��֨{�Ӥ8�GuM��-.��;m� ���!�ks�:���*%�����Z�'L����܉j�ajE����*r����(���F�>�H�i�*����Es���9@7����]�"��x��l坈���Y�8�j�x�w����KN�Ku�3�^�'�Od+�A�ljZ�Os ���+%�b�d�s�i.�E��=�c.��y�k�s�Fj����/+�uCx��-�(u1� ?J�6�ӳ���1�K�ݖc�/3ڭۓ�h�uD���h�Wx�V��b�� ���-�3.93aٯW���+N��Q4;��=v4H��,��$D����x^�oCS�b�@p�0�&yzR�`�d"Ȥ7���7�u�j�t��#Im�QA#�ች<M�އ`�-�B�nP�v/b?k�B����? q���QH���9���4B����Ϡ���C���w3���^��]�����)�'b;�|g�e�\;�t��.��Ї���(b��o���kѝ�z����e�-���b%��QlXw[���%�]�c��%qtI8M��� <�=�u�Y����}���셫iZ����j�7?�c�7.b�߶��Q1��I�) �������d%q���N�N�Ҳ���a���==� 0���С��)���M\�~�5�&n��ƭ�T�2AJ� �4۫��v��X�J�-q;4ɷ�Af)�8K�vQ�~0j%j��������c2ؖG���W�U�p�A����}� ��8�I���M��y�q���fW���ɾ��-�NN�C��]�IΑ�@����C|��Ub��:���!������SHSZ� �hRGD#���,��3)_)�b/�m��x����q;4|v����8� ����/`Z��9P"�:���2�Wݝv�o�a� ��D}0��u��|[JO���.9ON�{� D�r+ `N�i������.�M�2�E!,�Q?I7\��p��y�V=Ēv�6t�2&Q*���l0�ʊC� �:�v�%;��E�W��əq�S��˓�.,1{�2�}l+���[��|�����Q�N���\*\��`^�X�A繥�?�馾Qx�9�H������J����rj ����߆e�dV0f�3'|fy�U��l�H�Ƃ� !��@4�V��R���Us�)�(i[ݡ<�Ц�]a��WlR5���wd�c�WFjAvT��Ve�V�~��{-�9�ܔ�66�*K�O3a�L�¢���˺�&��?���(e5$%�,!���~�+�����$,K��|D�����b��:��)��\��(e�U���O��:,���b��ل�&��N�5�$�<~]?�'K渜�<���5X����߳��~�lC�n����QB���V�Mu�p��Ï�z���:/�JM�~��/#��2�r�'�S� ��b��W��cK%�v�^8Z�ë6�lӚ�Y��������i{h]�y�iwi\�fY���Qut{92���i�~��~m��9��� �t�,�FՓ�����z�JB���G�Ҁ��l|?b��`$�i8^w���8��WLP�@�+���%Pi�I<ę���} ��:2���)p(G���)��/�R������?����C2��� �ym4�@���J�S[��g��R�b��yYy,=h�����*f�ӱ����.���q��̀d��q�D9y�D�/�b�,�k�~�#"�eH����3������5s�Α]Ό�a[XMp���>s�:�Qah2�js��V]��0㐶���0N��$��mIq!�|th8�ѯ���Q�4�X��7f�1��k�'��Do�OS=��B�t��bC�ҕVtR�&�:�ݳ/�1�i���4H% �=�\^��t��"%J�Un-�X����=b���T���#EiHR��#+yAV���Uf����${~�#������=5�������"�Esg�����a���p��7 ^��߲r%V��7.���m�Ǿ�͵��_�Z�T%$����E�&�HΥ1Q ���]�`v�n*H���u�f�huFO/�5������B��Bͫ�k�T�EH 8��ft��`�@�k����2����i��D�goA�%�k�0��O68_��5�CC�5�1��"�W�V9 ;�����W�s}: F��������>����Q��x�-�7���I^�i��2{�N��.�ģ��4qX$i�7o�%�(nU�uɔ-D�j����w0}�$�G`���Ob���~�X��{�R���>c7ԷynI�l��K�J.�F�D0�F�D� S��HL���Lh]�� �らQ��`9.�~v�cD^�=k�{���V���zB�ہ@,��D��b��{���P�#���;:�D����᧮���f����8��T^���MvQq��Wh�2����l\�?��K��?��ɤ�����F9�Ѝ����F�`nx ���K�$�W��O�>-M8 �"ST!c�^�Xj����*�kW`D��a/uu�:�� �@1�F̍����wB�Ur�q֞먁,Ѱ5�# y$Ҁ88�51ty_b2��s,�Cg��� Ҵ�r��5T�\f��QY��1��k�i�� )�$<�N���t���l-�vI�HV�>ض��S����@Ɂ1�=��4����,�*9�$⦻z�e�~]��E�����u8؈�vi�)��/��b7�b�fQ��?��x���iXt�0-:a��^�� �?��<���T�n��x�'�)�&���S�_���%k�f��z��ۢ�)Η�� oXN��/(��L������g������4����qɃ�B0�M�A��ˬޑ qvV5;8v��g >��"&����h�AL`t�a�Vh0�q;s�{�U����8>f> {�Q��tܤ�നNF�k0��+M+�SL��;`�,"��H�tp�ح�.����:��xe^6!#�C���=Kd%�Jw��a7�ٰ>3?Om��A�t�����ɹ��Tǹ��)H~X��9�1S3�٤K�,�$��-����)��\��5����e+��1g��-�%��w�-6���>��a
Behavioral task
behavioral1
Sample
54fdfce611375ecedeca02a3c63c598df604e274e03a8d42158a199c5d4940bc.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
54fdfce611375ecedeca02a3c63c598df604e274e03a8d42158a199c5d4940bc.exe
Resource
win10v2004-20240226-en
General
-
Target
54fdfce611375ecedeca02a3c63c598df604e274e03a8d42158a199c5d4940bc
-
Size
5.3MB
-
MD5
fe5495acad7921f271a6b9e800e0ffb4
-
SHA1
c1f3ef5f85efe22dc77f7015e9e4b36ab68d8973
-
SHA256
54fdfce611375ecedeca02a3c63c598df604e274e03a8d42158a199c5d4940bc
-
SHA512
1262d792b1a30ac7d1759d13252161769c42b460dce92533da76cb1f2840a3739ee3ed39fb34c488388e7695431cb47cced001e2ceba24bd2085a85b0ba8e9db
-
SSDEEP
98304:S4fsTMoZJePOQwDWm0CmmIS6VE2QasBncbhQHBnGTAwoPZ8qywvpZgViGB:SPVeBSB2tS6SBnmhCxKAwoR8qKYG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54fdfce611375ecedeca02a3c63c598df604e274e03a8d42158a199c5d4940bc
Files
-
54fdfce611375ecedeca02a3c63c598df604e274e03a8d42158a199c5d4940bc.exe windows:5 windows x86 arch:x86
3de470dc66938526e93c5be829fe997b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersionExW
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
GetSubMenu
CharUpperBuffW
gdi32
LineTo
msimg32
AlphaBlend
comdlg32
GetFileTitleW
winspool.drv
DocumentPropertiesW
advapi32
GetSecurityDescriptorControl
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteW
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsW
oledlg
OleUIBusyW
ole32
CreateStreamOnHGlobal
oleaut32
VariantTimeToSystemTime
gdiplus
GdipCreateLineBrushI
psapi
GetModuleFileNameExW
winmm
PlaySoundW
wininet
InternetWriteFile
ws2_32
WSASetLastError
version
VerQueryValueW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 47KB - Virtual size: 843KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ