��NP���B;���:��b@Ph��t�u�:�!�X̎���⬩�=��O@oϑ��˗��@�t�xl:���M����MEY���Pcg�j���/9�� ���@#[��bΰYN�DOL�͍�AY֦)Jk#,֑��k.H�@�X�u�������)R�Y:��g; �r(�� ����>Ӻ���,���_t[&'���Jr��P�'%h[a0�0l@���☃M��O'��ش6��`�p�9��e�.>-�a�I,ŚM�+���͔�s&�|�g��e����8 ��>��ߴO6��������8��e�*�K�@PG���@+T=�E*ijb���B�@<�3�c}P��\&o����U��������DOЛ~L_u�H��:F)u�j�6fU�"X���x��?��d����8�g��fh��2�j�Ď���:5�F𪀑{+��pQ�0�y�����1�bz+~<�F�$ `S����L�~��(�v� ▍&ڃ2X^���F����9�R���Z��{n��8&����PPW�GudV���� �[�^T8khk� b�Pٌ����c���R��2����?a5f�D�u�X-��ԧ�b���d�!�r&�b��s)v����� ��@�t�I�w#>Ԯ�3��u����� fcL����X_��9s͊�%V;�Ħ.@�.h�x�YaYIʽh]�Z�WyI���$h� �����@��p���H�a��2p!�ng�-���Fu&-�^�~LN����������e빘:]͑%��CJ�k ��m��ǚc��b����k�.��V���j�.a�ہ��U��pa+��X���pLl�� �})��c}�4��NLd�E��p5�rb���⩮�?t-�\`�P���o�c镩K2�5��8�|��mO�V ?�b�K���zj� �9�}����.G�����*�Wa��쭫��0nŨB�\'����^�`E�7�\*��K�æ#�]�e�K;\�k� T%N��P�e�hO� 4p*�1w��)�.m�:lX/<d�����nYg=g��m*x��RPt.͐J��J�;D��t��KBz��8'�,L��0��_��څ�-gqH¡��X:d���3�:͈M�J����R}��U(yFQ*�$�4��Rh�hϷAE�o"��T�������,Y�Bצ�J-����bP�ΊۢMb��N�6��5<�Ո���(�(o\ޢQ�7LT_���!b�Z�${��=T�d�������/Hy���j~�5� ��`QS�F �"C`P����6��=_e��Ʀ�o8��et���^?�w)�Hp��:�UǎI.i�勾��N�t���(���8��t��Ae�j�fv �'��3�c1�o�q"r�[��i���z���]Y��b ����Y[ZV*� X���e�L��&@��f���PcC95Ӆ���O"]������}&���Ein8�]Nk�����s����ә�����t��lK����I���T��+s� >#����m����G��n\���ʻI �3�b���V�r���H�r�R<[����w���ȟ=Fu���k�;?,fO$&]fף����6#��T�S������x�����X��a���u��k`�I9%���S���\{���� ]�]���`6�� ��倀M�9%�M�0ѭ�V�O�6s��W��U������}�%q�ɓ�t��7���`_���� �ai�٠�*��ϻ[������/Fjr4A%��vd~ͫL��ٕ�^�Z�+#���U�9���%~:a�����j�~���= �{͗��J"���Q䓒m7�z�4�?�+�N/@���ƞ�����"HW����䂡���^~�cĨc.FE}��9 �b��r8��{�#)]A��0��FC�tc�0b�>g0������l�~'�j���P�}Y���f���g��tj�b�����`mb��:cML�?(����4&�l$w� Q!�#m�Hj�>q1�$5RۇC�M�-��(�j�uV�+���]�9'I��'���2�jO��}Ҍ����/pE�5�p}l�v��yE��_�v%RfBs�a��g|�t�☊9�8���������hg��������=��e�~�S7�-}7����f������KT��L��a ?�'�k85�6y�b�!5�S� []���A̍�D��q# �\*�}��BT�`�Z�����;XA������α{�� yҔ���4��/w��|��3������Z|������@'&��SC����T�1�v���٘�9�%������AHR@ y�%Q��"���ܺ����^ͳd��5����i �j�D�<�r��:���~������ �F��` �>nLZ ѡ��?������vW�)1�t��u�o��@6��[l���m<ܦ����Y%��_�e&�X8tu��.f�����6˃��[��l��M��Cq�5D �Ņ�t��=�����w�o.&*�f���.F�,z?�T].�)�AF�A!(`Awm����Ĕ=�G�%��傥�ޘ;e��?T��G�F�L� O�C@"��:��Ռ��=j�]�2P�3���Dү����X[O��������Ei�Ps��;XM����(Q���Ǐ�9�tq Q�2+����'V�/V��4``�����ҁ}�p�}��u�Ȗ�J/J��B����2)�0_�� �~��h���K�Z,п.����!?t˲�ũ�ֈ(Y#8(9�{ oSw{����9veC%����ٶ̆�R�U6<�yM��o��7Ȃ��q@?�;�������DqI��P$3�Z=�&�L�{+m�����w��|י���>�P�/_���D{>=��Y��`L���Y����|僒�d�Ƒ��Gv�:el�-��R|��� ��� x�݈��q��YY]YL���P�+�Tȸ}R�A?� 2f�Ue��q_�,�$mY �3}�PM5!�x�s�~�gl�y�Km�lI?�[Z7���R��O'A��q����xA�/r�/�6f��z�:"=vY0�@ �Z>WJ���qbʇ�}��
Behavioral task
behavioral1
Sample
aebfafc8f17c3e37b410449c4359f8134c14a59d14e9057f03bccc8a2942bc91.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aebfafc8f17c3e37b410449c4359f8134c14a59d14e9057f03bccc8a2942bc91.exe
Resource
win10v2004-20240426-en
General
-
Target
aebfafc8f17c3e37b410449c4359f8134c14a59d14e9057f03bccc8a2942bc91
-
Size
1.9MB
-
MD5
6c8252cc2c690f9674dc64bd2b24d962
-
SHA1
ed1ca431df7d14f800c13a642189f9cec932f063
-
SHA256
aebfafc8f17c3e37b410449c4359f8134c14a59d14e9057f03bccc8a2942bc91
-
SHA512
9ee6ab5c38c5589c626da6ba53f1f01e374266d80eaa0500340f3db0ab171c44c225294f2e56b969d16433c4ee990e26a0631a15ed9481b29d9927ccff098d24
-
SSDEEP
49152:zNTBEg98FnQNHGm9nq3AcLF2qSx/roRmwuXMi5IgD:zNTWkRGm9qQcMquTNwu8i5R
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aebfafc8f17c3e37b410449c4359f8134c14a59d14e9057f03bccc8a2942bc91
Files
-
aebfafc8f17c3e37b410449c4359f8134c14a59d14e9057f03bccc8a2942bc91.exe windows:4 windows x86 arch:x86
60b080fca5d4fad1c0ce2258243b9e78
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
kernel32
FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 159KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ