��Ȫ���ZvЍ�Yt��p���Ӫ����rX�;~`�S��Z���p���S:tU���^�Ts���̅��5mݍY ���j-L)�'�b���:9��⮻�S+�Gh{�$���81#c��j��� �C�h�^w�-U碢Ip�SiGm�r�YvO���6l�E"��\<F�d��k�@�D�9���Po��a�����~OE�d9�Q��}8�M�s������7l�;�����ώ��2���W�v5�QN�m�e�D��M��������0ن�ZWU��������(��ƅ>õe�iص��ɶN�����bR(�;8�K�����EM ї�}6���w[�c[�i1t��iYaP��^���yx5%�?���g���rf~x�I��o���������?-&B3�9�8��=LaX���X�x4��v�-j�����^�W`�ݢ�� �@�Ɋ�����`A"uc��n��Ms�n���h���R�C���;ޭ�?em�B����oʥ\[����� ]�y'^�go("���5���O|��^�J�ۢ��ʂ��V+�K����U̓���m�����O]o��� ���(�iB�ɥ���t�L4*@��ύ���i���h��e}�^&���h��{`��� K�)�h��`w�wq`m&�<3�����"��O��-e⚵�Τ��f��vҠ�,�n(�U�-�+!��ui�� ;�6=��Z���mI$$.�#?���D�tb�k�'���Pi��n-�s��1�v-�U��U֣�:V/Sq�;fj��\ȋ���_Z�)��(@Tʼu,ql�HF�e�8H?Ê�IA�W�pfZ��C5^�X�ѓ��: ���o&�Uc�{GQx�3�+��8����4.�9�ς^\&Ƕ�� t�!�=�-R"�v �ڸ��?�ޒ�6m�'�ޠ�06�2� ^��:-��&��"��@�@y��GR�v(��!��%R���Y�LM0˕�����+���;�`��U��-M��R����{F�_6�_{��̋���ߒ<M�S��*ׯ�����O�^PzegԊ��W����px-�fOi0�Q-���TQ����?D5�#2Wo�a���Fr̆t�=�Eחe����XM�]&�F�H�%��4�<���.����"�u�T�1�������a� ��h�����s����"����"Up�].���Q��������0��i��=�g��R�G ��n�$+|��R��� �M�տ�9����5s��A��q���_s����ov�t6� �b#�Sm0�JiD��,9���4���)p����^���@]-T�����6��H�G�ur��X.!�qV�'`�.Z�45��ƾ3��D�̤`"��M�h������;�4�*�H��%�Z��(Ae�h9F��@�Wn�xƆ������oB`���a@[�&�H���ك�i�����#ƪ݄�]_&�ꀬ �E��n�d�TNh�f/�[�z�M��%�L�l�J"e?��z� fE"�i �Et.�mAev�N�T⍊Pb��q1(#� �Q 1�ѫ��(ި��кQ(�.čo�>0(�8F��+�@|���x�r䴮)Y��A�QHxų}D%.p� �e D��h�J_��v�Cv�j��z�f��C�*!�eH �J��bnϻ'r]��C��G�ۥ�)E-F(a�����oq��GVI��e�|*]�+�,��V��(v"J�73��I<�M�o"��]2��{i4� �q�~������'~^0����F�%��K٤Ty����)>�� ��$� �AK?�Th��ښ�A��w<Q�(���'�0���i���#Dc̕p.}ɄY��ޱ��ǹ�����m",�j����)h��L]]�/�����Z9(���ﳅ���{o䥅GΨ��/��4�m2pc���m �F�m��C�H��Ba�X����+fl�z���<M �=ݏ�T�>��ej�/&nk� Vo��3�8CCǔ�` \�������&o�d����J?0������|W�n���%��qO�ȃҋŝ�,�dTҠB\��?�L�HL'Tnm���,���P�x02�;N��X^;J:���+cS���&�6��pQ����c�c6���2 ��Rũ��C=\�h�Ɖ����&,�m $�蓙��Fr������:)�;���ʙ�-k�Z�LD�7h�����ۗ���wabs���=h���u��T�iLRr{�.g�?����W-���I��\���2�U*�f;�}1���WHm�s�١����f�-}��(�+�9�����ì�' ��(t�5�f%�;S"�M�8���`a6�ee�y��?��ޏ֕���N�CY~�$C� ���\#g�[�=Rn��[�o��LAI"�� �����12���Q<�4����u�Vw��V������ϡ�]0<���;N�[��/�7���1�d���3��w��&����� �6�U��T�q�T~ɝ�=R�R��'��ˋ�Ve���[6��|!n�D>.��gꦿ��R��&�]��H�$��M^ԥE#� A�+�y_3|���ZQLB���� hH��u����ѵ�`�� u���\�=JN����pt��������p�s;�+�>I/&�T���?��yȧZ�� _�ʩAq��|G�j�#C*��qC'�ڜ��ܳ�c����=� ��E�x�>>�<H������o��}{DgE�����n6Zy<������m�����A�^��;����� 0�K���me�ZnH<���麬��̑���x�Ri�[K1Gl��| �^$�Ԭ�0L��2ܥ����L`�G�$n��K�T����Nb�ѵ��n�$�l��Y�d��B)@�逾 ;�%tFh�~�M�YF��8HejdX-[Cz|��&r��E�q�:�}�y����ٿ[�'��"��`Ar\�� � ܗSζ�� z��Bz��HN�F�����VV�S3��ܑ}���C��|��e ��4����6ղ��7�kT�h��7:҉ęi2����K�_��� ��8 ��FB�t��� �2K%��m7�Ů\��"�g��;�k��
Behavioral task
behavioral1
Sample
740a40cd74399ef50130dbb11f402bf2a3aad8222c5d887ace4cd3dfc12576c5.exe
Resource
win7-20240508-en
General
-
Target
740a40cd74399ef50130dbb11f402bf2a3aad8222c5d887ace4cd3dfc12576c5
-
Size
6.5MB
-
MD5
bb8c7b514bff3a177fd695e62be261c5
-
SHA1
622717411eb34df88b0b7f37098884aeb34af368
-
SHA256
740a40cd74399ef50130dbb11f402bf2a3aad8222c5d887ace4cd3dfc12576c5
-
SHA512
9d19d5070024f995dddd39777ef7635b899e51209090e3f29a10b192c0759e8610ffc8ec652204f2d703f302add17f9a9c1d182291546ce933d610ae2abd17c7
-
SSDEEP
98304:v5GRE3/ksz24KqCeluk20t+jgQVPYEEt84r2KHZnkoVSQ5VDc+9/dXEjbURdHyPD:BGRhIxVCeooYC5t84/VV9Ocd0PUDSPD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 740a40cd74399ef50130dbb11f402bf2a3aad8222c5d887ace4cd3dfc12576c5
Files
-
740a40cd74399ef50130dbb11f402bf2a3aad8222c5d887ace4cd3dfc12576c5.exe windows:5 windows x86 arch:x86
0ee2d3e5f03e5c87f330a10e47d7ab28
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfA
SetFocus
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
winmm
midiStreamOut
ws2_32
bind
gdi32
LineTo
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 764KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ