�؍c��$Ǥ�fVuy�L��+�3Wm�EO�bJ�]�0l��2d�a-�������a�y(�=r�]_*$���V�w��W2��)-*���@�l\c��· ���=>HC�g�g(Yȱ�DA1�N�������Z��|Z�4 T:�Ƙ�Js��ԣ˷y �Z�� ( �~:��vmŠ!���̀�L����G�� �.�{@�> �r!���"��<���eb���{h(�MC�L������4p�@LR �= ��RR���¦��G���9�� -r [v���V���f]�y�r��n��\��,�ݴ�C!��n�Ѧ����Jd^�n6��B�s��Q�w�R�rVD�1�~�P��#�����U1Ǝ��{���ߗ\!��&��Ńu}i�'jor��b���_ngC~����m&��T���]?*��^v�V֞c`rs�\�17��\���.N��%[���ź6��^L`��c����$��$���Yf"@X��ﯪ�S�����_�L�>m]��x���]�s~��n��\o�{� � ��L��tPo.�,Vڇ/+�-�roَ7�������6Sri%G���*� UG�_{��SUѱ��wXJ<�2�_?�n�J^$�A��� ��g+&�(�|�IN����O�h�2�b��4=������]��a7��:v$Ub&Y���8��XᤛzG"�� w4��Z���.�1�zXW�m���*����n�����4�&>>�/+�隋����e�½������j��_����&9Q�iG3�O{�I�@t%:6wB1�&9V ��8��L �کX��h��Q�u�B4�p^!t�r�^�6 y��w�I��y��QJ�3��Jy�|$6˱��/�Fmf�RS���l���[=�M�Q��ygܦ,� =��6���9Ovfh����r���b���3���9nLΛH�y����]�YX���jN0&�e�ͭ(�y@�ݭO1�uf����|�Z3��#-'�B`h�A�,ŪFOx99/��C�DP�tv_a��; ��-�8H��B}(U�.D����j�k��7@����2�m��AI뱿9}�H4��R^�~d���H���>7��p��S5��UYc���X�^��=..�eVƯ>{qX\ �nx��r�X��|�P �g��I�ؙ��8�@#' �^u�a q�{SE���HL?G�%>Mt�9��'����d�ߴ��#� �mv�D�]����҃�nlrC�[��Jc�������Z��a�%Whwd��m��[ ��?�d$Et��ܡN���y��� �"_��çM���H�8��Ů��Zt��Sws�8�F>���x��/��YPO�}�?�z� > 5뷮V�i.ի�(�A{�]��7�M��5�>�#�eC?p��n���h8�3�s��I��Ɔ,���~@�Ŗף�0hݐ�X�o}8�?HѠ�L�1�N3��� g`Ob%�.17r n�K���ջ��L1N>����.�nף��܇"n����\<u*~�i���۹1�aօ���!E��R�Ԥ�ΰNi�����$݊��\ty������J�c_�"ic��5�5������)�����`�'0T�ӥ�:3 �1��Z��{n�ީۋ�s���}GF�5����M6� �bu� U/xi�[����gc}��L��ew�6Pq�Sz�e�v�B���`̳�H�d �#�s��� �[�9��Ѐ���h����B �P�-��;�O3���{^2��7A�lf�M�J/�~�O��.,\#]��;�z�t9��ZK��UR�+㣉+������/0"F7��|W�_dK����D��������V�,opp�����e����[�Sӡ��P;�9Q�������_n��#@�@뭔�i$_�w�h�-tQ2��tn�U'e�7I"nj���� ���3p����� {{�N��drZ���s�+�*�w�B|��U�_$_EE4c�״o���#qp�s��s�泏�u���9=�0a���O�w�N`������z�*?��f91�"���ټН��|Xy��]J�͚� ���ܼ����i_su�����b�^��![Wt�J�]op䃴���u��A���Pz����0*�s���a�$�r�ˎ�O�k��.������2fxoZ�F��� s�������a"�k�5F*S�l!��j^k�.o��lC� �S�v�2���m��Zʵ������}�C[�pi�EڜwZ|V"`�w�Z���=h�WyS�r@" �J�ضxr�-� Foz��M��2������et���v�()މ�6�&xذ����C�d�Γ�h_ApA�O.t� �,[JqX�t�Ƅ~�#���f\�����0½_�Q��ĵZ�h���Ӳ����ȯ>��(�#�����m�5ɫ���$W%�v��lt�fc�.��R�C6授�E�X[��k`����h-���n<�͝G����9TqX�y��@����B���9E��5������)��{����-bQ�|��0=���-� K7K#t����>ip��dGBl��G��7���oc�ݩH�1.X9h5P:Ǐ���Y���Ȉ��H��M� x`@' �R`o���f��P"��j7�U�wZ�;�Z���}7�/!� �������9P��'�RU���57/-nA?�v��V���xI�����:Pͬzh�ŗNC�4��\�PEcb�������w<�� �u�s��Ye�v ���,����F����pV�FL�j� ��U��9,CGƙ�@<Ja��rp F��u�\�w��2� X��sH!Z��v��Q����#Q�g4�x�L�o�0�k�5d�q����h�!J��UZj(K�2�>�)�k�_� F�7م>��7��B�ő���(��5�^g>���B������$�k5�i�(�r���?d'WD����#�ޗR��8��8N�O[����������aXA��w*=�o�a�h���� �x`]!G{z-��s�z�7��<�1��!=�cs�tň�w�����]*11�������}c�`n��9��'����������ά�W��*
Behavioral task
behavioral1
Sample
c7588d1ce32a3cc63a5ab1742d57a61d023e7ab0339441b0fa8189e617588eab.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c7588d1ce32a3cc63a5ab1742d57a61d023e7ab0339441b0fa8189e617588eab.exe
Resource
win10v2004-20240426-en
General
-
Target
c7588d1ce32a3cc63a5ab1742d57a61d023e7ab0339441b0fa8189e617588eab
-
Size
7.0MB
-
MD5
f9f2510a11e1c25eb1e3e827e772939d
-
SHA1
fb85783231315a3e5cb9912a1eaa5b25deb062a3
-
SHA256
c7588d1ce32a3cc63a5ab1742d57a61d023e7ab0339441b0fa8189e617588eab
-
SHA512
5dc5dd231d87bd0770a4bddcce9daabb58a6b22fee790dfedb1718b97f3a079497fc83cdee5132e4b79692f4a9402ed6efde4e522d5ce2b9f34d4b45ca7892bf
-
SSDEEP
98304:XpdRYBHgJes4fJobqV7Jes4fJobqV+JBAUZL1GETpMxH+UOHUODGETpMxHJNm7:XSce2qVFe2qV+JV9m8Jzmp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7588d1ce32a3cc63a5ab1742d57a61d023e7ab0339441b0fa8189e617588eab
Files
-
c7588d1ce32a3cc63a5ab1742d57a61d023e7ab0339441b0fa8189e617588eab.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 411KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 700KB - Virtual size: 700KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.newimp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE