�>�I���[as�H��������G���d{|�-.�>�E�~yjpdB'������c����,���A=\�˳�)�?C���6h���_��H.���qu7�g��K�v=N�� -�.AAZ�_ �JV���2��i�EZS�"f�]�T5������~,��)@��@��'��SX @a#n�\f�P5���)w��Y) �W���?�Rz��{s��~˦=�V�s��{��wy��ցKM��i� �N �%��5I���d�l_ڂ��(�2��2�L3i�����ɯ4��~7�lJ����x�0j�3�g�s�2{E�'DE�8�����Q�g �'eW��(%7��C�[��bހf��64Zs������v�ɑe��_F�e�����-��K�>:��^��jS����a?n�I���\���2��ykd)'e��2��HSB���rC?c[�wq� �����I�J<��8o�6"���h�@�ܕ���a��Qr�7�FI@�l+�ֿ�E1D��2`�j�%��[��58�)�AkH ��v��9�Yt�7K��J���f��������:rbY�|��);"'��V�kr���9T���q��sU�J��+�*�ņ����^z��k��T(��xݔ�?���/�6�٭c��k��Gg#t���^��-=��<�bo����xY䌪� !���W�TD���:R^����u?���^_ıvM� ݔ��a��E�#tά5]��Γ3bf�8"��z �DO��V_I�B�$T.�K�������_q��C~{�Ѷ���Z䅞��[�hp`_(�sK�.du)Ya��%�х�+C>�b�`���J��?)�}�����W�[������w�ի��p!��X��h�8���h�%�B2�Nl\�ŷ��� T-��EK�:2:mL-�"�ԃ���q��b���ї�� T��oE���z�5۳յT<�\�̾_�TeM�k��P2D2��̀�C��^��#��<B�g�� �QJͽ�*ҫ��#]�H6��g,�q�5Q����Sk9 Ȗ���wګ��^u6Y��>���[En%v�� I�+?M�>�P S&�k��fMK~ ��XR�\�C�����&�T=@���)�h$�?�\c�%!�["���9�^/ߌ��U@6�1V���7ކ(�)�߷�c��&1���7�BH�'�p�)-]檈*����u�a١X��Kk���������H��0���j'���$���5����u �n�<w�O�&�h�WF��q��eR��ʸp�)8aq���I��2>K�D����O�~�ɇ5Zo�� � Fs��r��'[XR�<>Bj�F'Q�,x��'�;�_i1�l�iK�G���Ed�{e?QH�tE�ݰ�Z{L��ƃ����e�'u�(�ؤjT�}��az����0����r�u�y= f��=�$�I!��.8��?U���J�>��),3�:�n �+�<����j�Âej�����3�}"_��ځ|T�l�'a"Rna ���=�o�Yi�$����'��;�z��'bm�K*�H��`��X_ˇwi�鵔��K46/Ŭ��ƕ�������2��h���UD6IJ��d�7)ީ���7G<c��xo��mD2�!�,����M�~�M�8�� �ƚo9����`��y�";�NqR�Ig���A��ם�_�u�����kcj8坐�쨝�t匕"W��T:��D�9D�d�*;�3q��5�F�3������HCxAfE����(�l9{CA��7Oڹ4��<@��(��<y�$:`Prw�kXƴ��ȯ���2�����g)qu��#��a�B��]��������s2��+'�<���e��������]�J�^+w���l C�F��U���55�����#G�R�>��k�X���a���2�m�`�,S!.��̭E��Bɩ:[дE5�&�#�[sK٣����fݏ��88���ofLH�7(,a/@#���YIVU��E��'�jf�g������B��9v�����U�n��r��$�;ԑ�f�jz'�Ȝ�~�:N�P�Qrj�8[x��!�a���;��5ѳ�N3������N�MSV�\�f<�Kء��� K���׃���d��;w(!9-q�5��IU�j���n�QjB�X�fN�7�)�w��Q�:5� �۱����ѥ��E��6���q��*f�c�'\4�7-��4`�z.�*�b�����5{ۛ`��Es~V�~���.$��H�DJ�����r�p�����) ���{�k� �� ��f��I�fd�yt���A�̏�d4@"�}�n�4�hZ� 6��V�5�O�38]�;�ULxA�J1��Si�ڎ��`�(���m�ӰW�p��"��|y�;�{����� t�4Z�"2E�g��)��&7�]�Yǁu�m|�i�����!?'tOң�����>�zqӕ�Х�0��o!����J�_B:����=N��Gr��d9����?]i��. ���%Grt��R���Q[}{n�@kf�3�,Jj�����@c!� ]�^��b�F �Rg!��}f�$��-�59�R����'L����p`�G����^�Lc���g��~h�~� �����Ӕb�aq\o+�H�(=����5i+�/�"D5sF�|0^�`����f� !�h�$�Xh����F�}��t^;m�����E����a^�Kb�+�(��b�����iP����.�={����)���������L9H�6��W SLB��0�S����53N'O�$�5a66�4y%�:�>�`��b�Pd�@٧_�qN-V����{S�$�V������<7E�.�ۭv�̮�Bb�c �R���E��W>+5es�%��k�"����IRZ��@ {�mc{�l�(�����w�����"��uǣ�wH���F����(����f��YL9�).���I��\|bf�Q��pO{���A��2�b���-�\�cS�m����!�ɀ�n8C;|�� ��--�ܱU�ӫ�Qcz�ʝ��ZQU���夘"�I2��ȥ��P ��W�!�o+UaTj����e��^���"cฝ�5�,A��^�z����0�t�P��4
Behavioral task
behavioral1
Sample
f79042ae6bd513764488313786ea6449e12215f3b1e5700ce1351c2f6690e9b1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f79042ae6bd513764488313786ea6449e12215f3b1e5700ce1351c2f6690e9b1.exe
Resource
win10v2004-20240508-en
General
-
Target
f79042ae6bd513764488313786ea6449e12215f3b1e5700ce1351c2f6690e9b1
-
Size
3.6MB
-
MD5
e7c3cc02ad5070f61f915588b410304b
-
SHA1
921114469f5710887706bd3633667159d5ecd28a
-
SHA256
f79042ae6bd513764488313786ea6449e12215f3b1e5700ce1351c2f6690e9b1
-
SHA512
c1a6edf65483aaef75f4423c06ba95306e841d4c9eab2bc8b29df55dc46b9c5254dfa682512ddeefd9e575f45dceeab297d91a19de412c24ee0cf386686c4c28
-
SSDEEP
98304:VMDO/xNGRpI3ity4eeRfCvJU34Jwcgt2h:Ky+stJ/Jrgch
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f79042ae6bd513764488313786ea6449e12215f3b1e5700ce1351c2f6690e9b1
Files
-
f79042ae6bd513764488313786ea6449e12215f3b1e5700ce1351c2f6690e9b1.exe windows:5 windows x86 arch:x86
a85c5a787b2c692f8c762f6688c51f4a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutClose
ws2_32
recvfrom
kernel32
GetVersionExA
GetVersion
SetEnvironmentVariableA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassNameA
gdi32
GetBkColor
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
VariantCopyInd
comctl32
ImageList_Destroy
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 737KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ