j���d|�$h��f����lC�R��K�6����'B�c� 9_��W,��5�����I�+�%\;l�`o��1�]�!�}�b�PLiMtC�?���c/ڡ��j����yK��<w�I?<i�V��)���i:)-o��0��Wf�b�k�,�D�8����Q�L�_���5k�f�T�䑥=�끉�ґkƠ��)s�B��Ł��6Vq%��c6�Ҭ��F�e�Uj+�oі:�Y�;���:I�6mߘi��9҇@=�ɔ/DFc��.1�;`�ׄK�e��8Mh]*��oZw��.�͖��֧Q�C0��)�����������9#�}��-V�����Bm%ޖ�F5���y����:�������aN�j�\L��ZN4�s���˼e����=*���ڋ7��}���~����G��5�)���P�h�COy�ג�{�JMZ�Ua)�ʞ)�d�*�7�"N&�����P�lA�fs#\0���?�>��jN�ȦIt���ML֍�z|�!��f�KK���<G�v�b�c��jp���e�OsA�N7 0��r��-��c�V^Pa���:���O�h��QT��{8������sY����x�f,����}�g�>�#d_x�6�����@�U<vL�H������Ă��6�ӳX8��֖@��Wv^s+>� 첶��zѽX Vʩ.� �,:�B�&�3�cO�s[x��z���>*����H�HN��D�V�M�p��0]a"��B�0�ӱ�0!|1�j��d *�d��ݾ�\Ox�t��v�>S�Ǖx�eW����H)�u��W�WVj�堡��5nF�cO9���7TA�wsSWZ?Vﻙ�W���Y�����`��/K�\ ���?F�z�D���8ļx<�O��W�`��������oo�N��p�f}��O���ˬ_���0���P�Yu��J�VI]����(K��e^��R�)����Rb1z1_�xR�ZH6����xS_�]l8�'����(d���t�J���Z�p'[�臿 �M��������A}��8�/��$P�e�W��JJ��Q��c+2)����w���E�����h�����Y�h�9[z��/~�� G�y���B�~q��n���2������~m��ԯ�M�8E�1�=;}f�a��д-GxQ���l꺤���x-j��v���[\�m*�X����B��� �����%!�[q�+�y� >n$�� �iqW��x�L�1�VUh4D&}H�HD�0��h=p�7MT��ɛ��' �Ft��E� PԦs��U���ؘ7��y�{�N��@P �y��c^���~"5����&��VԽ\YE���u!#Q�'�X^;?iw- n0��d*_����S�/�ה�s��rN�����`�����B��EW��D�/!��0g��JWi���+_���F��Du��>bvH���}w2�i��z)� c�y+M3V�Mqm}m�lZ\);O�ֹ� I�fqY�zYO����R�c%�薈�2����W�ϸ�|yE5t� "`dv���h�km�~vL�HδxM��dKB�A(*�x�:����t�wD6���{��H�����R��,V���o�E9��>?5FH OD�O䶷R�zk�ޑBmkt����)�t�x-���?_m숔�w����/=ZB�9qeF�ÅVy<���"gF�M����T�G9˸�D���q���\Y��O�w���^�9���[��c#�⨛U �.�����=R��M�gRT�D9|X ��-���o�>�U��B�uI��ifj���1q�(Q��e5�xߪ�Ʀ?�������X�(S����B!U��V���f�E�S+P��n��ZJ�������&JS� {��2��G*�qfe�Wo��.@<���21,8�@�ʼ&�=>j*��L���;�&/o��Q��~�x�v��c����"��'��K1=��8��X��l��j��,}xP�};���������"�����4i��&���\+��Օ6�p��Y:X��� `�Q%������<pD)FjQ� A�'+��Q�әr�~1( 1������d�}U!��r��5�kW!��=�������a�CvRػ��a���:��+|v�\ω6f]��쩠_�9��w���\}�o)��j�b:�xf��Os/��xW��'~8�+���<���fa�:���`�-�����S/���4� �\]jI?(��������hL�rJ�T|�}�dd.)����]Ls�b������'B����H?x�.�w��9oM��/��_��㺻{�,����7j��q�/|��Oz8{/p��*@yb��4��`Wn��d��$�:6�/�T�����M�nU�p���"����xѯ\>*����+�Q6���8��[`�U�,���-��l*�.p�v�5L�x���s�Q�f�h��0amF�Q���VɆ�|���8Kb��2m\``�c�3��kK��Q]ھ�)ے]2Q�y:b\0V�>(2T+T1��푰�7R� ���ă�a(�HP���(@M���ѱ��j�~���Ƿ�1$�S�U�������l��*#ܕ�C�b4���_�}���oa�Ģ���/�%rg2I���>L�2�Uq�W�婒?'׀���8���:I�Qo���2<�x�I�o� f�����VV���2����r��ĩ�, Ҍ�[�W�n���3>�cBj��^E�tU�yA �rTG�U@��3m�*��V?֣�D�-�NH�Q��һ0Q��8�#�r�释·��%�K�z ��թd��w!�}�w�l��zC� h��3I�wik�.�I���%D�剉��v������S�5_����L�!9>*�\�n\-Y<&�� �gκ _�ek-�R�6�N��l���X��Y}��?>˳����=?x���*�pEg��ʃ���I��B,W���� bzBP����m�KwLީ*p1����V%j��8�E����lS6ϫVY�+��*a9���K���Rw���,��������B�#F�8*]��,�u�fT�U�2��/p����I������Q{"���o�
Behavioral task
behavioral1
Sample
768d4ea0772d8cec4acf7fbad164c380541b4865edce1a4b1b8a15fb1c7e4fa9.exe
Resource
win7-20240221-en
General
-
Target
768d4ea0772d8cec4acf7fbad164c380541b4865edce1a4b1b8a15fb1c7e4fa9
-
Size
3.1MB
-
MD5
5f1d4dbe0f8ff402443959261407117d
-
SHA1
182d0d74497bcc8d555e10b029991079e45bc8b6
-
SHA256
768d4ea0772d8cec4acf7fbad164c380541b4865edce1a4b1b8a15fb1c7e4fa9
-
SHA512
005b82ac11980df3ff818209e50c1cd0599ed4a661eb42b2a306e56258f1c9b3fa42c1a3983e918b72185833a4f2c4a922c40d01fa20519e3e5525cf95df2cf7
-
SSDEEP
24576:ra5/RZUBDQKRf9fgCykxLu73SSH5JtUUe/hjcoIDO7Q05SL4OD6AknAb/5tulLvC:2/aD1tqG2ra1asMTNj4lICedImOG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 768d4ea0772d8cec4acf7fbad164c380541b4865edce1a4b1b8a15fb1c7e4fa9
Files
-
768d4ea0772d8cec4acf7fbad164c380541b4865edce1a4b1b8a15fb1c7e4fa9.exe windows:4 windows x86 arch:x86
a5c8949143ffc39d5e8620b1a84cf9c9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
gethostbyname
kernel32
GetVersionExA
GetVersion
lstrcmpiA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
gdi32
CombineRgn
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
StgOpenStorageOnILockBytes
oleaut32
SysAllocStringByteLen
comctl32
ImageList_GetImageCount
oledlg
ord8
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 885KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 348KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 284KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ