�}�%�_��1�S��sF��MW?d�R:�M�$^�d5����M��d�������1P�A�R���68��*�sVI2�#��6�6y?�b��w��.Y q]�d����c�_�E]�_<"?Y<b-�������@���o�0i�����_ H1����[�*���d�2��I�V���hm���eW��v��bƂO�hִ7���L�����F�{����`k�������b��<l���ץ��:@�A��~[�i�;�ܗĝ]{�-�{ٷ�������g�K���x{+�o�c����TtN������]B�j}+��"V���[��u�`�i F��[\��#��8߽�@ƽȉ��d����װK�������q�R8A��J��|_��&@* p�w�*Cl��=���\��o�a���v��(C��:r�UR娷�%!�Sooq�#�k�G��_ٓ��4麳�q�V�bzv�%�I,D#��]�yLٱM���>�<��FN!���+��)����`�{��*^tdҏ /���i�G,}�*2��KB�j��[h��`�B}̨Ez��Iᦳ8���%��[��J�N�ub���*��?��sj��8GJz��,x�,������ìp�S�A*���i�� ��]kdW �6��z<�1�q��3����G'~B9����"b�gW��.��g�2�V���Bɀ�ŧ~pWU�ͨ/u�I��,�6�{����l���h� � �I:���\��'i�$B� ��-X>�M!�w<Er�ޱ0-�b�(�D����Yy-\l�?�,g.)��vPq� @S�nti������ggbs8笹-W����ѕ����4+1-�)T�ej�[��'|s���"����)`��t_�O�i`�2)&&�Ѧ���q[љ"����EB�d�0��I���kd� �����<(�H&k[� unH�:��D%e�ے��B4�*ǚ�̦�}k�W#�u�$�� ����'<8����1=S4��؟ժk[��J�`�0k�����=�aO�X�Zc�ٔ����$3T�Ut�Q��G\b��s�}h�3�:����9�f��_��$hF����Ew������"�$7*��2a+3�Q �oD-�@��:w�h!�8�~4��PƜ��k&vm����� ��7C5�^��D�>4������GQoPw�1{�_���T�9Dn�ʳ~BT� ;� ��������ߊt�����,[}y�CO�s�O6ҽ�M� ��6�Lw�^2��' �w�`]d��c���ʆ:w������y�J�;�:��E��!���������G�,ԅ^< .�n�U�^d�N���x�J�v��~ջ���(�X�걳Z��I����LG�=�X�C��}A�3�8D�R��W����+҂*��/]�Y�DŽ\rq�lJ��keJ���<�~�\}����X�R� ����,_�I��@!i'}B�|�����?��_ڔ�9��q� �����˺rMv�����5Xt��`�r�ȯ ~���6����l�V��纴fĦ��6E��mɔLe S<J�����ܕG��U��IR��[�r^����w"_xEW��h��EnN$ҽ&�|�5i �s�ܿ�}��3bx�4�����,ʬA�Qg.���K���x{��6����]�j���0�A�+1T�t��ZAf6U�����T*�ݴ����URVhR��<����$��k�1�eO�%��&^� ��}��KMZe��}y"�ˊ��B�X��=���:��H�5�6����$<f�ʋ )~�bhk� (;Ըm��3A 02c��\�U�"����:$\%:� qY^�`���y�t�gn�\}�[ES$��k��qBKg������%�����8?���0�#�:c�T���T��}�`�6 ?��ˍ&�[�r$���# ���|����MZ�fXa��b#�s�j�6Ql�ǰ,|1(�᧫���~G-���axL�89�e�@�ڶ&�eX���p�G��)*���;$,���_��M�)�k��%@������F��/���J\I.��R�]ZD�W�#+Wc��" Ҋ�� $�9�A�f��o"tnR0�(~��}��� v>o�V�u�/K���P� Kr�'�t���m��"��;���(x�˛q���O����h9�N������%B���OZ���{��29�i�=)�#/��c��rfV��� ��b��Ivv�p�-3�d6�@�L{��DX���vmF5rX���M��CP2��8��u�ּ������S� 肷��@ ��1�m1�O�fD[�4ET!�Ԟ��.#|��~mU?�����wU�b�l����m�6�3�<�O������U&��[���4����EA�&.;���ӵ���? �Vn�umِ���}��@P���V�,**�FUR ��}<z�q����cqp�<�*�1G�CW�H�ܓ?0?�����r��%4\c��L3:T����e�����ўB���`F8�B�Q')�� �������"�%,ό�Ŏh9�^~GEc�f�>U�5`S��L+����]ˌ�I=8p�ښ�`;X��t���!zNƜgǀs�0�k�x�<��xgɬ*iK��=.�'&H��g3���0.ʽ�(�]�b\��IB"��O SB��k�%M���)�}��:u?^'@���6*��ռ��.��`ZKҕ%��D������w*Ţ� ̓�-\���7c���0��F����:}�0%W�ڃ.6�&>��12$N/�f��jͼ�����>niYu�ޣ��xЀ���N�����L�Z����P�HOQ4�.V�m]��Bab�[�<#��d�ia�bB� ��x��Q��tw�|������b)�۳�O�����R-�ҧ��~��Vdܨ{80�qG�C4�1&xxt�1���P����0��ǯ��T�9K� i�W�T��7q�� ���D)�o�ŷ����.�H�<t���l���[8[}�f�L��J�rjC�t*���b����=���P���v��:7,����s��]�O�c��x!0���"�Rb{d�4
Behavioral task
behavioral1
Sample
2f45c02f1e69e5a40e4d085dc0762dc3e24d5a04e5eb79788fcfaa93ec51aa88.exe
Resource
win7-20231129-en
General
-
Target
2f45c02f1e69e5a40e4d085dc0762dc3e24d5a04e5eb79788fcfaa93ec51aa88
-
Size
5.3MB
-
MD5
ec370c39aea379d74b4ebdc45b4c1f0f
-
SHA1
8dbb4b591a5549c331cda6ac5473616c22f1f3a7
-
SHA256
2f45c02f1e69e5a40e4d085dc0762dc3e24d5a04e5eb79788fcfaa93ec51aa88
-
SHA512
0cb7f19600ee14be9c2522215927d5a34f937b808cf92f14781853869a825df1f6e5c6a027382e05313b244db4c4a263914a9239bbed2a4c329f777103aed012
-
SSDEEP
98304:TGRzKHkxmu25MXvhIPhLOHuOQDTpESOXO4UmMW2jnSWjYE5Carv:TaC1u1XMhaHuOQODr6jYWr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f45c02f1e69e5a40e4d085dc0762dc3e24d5a04e5eb79788fcfaa93ec51aa88
Files
-
2f45c02f1e69e5a40e4d085dc0762dc3e24d5a04e5eb79788fcfaa93ec51aa88.exe windows:5 windows x86 arch:x86
3f60193f3254f2c672bbf4ff8938fd7e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
waveOutUnprepareHeader
ws2_32
closesocket
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetVersion
CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDlgCtrlID
gdi32
CreateCompatibleDC
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetSaveFileNameA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleFlushClipboard
oleaut32
SysAllocStringByteLen
comctl32
ord17
oledlg
ord8
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 616KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 268KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ