�8��uY3#��I�#ۓ�G�9S��m�'V�Ǽa���_aQ����_���6����@�|�HD+,�#����՟��%��b(�x��Z��VgD�&��PA�7�l�Sׅ2����a���`˗ ��"h�|���D�Fo���K� �'ӻ`�.�����:����A�<`d��C�] �V���r&-��-A1o$ �{/����������c:%M��"D1=�����迯H;��kՆh\���~"�E���0x�R2���R��۸�D��u\t��*��-|J( C��u%�آ��,}� �T�Z Sj�T� ���}:h(L�w���A���=D����&�2��3�����Vq`�Xv ��;!��������yWC%<n�1���L#s��XC�lX���ȩ�Ѭ��2�%����˩ؐ�'h��e���5�����)�ϟν,d��٪?G��l���>��#W����n��s!�߇�o���C���<:����i����&��H�u����`�Q�t ]DJ���H�)�$��p���>nW��ZRв�k�7L������},g��P����ܒ��"_���?5�Q1�m���خv�j������wq �Bm�r'vJ�( ;�1�0S�&��;��h'I�at ЏdR��Ź���3$�Z��7FD/<7�d`���z��_�<���)�n�k~��<:�v�e��֒MIM���Ԁ)�Ү�`�ZFΌ���B��1��W���d&�%i�=9���W��v�'VA����A�A;>���#�I��_�Vp-ѐGjr��C�"��\^.eb���vj���a�Qb�@ߖ*I'c��f)���.x�Fڗ�BBp��4��o��!?H��h\�{�D�4�۲B_N���1��IA��s �-�� ��lnܡ�o��K�-f���\w�<��9�j�\��0y L��Cx٢^�T7�$�r�{�*�i�����O��Q�["�PME��18�?9f6���]��� �j@Y,Y�)�h�F�:���}��{l����덵��)b��5i��N.�k������ثm�+�j��C��6�{�ݏz��S����N�6`�����_�����G�`��}�W�����(�=萯 6 v�]��_&�Ae�s��5����ȍ������%��ϟHzNt�0f�z9�o�1!jW��edp�������P4�p�ޥ�A4||�� Y�mG>��n�~d�{�e�C�VǍ������y�>�#��I���&�V�l6?��n�4��7t��E(��q�+ �8A�PgD>s�Z}����5j�X�Z���D/ŨNdz"TP)����jLP<mQ��n��`@����SBd��N�Zy�Ѝ삏��I�����p�=�XU�jz��`��Sņ���A��- .�AeX��HhV� EU�eGo��i"��l�Vwai������ܩ-���?�����XlC���:�9O�����fH-j~2�E��P���D_-5'�f����Ф���.��;��~�����_��FS�.v �]i�T�!I��3�P����-?Uy�։*���Wi��u�������\#��&�+ԩJ��1P�����D��[���0�ά^��G��yiƠ�!��`@�mJ�3,�����0�0����D�*6�?������TBWSe$�0UIMg� �W[��&�����52G�lux�����':��~�F�:De���s��b�7]�7-���g��6 ɕ�]u²����]�=A��Y�E/U���� G�q|�O2u��@�qg����TttʌY_]�E,�>�d@;X�!B7"Ǜ��Ng�]Y��@�aĄ��t��]��P!8 �b(��:3��=��6�HZ3��E�.b��t��[]e<e�*6D�H�Tu:�Q�ɬ;��bXig����K��������ޛe�~���oD��#tjlx&̘�����%�z����-[���L"��w!�NƆI�f[�\�w:<5l@�Y��*n����mɅ�-�^�c*ٝ}-�V��$�˷�[F��#S�[1����u�w5I�~��g�Q���m��ntd9������2Dz=�WZƍ�TX8U�W4^��ǜҶF��΄�:v���Ռ����G4��_��[{#�J��Nݲc҂���L�����{�N���ߙZt�@n8?�X2�Ta+�$Ce��T�ENԽ��S*�^�j�[R��G:��v�G�sT�u����Ayc�u���GIG����(2�b �ֵ�T����L߱�b=���c��3�l���Y�>PP����g�ӆ����t#0��B�p����lL�6�k~���Ns��%gi�¬C*8=�����Î;�d�*M��>P�Fv���x�K�[��<l?��`"�=��lẬ6�S5�z�t��cz��UEF���O��� �� �dV]��U�����]Ln���c4N��G3���$��w ʢ cl��%w"a���V[�D6v��u����)�kH�t�����Z~5ɺ�� �#���$���|�"���+X9�\}^{�!80qR x�M�s�mf�qP"jr#< �h��}�Q��Y�����IX� і�f�� �vf����0 r�T���[��E�Sʓ� �K���1����m�H1��%{܉�<��+�GC�KI�����V�6�$U�H� �9x�?ݏ���Ę�$4+�Q�PTP=|�F-�nb���MU�/�Z^���9�T^{�'��A�+���6��w�t�%���n�ܛ�[*8�a����Q��[6��(*ߵ炎E�Gk7� 7�j�D`5G�!O��f�8�>X�o)��HK�a�|}Lq��)��.u����=U"�1N���ٙ q����<�c����1��gs^��/�1GӸ���v��YʑW+�,iޛ`�IJ{F�e���=$��Yr܅� ���#WE1 7#�W���U$!z%X���=�H��wB!����!w֟&�v6��H� ]L�.�`�މ�0�.�ySf�]Ca>SZ���IQy4�ʰ)��X:믓�M����v�ť�?��3����\pX��u(���?�R��^�f����K��%!�|kR�+8&/&(f
Behavioral task
behavioral1
Sample
42a233bc767df8f7afe72f95a0758c1d93ce752451273f4c6704c91baa786750.exe
Resource
win7-20231129-en
General
-
Target
42a233bc767df8f7afe72f95a0758c1d93ce752451273f4c6704c91baa786750
-
Size
6.5MB
-
MD5
b06a8127099fdee5094bf069bf556da9
-
SHA1
6a9c3fe67afbad7bbaaffd597400c5150139cc7e
-
SHA256
42a233bc767df8f7afe72f95a0758c1d93ce752451273f4c6704c91baa786750
-
SHA512
2015ad2d4ec8acf8879d8d823165082aa7b22d2d62d165ebd215f873b5ef92e3f7958351e090a2693e518ab4bf5db2b25111320ecfca19aaed33d40b3d6f83e9
-
SSDEEP
196608:djg96eU+pmutBS/DC19D2qCwS8EImIQpajJQRaG9JK78WXN:dRx+suC/O19EVBIQUdQcG9JK78WXN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42a233bc767df8f7afe72f95a0758c1d93ce752451273f4c6704c91baa786750
Files
-
42a233bc767df8f7afe72f95a0758c1d93ce752451273f4c6704c91baa786750.exe windows:5 windows x86 arch:x86
80c526f56915365a5bdaa9450e4d2170
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CopyAcceleratorTableA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
gdi32
LineTo
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CoGetClassObject
oleaut32
SysAllocStringByteLen
comctl32
ImageList_GetIcon
oledlg
ord8
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 765KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ