���7���3y��cQ����颦�fp6�kll�J�H�0��,|�K���̧�'V0����n@����@��g%�x����61j�=��X�����8�b�W��X�!��v�TG�`��c���7���\[�W�R�@^��Eh/��"���8��z�����-7�݂o,�Y�����O�����:�Z�����>��an Ӓ��TQɮH�1�/�Q���U�l%��$/�&̒��BU��ûܸwT"�\TW+:�U9E�����N&���|�����Ϣ��o[��J�ҙP���.x��9����[y{�u �CK�u��N�x�������Q����T�0�'�*�]���,�,~Pq�w���`�Gt��ʼ���1M��/�<Щ���KA���� ����A��K;�����5e�v�1U��AK�x���gu���p���Wz�D����qA`x"O�������E��Wb��<�,�����~EN�/S� ������ sA����uy������@;���¼���w6U<��c���Ee3� /v�+Ȋ��'kx\�������;+�t��7��M'�a~�G����ު����3��\���I�؊C���#a9Uǎ�y�JFfԮ����;�l��i�K���a���`�EC��� ��w�GXf{5�vG��*R�^[K��������3Û :Ay�^uᛑ�|: n���X�����LC�[(�ϰj�MV�;����nАf ���/>��/���!'1?)���NJ�MR���b��"�n9����|`OO;�'�1HtJ�v�t�k�ē$�&5��MP�Pn+D�q �}s�Y��Ӵ�F�x�I�3vvL�p��� ��nh��������u}�9C~u�U���fG�Sm�JnZ�o۔*P�{Qt��BV�Q6�HHA����8��:�n/�DP�� ��Rt~Yx�.({����lb�Z���y�m��~���G�?>�:����[ $�f�1'������r`��PDž������w�'�@�p�'�0 @҂��k��ѥ�0i�D;�P��/4�d��E���J��b�ǎ����|�'�y8���O�Z�b�nT�l�t��d���fhG���(_/\0]F����_��Q>�88�f�����Z3l���i%p���^y$֗~�'q]npv���6Y��E��q����{���*-��,L@�:y�2�2��p�6��|������K�Af�Ї�L�����RQ��֏gy�$濦���c��h̍!�M�| _$�b䎮�x���0k�qP+p���oń�Y�v=��+�]R���q*�!wem���=���B��9���]�1�������r��i���<T�-ql��S�Xt"�Ud.�s�Nv�)^\��/*Cu������(ၼ4�vzLz�+]g+Rq��L��m��A�bQ���X �冗_�٫Ó� M�s���_�#^��y�� �y�q���l�5X�}��1�P���E�1��r���r��ş��]��a�����27?i�s�ű2��fL9�>�t���^���Ur%W��P���R�塃���#4W��M=vhRW'·��%8�G�0��E>�f*V[99q%v��3�C�5 l.�q�K*�q6B���X-.�j�c�r�ͻ��]}�5M ������瓵^�8����7�~J> B{{(�`_��8D����Ҧ;fDZš��?<��iғ�m���:�U.8~�̵�*��2+��q��F7,��0pĈ�Glr�X��O�5 u�e�]�di8�J�>��t鿞��a'�𮬢w�ÀaU�<���&�+(�DN�R�҆tU5Ź#�����}���� ��A��0rzC_��~a�,�Q��}EcV�V�*�K3����fo�15-j�p���4�V:3Z,�:Z��L��C8�i�����O�QA�r�K���l����â9��c����@�U�@� 8��=PCk��l!fK�6 ���w�]�e��dNX�L=9�6q���%��*ɚSw���n(�6�pr�JS�[��3��7�^7��Ū�ұQ¤n ֗i��wTV��I�ޓ���r��X7��{0��J��\C�]t��9F�g��.d�R�4QXƛW��t~[#Fg������POxkĭE��>��C �����0��Tٕ;�t�V�_Z�5 Qz^P��S�({��L8@晖�����=9z�vSS���JN]M��%O����:�_�����[G~<�����|�x�������;�ݯl=��yck5���7UQY�d���t���w%κ��hH��՞����#f��� 7#���[?1in>�pE3�(��E��w�Ҫ��F����`�8�iE2*�e�TD.���)��c�s4��g6_�J���y@F�E9s/�aƈ�� ����>���Pq��g!a�3��Z^%�8%v�{�TX��D��K���F��GV}�|tf��]P��H0����,��IVb�DD�� ��t2/���M��d���v�>������vC���v� ��G��./D�K�f_#Q$!~����̪l���{OVop�Џ"�t~�E ��?�L���`�ͪ����<����IH嗣H�/6�W�I*_zm8f�gO;d@�q��g�����`�O(��]�#,�g�h�@0U�%��k�͵n�����8z�s�-�D}!w�T yaɰ:{FD�ӄ��� u�Sm�;�)BG`�"�U�a6t!��M� M�9�d�����C����� Kn�<��E��o�F8�Q�\��DH"F;R�8תX������f�h�A�|���������Dz�Er�����K(3M�i�[���咞 �Y �F����J�զ���W ݂'�p^!�����)4}/��E����+�����f��:�,сx?��]*̐ғ�kL���Ά�ʺH�<Ϯ`�<Q�y$�C����N�P��u�~-}~��������>I�r��0j�n�q�%tN�G��H��0o Kq��ZҜ!'s���p�����$���}%=%�Qɽ��R�r��E*��X����Y���$��������>������=!�P�?I�[
Behavioral task
behavioral1
Sample
4bf4db6a1e0877e8c5b22b3de0fa6331f1fbb9522ebd7d78b7c7842bc1236788.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4bf4db6a1e0877e8c5b22b3de0fa6331f1fbb9522ebd7d78b7c7842bc1236788.exe
Resource
win10v2004-20240426-en
General
-
Target
4bf4db6a1e0877e8c5b22b3de0fa6331f1fbb9522ebd7d78b7c7842bc1236788
-
Size
7.4MB
-
MD5
9934f3d093402201f6e44f26fcb4249a
-
SHA1
c76969f331e03f4a0900f05f68668aa6843597d0
-
SHA256
4bf4db6a1e0877e8c5b22b3de0fa6331f1fbb9522ebd7d78b7c7842bc1236788
-
SHA512
8be50bee1719d6a881d213a8922561bab8bc9ef5abd9c92dc180b6161474df28269237f959c9e01899e7aa957028845e13035848f90036d545086ac3054356e3
-
SSDEEP
98304:rVnZzBf8Cekx8Lv4IAujtoeGhrKHJcjHvAwCPniYAdUAOsh7EQowpDK:pXy14IpjtozrKHkPNEA6rsh7EQd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4bf4db6a1e0877e8c5b22b3de0fa6331f1fbb9522ebd7d78b7c7842bc1236788
Files
-
4bf4db6a1e0877e8c5b22b3de0fa6331f1fbb9522ebd7d78b7c7842bc1236788.exe windows:6 windows x86 arch:x86
b112d9b6fe0a48d701469a4385bc0f40
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetPropA
gdi32
GetSystemPaletteEntries
msimg32
AlphaBlend
winspool.drv
ClosePrinter
advapi32
CryptDeriveKey
shell32
DragFinish
comctl32
_TrackMouseEvent
shlwapi
UrlUnescapeA
uxtheme
CloseThemeData
ole32
CoRevokeClassObject
oleaut32
LoadTypeLi
oledlg
ord8
gdiplus
GdipDrawImageI
ws2_32
WSACloseEvent
oleacc
AccessibleObjectFromWindow
wininet
InternetQueryOptionA
winmm
PlaySoundA
imm32
ImmGetOpenStatus
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 346KB - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XMLoginS Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ