��p����_��,R,�,A���"C�Nh`B�`a�7��vK����]�U}�\�P��{FYSK��`y��jڗ ��귒�W�`d�M4�7��'�g�E�%ëԻ�r�f��H������q�Fk�g�� gkC��lL���e��B��q����o�@zE����������LJ���f~�Y��2���(t��@5s��[�f�j=s4���4�|��=��l�|�!̔�Y�l���"�_A�K��ȴbӔ_V���N)� ���~���j<�gqۙ������"�7�]�����e�9���eJ�c<�vihD�Ӎ�)��/��LU�+(] "U5�E~�����;nY�9�-�K��3]�"b1.���w�Y����8�\a:!��'�oK�c����p�uc� ��ƴ˾��7F6]�i�o��jw��1E�+7�R-קsŊ���G�ɚ``NJ��5�[�U�~�>za�+�� �[?����F3a�Lh��=�r��5��_.�{���͆g�Jh��Kz""1�2x����[={�������I�����;0�^(5�`&{��v��9U����Y��d [�G!}#fӯ�`��^��]��E��"*�QǼ�&@y���v]�r���n��<Bq�)z�CmFX::�6[�oRj�\0aLmM9��r�_0��n�_[���Tg���f����rq Dq��� ט��!������٧=�Y�֛�J`Vp%�i<G��X ���c3��B�����@u/���l�Mp�˲Lr�!��T��k���H6��� ��z��r��D;R�D)I�6]�O�wj��x���wWM�^\y_s�ЫA0�%7�+N�;k�s�����ı�n���1_6�w���<u�RΈ^J���:����+Y���@�H-\zá���D����>�����g���X�����e�y��:�6J{��&������ �":7���IR���D�\>��e�+͎���ehλ����5�.�P+���"�� M�_:-��aY��ó�#t6X57������K���0���_Xvz�Й4hS�.i(�'�̖����y�������� la �ř�}��sj����̫{H����~b��pj)��`oDL@5{��`,~$��FO����sx{���k��Z��Wo����o��Jt��;��*#���D�l����܊\����U�ڥ��]�]~?܍J\�i�s�b����^H7A{�gyZ촁��W�*�#� x���o/kv��iw���8[�+ꍓ�ۗ��T���d��n�u�{uI8c�i��Y��_�Â���R����#��)T��7%�� ���ŏ[��<a%ƶ2$(X��z!o�b��R�T����W�w90��O�ú�_�s'h�]�6�z�\��h]��!� m���V�&R����2�qp`џ;]\�� ��N�U�]"��¶f�p�n��PȖ��xP�m1�wVSBf�h�R�������Ŭ7���CB?W�ٝ�*�Ţ�?^��'/�w�ۡ��d�w�� ��~� `_uS�_��Y����v#j�;6��Ӂ� �1`=�{��h��&-+�87@�6�P���ɅB�'.3;�&֊�U�<j�2�x_I�����">Z����N���,nQ��+`4M�W_���;��"�D���0�ϑ� T&[��;������o��wtA�����g�Fa�ǔ�Q���<t��5��6S����6�9����J�k0�N�4u��m)�Y��ǭ�����=�*�F��RW_�gc��h�o��3��Q� t׀a_��ƐT+'�[i3fС�a5t�X�� ��Y�������;���.���Z!q�aa�\'���J_@+��q�����Ie�ۙ~ˉр�%X}�-a�A)Mce"��R'�Hp��Î�̽_9)�_�*�����;|GS�Ȓj��#0]>}��qf(,�Y���<�'���RIA9��N�)P\q�K�ۧ��#iz��&H$T�.����$?�Av��� ���������`�!���l�b۰ܢ��iQ��'�~G��s����]����K��OH��V9(�"���#����iBq7J����D2}+�"��%���]��� x� ��|˄仆��~��� � �u?�:�~23��f��Pgr)���!��3��界��[��jЮAى������1h���SHgʖX��7������Sy���F[�/͓�`�u��)����N� x�"�R�}n�J��d]�T� (&�����qX�����������s�����c�DMQ�J�{T�|�ѓ���&X-�{�E��;�B��Ù�|�t�Qb8�*N\�Ƨ�� �p��� )>(F����T�����®d4r%)��vEB�p\0�p��m�r�}*Qn�+���`���K����#H�� yT�&~����L��#���u�����+OA��@�&�T2��z(��� ��{�ǻ�^�Rv�_�i'�Y�$U����s���3�X(.�|���^��`����έ������Jn̟�=�iE�\�W?0A}ܗ��^߀��T2 k��� ���귙E��iO&r=�XD+��� W'�Kf�}�9��S�%J�PN��F�~~�V;9i�)���NH�&�P��4�I��|Eu���R�a(밦��L�g��Z�v�̚��wjQ2��X�?�:9��*�ߴ�Z�7Z&� ��(e 1iO&#� ����vNBS���:���o9�4��F�@������~=�S,�o�z�..A^���(P1hM���Q�qn*Lc���ʈl5S�����Tœ�T��.������v�a�o��]k~>�.
Behavioral task
behavioral1
Sample
2076f2c5307b283647b494683425d2d659b45bfe591f77cf13b1a0b064453592.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2076f2c5307b283647b494683425d2d659b45bfe591f77cf13b1a0b064453592.exe
Resource
win10v2004-20240508-en
General
-
Target
2076f2c5307b283647b494683425d2d659b45bfe591f77cf13b1a0b064453592
-
Size
3.9MB
-
MD5
09577596d34d4bb57a1ad06e6bbcdeac
-
SHA1
9bb573d81e5bb8ea2715bcbce8d6071258b6b0de
-
SHA256
2076f2c5307b283647b494683425d2d659b45bfe591f77cf13b1a0b064453592
-
SHA512
47766fddfcabe4eaa961b149530d09b8e9f38ca3f9529acfe23d0efd5ddbdcb5afe67542675844ab26045082d5f02afb11816a11eef4862399aa3d4115484600
-
SSDEEP
98304:uQeNhFONjxUGnpaCzXv3UCiRVjPLh7jjI7EHvFlMCFAjJoEvIUcUC753QhaLyS//:/egNjskXvkLHjBXIIHvFbFQaEwj9u7W
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2076f2c5307b283647b494683425d2d659b45bfe591f77cf13b1a0b064453592
Files
-
2076f2c5307b283647b494683425d2d659b45bfe591f77cf13b1a0b064453592.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 756KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ