"��)�6���'?O9 IW�^�Rc-�9��0��g���l#y�z�xjb���r��Y�F�ə`3�����/�Yݿs�t^X��x-��_N5ؕ�D�R����ΌDz�nk����3.�G��4��_.l@����*��uL|��n��n�k�{f9�rl��W���.;��Py��T����@���:���^f�2�\�ޫݝ.�ԋ����%���*�$!dp�������X,���{�ϸ4%��S�D9wQ>�{�����`�wS���^ �_'��� �� �>Cz3�g�s�"pZ )�L��9��z7� ����r}�k����^����'��I���A�.2���[��J���#F�����b&A�0L#������㹱���=5��bK��D��Q��Su�$:��*��D�����o����>�E���p�M�� F���?X��@TԺ70�o���ʤ�*�o%�[��K�-��x,���"�a�h��ׅ�#V��8�bӆ�^U�U����'^� �#-�b?�>�%�i���ƉH]-JuG|Α\5Z5q�^܍�H_��;���2^���2�^�'�KkI8Rc�)��E���)5Y@�W��f�MWD'Gt�ycD�zF�a�]�hA��U��i#8`]�?Ϩx�Vښ�ɲ)����Hq�d_�Τ8�� ������͊�h�j6�gߨ���ˉ��A�-v��y�+��:�D� 6;6^R���d�ңB�$�R+,:!���p")����#���D��s�e��-?�6���j�86�UP��������1Y�iy�s��X��'Dz���*��/���!�$/ZN%F$_��t�=`\�XJ���M�I��g9�o�m _~�f&�u�"_�Z�X���I�6i=)�QBv(�4xkו�����(�A?�p�yFS�����8B%�e���G�^2ʔ+E�}*��;祍\X�ѐ��+H���d�;�~x�\Gֵ�gtE^0Q�������A=� y� ��K[�R� /��7]b���XǵW�п6?H_�A)�rBm�W�i�k���\Q2>����b���3����zNS��9�B^Z��`�R�.�G]-�Bg1td����X�?����"�%3-���ҏ!Cd�w����/ٸM�L�A٬<��� ���ؤz\d����*K�B �+bdx�.r��bJb-�_6����O�F�+rQ|���2Nl>2hv�� ;��aM�ѭV��a�e�$ 0���j���M����ad�*�t����[���,���]+�D�1�q�sq�/)0 ȳ��AdH���P�"4�ְ��/�'�a>�AJFi@-�wϥ2�bao��Y�P [֛y��@o=��T��z �q�H+�a��M������ﱂ�~�a�E�ϔjj��B~�m25 K��O[�!�ݟ��@�?�k�El�U��VE�H�c�ZZ穹Ry�V��h�&�7��ت C��U�Od�̖y+�i n�1D䲭��j;/�dBx��"�5&kMK��L�֟o��6�1\�5�)�!�ՒE����86DA�x��z�z���,N��� �m�y��*�0]���5�g >�X�|8J����� ޥ�~�8˵u�0_�K�*ï�Fi� l:�-;�3d�M����j%[�\j s/��A�)p�(��|j�Ǥ��8H�<�è��@�3�_!����$�x?�b�'�dQl0Q��_d� $c�r]�~�B�UR䟓��Y:�5_{�����R��tN�}�����@J�4����b��a�Mҟ{�k��D/Jl��KJ�֕�ىx�"���N�;�7���# �%:�R�rR�Xstnv_�5��RcP�5 � �+S�G߈`��j��a��H�{6����>���s���`��`e��ۑyw$����Q� U���|�\'�ҭ��~������L�-�'�Mƀ��H?N��N~3Œ�q��s���2pG�e����U�� ��{ $МK���J���Wv��[tP1���a��j`�6���<������:��ϼ��$f���z�UBڽ%i>�bϒ?��~�Zr�܇%#�h[DC:��vP\���E�l�5�S�Q�c=y��������3m�,�z�� ᒆ���#v$x�&�C��^��X�qk���1�Y$����L_Ϛ��]"@G�����n��o��خ73�W�G�(��ŕB�������f���l�sl$=@HƍS��{RL���1��@�t�+�Z۹�2J�7r)F��;��0��Z1U�B�e����Fj�W�E@��[�#��;tq~d�Y�]g�'2�~*�>���"��b��(V��:<����qmB���$�\�����e_Ah���^�Y�������7�N�M�1ǖ��,r���.���7_�5�\6C�5ʉ{�qχA]C����p��%Wv���y��R���C�R�NLHW�Mh�MÕi�m�]z(���W1���H�V3!"�&Hp%#�T�n��H�~�~N�b=H5��ZNN����/2���i/+造�V!�f�X�A� ����QzkC���iE�Y��k���Ws�������\i��cD %���� �D^K��8���S���%�E�Q�h����D�%(�G�Y���"R3-��:�~`s�_ Ѡ�?���� �������y�'����r�(����.n�f���1yL_��K�-~�Տ�@�����ئz=��o�������xT�=f t��s��7�24C����g��X�廇�;��N�FT��*��#ۄ�������J6���-z�`8�Dz�~��,Ϗ�����-� _�MZR*���<-�^�QYSl/hY�cETj>�USFJ'���B������L֣Lşy�>��ia3�o��,5�>���Z�d��� ���r�d�r�t��=��z���o]����F�a�A~x��B��"�ۿ������y$p{{�A��5�P �5P8k�&����'�Ӑ�@�cxw v oi p�6�����h�Ĕ$y��� �0�n���0YzXM��F��]�p�;9ّk.҈���k15�9��q���"
Behavioral task
behavioral1
Sample
ac67027a6723843337d1cce20c85d770ded993770e78a75a3bb4223be2639e29.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ac67027a6723843337d1cce20c85d770ded993770e78a75a3bb4223be2639e29.exe
Resource
win10v2004-20240508-en
General
-
Target
ac67027a6723843337d1cce20c85d770ded993770e78a75a3bb4223be2639e29
-
Size
7.2MB
-
MD5
99fb2c94eec80c0b203850c82f530be9
-
SHA1
5d51a8b9eb736206a52a275e907509d40458b18a
-
SHA256
ac67027a6723843337d1cce20c85d770ded993770e78a75a3bb4223be2639e29
-
SHA512
f1c1bf36878069c2069b0b37aeac7425882bffdb29bedd4f27533260bb1cb8f60b5ef3fd48a0153c789c6054a7893f74d4e53a967325bc580be84fd394da24c0
-
SSDEEP
196608:XvixuIzpwBu2dXj9makPmsc6gYE3lp+V2vs:auBuuXj9tsc6w1p62U
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac67027a6723843337d1cce20c85d770ded993770e78a75a3bb4223be2639e29
Files
-
ac67027a6723843337d1cce20c85d770ded993770e78a75a3bb4223be2639e29.exe windows:5 windows x86 arch:x86
5636aaccf8517414d8d4483eb6c1472b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
ole32
CoLockObjectExternal
shlwapi
SHDeleteKeyA
gdi32
CreateRectRgnIndirect
advapi32
RegCreateKeyExA
shell32
ord165
oleaut32
VariantCopy
Exports
Exports
Sections
.text Size: - Virtual size: 583KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 270KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ