���/�/���u��-���k�sy`��ˁ*��륁��d /N�}=�B<���f3��+`�b�X������/��ē���\�j�U�5o>��Wk�`��z��4fR2�j 8����i���$�Y�HᎋGO��n؝�����3hP��ke�V�z�zk��VG_y�i��A�:@yGh4��|2W����w���#~��T]�e� 89��?yd��%V>$�p�����U�;��~q総ߧT��g����u7�?����#��ĩ�{m2�㩑�] ~w����d���TX��J��g�S��b�l�-�����[�*hb�'��+~�߾-��5�t��nY���J�}<;)cn7~3���i��g;�C9��� �;gO����(a�d�Eс��:�4�|����U�c�5Y: �Uy�쓮n�5����/�>�l<���G �ݫZ�F�4e�hR9�`ψ, �j�NQBȭ��(6��jCdN~|�T�f7�!l\�� �uQ��͛�k-:,�zw�A���4�'�`@n]E~٢���u?����ŎƲi�@$r��K��� S��#�M�K~�����A&�+N�4��qG�����ރp�.}��{|hF� ���}���6��m2U���?��ɱ.��?je��j�S�b�P�KZ0� �A�ĭ�`�1������7�[�fғ���e���)�a8������4��2T�P���$��7;���Řӓ0���Q��{#���߈ �4��l�H�*}�o��.-hy�&"��X�h�˴.���*bpxxr5iW��*J{��WL��E��d�Y�84����0� 0� 6�"cz��gj�>����8}<����U��k�ׁ�^��(V%V�3a]۰��XboQ���Cx���Z�%��E��pjח�O�Z�o�� LY�j���~����֟��,4ͪ��0�^JKJ2[I�j�@�xX���q���*>��l���&��MtM��֬�*'q��|Wŧ�g�Xɪ�o{7�˺� e[�z.�.f���Q�*����rx����������J���Cy@���\��� @m�����L�c ��ڎ������@"�k|��TȢ���oڒ��ɚ�����E��3eI�����e�zil�5��������4p��Ȗ���v-7cc|�)��/���H���:&?��� �鲒�t�n���x��w���QX�f������<\q�>c� IN{�e@��'v*�1���\d���62�U�����L�G� w�E��4c�uK��0�!��|�9Oe�'`�-�����k|�#�P]'W�0?|�"Y~����F�i���\��8�f�@�%\47�#q�3�f[��ò�<I�������r/�]���� ΉvIUF3��'R�?KA��ԟ�ݚ�^ _7����`�vQ��X$�?7`���3���^)����> d�2�9`�BFc� � �]xa!���qEt�\�M��':���@|��L�+Q����ג����|[�fȨ:��,�0:��H8��j��aE+r�Q|g��l\$dHE�1�G�)>��/��J���]�!l�Ek ��<0�����z��/����:�?������I�!r��+����U�z�B�\�O��I�p�o>��G�1q�MdJl�[x;kt��.k�~߶U�����ͫ pm���l|*/�Z�Ӣ��M��/6�"z�v�D�f���}� �_h�D%�r8ȯ�uIrH�L¸���}��<���?�2WJq���d�>�!:�u�7�D��*�[s8�=J�ZP�~� !�_9l�͵t�K�%>q���]�{�'��g���$Ǩx{K��Y�T��AA�l�y�+C����M ��sy"3J�V�j�RR�/����A���s}��M'�\_l�;2�Jq�3�_�(����i�$�f�ۨ�S���Y����)���&��$��'ܭ\�m{f���p�>,�v���y�v�ԝ�֠��9�Ǫܤ^�!�2Q�a�\H��"��!]����G�n�B��$��� �h����l��ϑp�6�eF4S���������v��IA�Zo�y#�/�c�/u�*�`�~�R�p��J݁�^K1�}��3�)��t,8��� (d��=�6��e�EK�����ߍ}�7 �� �T� �L��3^Iu �b�9���k���K�p���]��n���7}�Y��28�7̿q&�����S�M럣N�-Fg���[�Q��gU�0���)���O4ڏ��"0sSC[�d�Ǖ�B�V3�y�YZ�h��2�4R�r��$N[��F��R�j�����~�[�$��`�� ��2��'�'/.�&3�:�y���w�f�I�$��6?k5 ���e�.�4z����d�+��v{�s�'̆�����S$�S��P�m� %���X4pi�@���Pq �V?��^������~T��#w`�9�x���@��#J6⨒f�bW�0��.����L���5H�s���pq�!q�K��gn���\�)k*�F�Pq<d�kfD獾ͪ�+��ʫ�}:4g@_!���~'�-nd9k��]�����0���ğ~����Bk��A��f{�3sa�;��6�k����q��6���AaCCt���G^LԘ�����/�-��*�g��?� [0$�q��W������_���]��)�����<l*���j�^�OH|'�o`�)�2-��C�/-%s^� ����T㳼��t�߉��f�[����_�"���x��*ݖ�Uq,����Ə�eHX�@�n���)~Ф�"��������������4*�J֛�D��G]Wߠzg�@�R�zb��1���F>ˉ� ��� �ly��`̾�ڹ�_���O�G�Knw�%Q��.�ߞr~�#��e�C��=��6��#�MhE�Hf~Tf]�aGhbn3��X � ;x����*����h�����uf2B>[bWǎ�l���� ���I��>�`}����{:?&�}j"7 Ď?r? �&;��t���Q�־�հ��4�z;r�"�SW��|��g���ט2>N�,S}���:���0�6YfUb� F��s*��n�#����j�Χ����` �>�
Behavioral task
behavioral1
Sample
b65f5a28d5bc7af02ffb66bc5264012c36f275386ebc6f6439f6479f55b92e15.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b65f5a28d5bc7af02ffb66bc5264012c36f275386ebc6f6439f6479f55b92e15.exe
Resource
win10v2004-20240426-en
General
-
Target
b65f5a28d5bc7af02ffb66bc5264012c36f275386ebc6f6439f6479f55b92e15
-
Size
1.8MB
-
MD5
12080344d2e2ec4d712be1a0e1310291
-
SHA1
0067828a12599221a9568d028a4f623585730969
-
SHA256
b65f5a28d5bc7af02ffb66bc5264012c36f275386ebc6f6439f6479f55b92e15
-
SHA512
3774408342c169fbfbb5934e8b63912379f163154cc089652f5ec7d08aa8523870a7f854d992fc1737333029df2eb24d194f97e6e02411852a73551e597fb4f5
-
SSDEEP
49152:lFOZcuWhWgf8i7tnXxga6sTQ5Yq1yDrI4IGuVTN:lF02ZfP7tnp6sQIH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b65f5a28d5bc7af02ffb66bc5264012c36f275386ebc6f6439f6479f55b92e15
Files
-
b65f5a28d5bc7af02ffb66bc5264012c36f275386ebc6f6439f6479f55b92e15.exe windows:5 windows x86 arch:x86
6af0e186e99a9e4a583a789eb2fe7abc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
FindResourceExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenu
advapi32
CryptDestroyHash
shell32
DragQueryFileW
ole32
CoCreateInstance
winhttp
WinHttpOpen
wininet
InternetOpenUrlA
shlwapi
PathFindFileNameA
version
GetFileVersionInfoSizeA
gdi32
StretchBlt
gdiplus
GdipGetImageRawFormat
uxtheme
DrawThemeBackground
atl
ord42
comctl32
InitCommonControlsEx
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
oleaut32
SafeArrayUnaccessData
Exports
Exports
Sections
.text Size: - Virtual size: 605KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE