�g&<�>+�^�Hg���[�2��7��� �'����ɠ�Ȓ�cH��r���?���r?ɾɗT�ܩ�XO�b@��ª�`Ez �|;lj~����r����:#�ʄ�A/6���*���l6k�~M��Ve���lԽ�u�l*l�дg�$ʠL�$����l<��[**��Io�)mY"v����z� ��6�2P�^/Mb��$�Q�`NՂF��K��a��6��t�앙z�2:����ܲ��;��[����LfK���U&L�Q�X�?�>s�t_\������S���]�uw�>��@����x�DN�E����zl����ZWi����1L��� ����)�M�k�ej�l{��6������Q9��7$DИ-���6�����"�R�9�e�����-I��1N\���d�]Ń�ֹ��Eh��~*���r�Ƀ/�5�5��Z������[4���j��������b�%�/���=��d�m��A�`W�:�_V- ����5`���V���`���~�$�2/)�-E�I������q� *�nK��~��R���X��G�Ǥ��z���}GV�Y��Baa�b~���0�G~�@dX]��_50�&ܒlk)l���{US�'���������0�8- ��>�x6�*oW��������;NS3Q6r�ڥ���Em���d�H1�����B��鰔���#���ow�,�D���c��>;=p�M��5�A��2�Ͽ+S�yu�GU�Gb;;��Ñ�7��xgdcizѭ�������~��ubO�6�����bǟg��B��"��pr��9�̷����ֺ"!���w-�h���K�iNu:����<�����W�� �w�!�)x[Ka�Ɨ_��s)ӾY��E�Q��r�P(�]�t��l. �}�Dh�D��e=fL/�0W]�,���:�w���'CJ�A �Տ�ÈV����/-�?i ^w.T����C��Q�G���j1_~ ��j�ak��v�V��c�B{���o�!��ʻ�[�u��ƃ������y��b����xzL����d��l�t�t7#��bgB��\EJ���p�:�����ۗ�s�U�!jAu2����Ԕ���$��VRr�A����Ȅ��feQBFCm|�d[!�Qm����J�ް�R"��ut�۱(p��k��#���?C���{�0j��%Α��nDS�#V���EP�!�nb�k�Cൃy����/�]&<�R��,!cN�Q��H�pi��B �ỉC;��`ꋮ�x�?�qYH�o���x?u)E�;��SvuE~ip�t]?���D/�n��]��?�'C�^�F�VʢNP����Ŀ!˚D�������Ozn0g�j��~��m �Y�y��6�7�mM:��1����˅";�������>z]��c�&>���_����C�w�s�A�%�"�!'C;Hw��c_�0�{�eb0bHe��p�Q����H��GE�S7�!�K���h�aC���n1��h���9��fĀ[BL�}|q}k7㝩�I��I�^��'$<vcȈ�}�UcX7�S�2���9q�gR5D/���c���C4��&�f���|�x�\X����:�B3���%�_�����;�Di���R\<%�5��-w��P�B���F!�ϒ�A�yP��-_?�n���@>������~�<ٞ�!w� 4��y��Bj[:�� �r+-a�?�l��pI��ux��H�I<�@�m��R�l�y�d TV8�q����$�+��N�FdgJ�50��j�0zR�̈]x51aKT��ٟ߬��Y��� w�����!^�kҠ��i�kE�#a��� �B1��]3�Ҙ��kdQ�x�;��+s;�e������CY`����ktzL"�����&-(��]����n������R�h8$��n<M��3I�DIe�*��7�6�c���+ʦ1�fLgyJ��/\�(��E3!��J��_2y.�֊Z0 Ĭ��4��@����Ci�B�Җ{��'w��&�� �FgT$XK��-ȱ'&`�al���/ f�af�8#vr���~z/�јzn�r�.K�Ĺ1�0��� [�|���.d�.-7������yU�x��@"�� qY���!x+�Xw�<ݳ�7��^#Ӗv<ޯ4�{7�A^�]i0u�觙�\u��`�ᜆ?V�s��)����O"e��˦g��hhrHw-@��ߖ���?��0��ЯFK��P�NW���J0�����,��k��VItNg� fS�P�Z[e�2Yx��Q����L�ЊVL0I �K�u*8dL�Ũ�5���S:�]C �f��@�,8Ux�A�����"�C���eW��rc_�c��]ɪI�bb�O��\�Æ�A�ܩ��~w�.��:������fW/T"� �|�@�Y�l�n��͑Z�זi�)ɒ۬��"� s��1::Z��עqܶW�������m�E&u�6|�, .�(���-��έ�� �o�ܛ9z������O VŐ��Ӥ����������Ѱ�\�� ���*��#��+���������S���}�(��W��W� �k[U� b��T���l'�;J7kV,�]�sA�أD�кֶ`<xh-y�1y�!N�(�0�졿��ҳ� ��ӑr!S��vBJ^l�v����������v�D�m@�n�+*�g����k|M�P�Jc^�ϵېD�~g���I��,!���(���f��{F�ŏ�?�CT>�W�On@�-3���S�J� �KJ�x��pr~��cYj��_j�n'�O�'6�H�j�a9��h_����J닯��"umO��v�k�9o�߮�:���\ U������D�J��� ��<.U35B�a ��:�F����n�W�������������z{���U���},̠�q�b�ᤋ�2�(c�Yw�I��7��&_�(�9�f�:�[A�{n����t|6~U�MV;����{Տ�����ڰ�&�8w5Q[�Ő�ȕ�Q+͔��*��d�y����@�`��l:����S��]t]DQD0��e0/�|��ēy
Behavioral task
behavioral1
Sample
4d970addb03dc594772ec7c85d262afdf33360c22d36fc060219adf4542f857b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4d970addb03dc594772ec7c85d262afdf33360c22d36fc060219adf4542f857b.exe
Resource
win10v2004-20240508-en
General
-
Target
4d970addb03dc594772ec7c85d262afdf33360c22d36fc060219adf4542f857b
-
Size
632KB
-
MD5
0f0cb68ba197a06e0adae92bd61082d9
-
SHA1
2522e8b8faec169fc5554892a7fb35443efed1fe
-
SHA256
4d970addb03dc594772ec7c85d262afdf33360c22d36fc060219adf4542f857b
-
SHA512
69e133fb969a37c37379e56d721c8f650a4d933499a60c496da2d7417fde247e1a1b9754a519fd7ea12bf1d1fd866002fed466b73ae4d81f706d1075e1133424
-
SSDEEP
12288:Gq0lhZTE4oTbC4FJac2wts4klD1xNf7Cy/8B9vY0GBp+3cEK/:67Z3ibJOYts4Sxmy/E9vTGBp+3G/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d970addb03dc594772ec7c85d262afdf33360c22d36fc060219adf4542f857b
Files
-
4d970addb03dc594772ec7c85d262afdf33360c22d36fc060219adf4542f857b.exe windows:4 windows x86 arch:x86
3376029013ed9d151ce606a7cccb7d9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
SizeofResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
gdi32
GetStockObject
comdlg32
GetOpenFileNameA
advapi32
GetNamedSecurityInfoA
shell32
SHGetPathFromIDListA
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 450KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 620KB - Virtual size: 617KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 358B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ