��I�w���.�!�6?�3 r��5i���(���T��r��`�[����8?T��v� ��q�t�;J�P!`�Ƃ�Lb�Y���� F� ��\���X9۩�P�x��qΛ�������YPjV�d+��9$�p�F�%��t�j$a�Tv�)ؓ�J?��5�C����YFP����p��29z��!��o���.�lk�����;�&C=�?{�"4*�^J��|Bmǰ#Ӽ�{5�A*]IP�[���z ��-���[A��w������d|4;L�~�G��=d��c$$���*�jE���e�{�fh�#�+3ּD�EA(_C�U�"��������"�j�aa�U�^��2'�=3�-����E\�*6b�Ys�YdƵ��#�`M֮��n��� ��rv�-hR���_z�N���-�k ��g$�V�F�T7��3�Ap��ޝ|H>F� ��ƕ��k�ʀq�Y������y��'t�P����F�+��UP�"k{2�Ʀ[ �p��c�ߴ����H *L~U��B-f��u��ih˴���7��'>_�`^?xA}�ՐgUQ��G/���hb���c����ARSPQ��Yذ��f���T��fM�}���s�xS����e�b��#�'Uc*��Owr���ޗ��g8��@�k/�Im0M)�vtd���I�� ���C �?�eY��7�������]���{:��m��l�N=E���E:�ܚ�1yI�[��t�Ց�ew� �v�Dj�^y�r��s�m,��������r����J�b��DP1&���i1����X�Uj7F\"�Ԏ[����1�$pm�$�����k����p@�� �8����=H��#O�l�ݜ''�]��!��i��V����e,E���]N�����3ǟm^�Ϗ {��?F����9Qh.��&x���b���-vMD]�sgķ�+ /�Qo���x;b�������}����'\Z�%�J�&�+���Q�� ~Fo�?n n��l8��g&Pʦ<���X��|o�~�ƽ@K�d9d3*V#����ſ�-7���}�"O�-��ŎH*�/�,o��V�#�d� @M�ɌR�ᯏh��;�%R%�}���R�vi��#�f�:f��%4���X��L����5�Ҭ�,�l���k���M<�۔�2�(0�,���>�`ɮ�`չ�o�8q ������:/h��K�0Z�\[�g���Yu�lw��vj�b�t�#�}:���X{�m��Q�f�����"�*<�iT�"�ה{'$p�$C��˫������A��l���\7��vI�_���9�4u'N�(�Wj��<��A=��鞗�(�����v����>�"L�A��*\d"���I7�aҥ�AUy�9,��V���� *q�E��'���p�3�Ξ��r����)Jӷq��u�Ȫ�9��-�|�^���b܌WI���y�$Qft��#�7��x!Aw#>4^�h"�,(���V�vc�^hK�A}& +z����i�O� ��-�Ө�d��{&�m��EV������,m\J�����й^�Cj#/q ��33�W�QvTp7��� Yhe;Zc}��� �J�.M�H���GX{�؎�27�WBa��ʒ�'AZQ�U��L+S�=Xj=�o���=�X����1���}�}��U�FԸ������FIfˏ��܍�r����h��wg�<f�ZI]:s�� *�{��-%6�e�<����BRH!@RK+晪����y��=m.�ÛE�ƅ|�BLRV<ୡJ�T����}/�$�U��#�#�����^r�F�gJ�)<�t�G�@5Rʩ�Z���D��D���C ����aҒ����e╡O�S�[p�Ib&H_7���M[�*F9��p�ƸQ<(�w��j����M'|�X�d�?.l+��f�DɌۼ�f>L��,ǒ�L=t��f�ۢ�@5@+����3��V/5z����M�Z�ӆ��)�Ͽ�.���� o�C�0$�j�����\�>�n������%�������Ȯ�f�R����t�Q;�� Q��8&_페��R�d^�y��r��x�Ĩ���a&����?,&Zqw�(ɫ�qI��o:4�F�<g��2��>�Z$�t�a�{W�I|j�.�wR/�AM�Vm��� ��!�,_�ں1M���Z�-����Pk�ōB�@��P�>���6��$b��U��[���`s�O�4 ;8,:h�Nj�WG�r��g"�Jߕ�/]� w�YvM�}*�}�]�B��������j���߁���)��o1�'<??�놗Y��{�~��F������r���Q��dX��s�)������ݍB�� ��J+0.�dڢ� �~���ݔ�-}����,K�p�&�QL3�~#2����,�۟���x(T�~�ɻ(�2!kwǏ�����������|�@��m5\$�xZ���������i~�S3�0?�[%HQ£��4P"?aO�Ǐ��J���� YwK��Dv�G�����ӫ뗾3-����>Ӻӑ'r;�&ܹh����N��Ȟo5��_�*ymƿ��>=<����K�湸�J��G�7��,zi�xO�� "hF8o=eH� ��ZA*��F�0�$7����T���~��y����Yi�~̔��4t%Q�s92 � �T0N#ɼ���Y�!���"ST�`���^t"�������Y������U�,�"��Z����'m{�0�Z� �ʹ�@0c�Ε�5Q���3�:�7L%h�9����+�yW��<v�U>�*�o��ۙ����b�zmq d��L�U�@Zd�c�;@�<�蒪P��8:�l\�!9�L� ���?���3%Uc]���Fbl6D������Em��S�� �B�7[��f���Q�*��t颕ݔ�n�����[����@(�]���7��Aϐ�ψ�V!{ӂEfnY����g#����5tV��γ/Z���_�h/{���/��.�^��秱�晠ȑ��#T�������%5���[�Z�f���)-���T/o40 ANC�>�>��NS?�Q"3�;@��E� �8�2�����nf
Behavioral task
behavioral1
Sample
3153c21f73ee1becb5a3ba3293f73cd627a1592b15297f575b42e47c8db6e18e.exe
Resource
win7-20240508-en
General
-
Target
3153c21f73ee1becb5a3ba3293f73cd627a1592b15297f575b42e47c8db6e18e
-
Size
6.5MB
-
MD5
5a9871e056e8c01eb5527876a4aa9b77
-
SHA1
2533bcfea9d316f9d84b9cbabba9a4a67a876a8c
-
SHA256
3153c21f73ee1becb5a3ba3293f73cd627a1592b15297f575b42e47c8db6e18e
-
SHA512
3228edd23492a1274d707f5ad7f55e72e0945fca4e832dd02ffe96260b6c87dac466e1e448af11171571537ff71b6a6c6cbc90eb9bd22e1f31549ec1005c42ac
-
SSDEEP
98304:LumTd4lZA+YXtp7UEst0s1iliBrMktbINzv88aaoJJZSJybGQvdz:LuW4lZ3Y9pVm0sE4BQCUNzv88IKQv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3153c21f73ee1becb5a3ba3293f73cd627a1592b15297f575b42e47c8db6e18e
Files
-
3153c21f73ee1becb5a3ba3293f73cd627a1592b15297f575b42e47c8db6e18e.exe windows:5 windows x86 arch:x86
80c526f56915365a5bdaa9450e4d2170
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CopyAcceleratorTableA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
gdi32
LineTo
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CoGetClassObject
oleaut32
SysAllocStringByteLen
comctl32
ImageList_GetIcon
oledlg
ord8
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 765KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ