)�T��W&OW�.����F��O3F�3ٽ�v^��h�ڞk6�a����ʖD�{xy��"+�]���k-�lMI�ĺU�^%�����$�6P>$�N� Yk���v���>�A(��/#�zH���n^��:����>��cE�`�l|S�:��[9e9��/��M���"ˇۂ@Z�J�@x?�����bI��N�M ����=+\F����˕r�k+�]Ы`��͝^k d��j1��!6�����"3ɺ�Q�\����DS@̓#�Pc&8G}��w��訒ݙ@�v5{빀ACKr>�p�Gj�!�΅��m���NG���E�u������>^��9� ~�ivs�ϝ�Ư�V3�d�O1ge$4~�H�>hD�4�cfL��t�ğ�e�[��H�a��^�%���������.� ����#�6��j������|x���î�s�Qd��b�*��(�62��Q*��@�s��0 �7���{��F����D+gS�}Ш��� ������>�}[�����h��\�U�'?�tC�˞V��ٺ�^KW�p�g� �7�%sD6�c�t����@�W�0��_h�{��Pe��E�4AY��އOu��D��C�W�B#?%��j������P;�v���Q�~(����c��:By�R��IV����EŶ��q��JC�;��@���fk�QC�~�]k��D���O��~>���wL�Xcfa]�.SA:�'8�4����!3��7{IW��BOxgU*HL�k�gpG`h�#d!�S���R�����g{L�n�g������DN.斎��~|7�u}a"�Jέ�Eq"W&(�ژ�Z�AWa� (�҇m�չu��v� q���h���^ڪјM����D#�Q�. ��r���E�<��ԭ����w�O[�Zn����%�Y�<�mˈ���I�/�[���~�}3�� ��ip�UX`�vpB�w��������j�iP���Ѹu�D����P�,^=U�mM���,�A�`�� S��QϦ����'J![����#c�:�"��׃HȘH��PR�V���j��-����Z:��|���j�R�n��?�Z:�J���M������Q�����.Ӽ���\��#m�����.mlU�7PW�rt�v�����H�R��X����� s������=$f�I�Ū.i�$�1}?l�3N���C�n]')Rfj�;�ѭ��f�A�3�{b��E�6�;1ͣ�9�8 痠�Y�>d�1� <[�܃@�F?<ɉ�k�S��4r"��`��jom���5�0ɝ�l���l7@�4�����Ăh��hor�p��P��rq�6:dbag�eZ,�N ���7�����Yۦ�#��Y��0!�x��� |���b�����m��K���D��h��S'��(_���݉qH�7�A�L���n_���:!�7%���s�֣��~�I��X\rC�4�3�Hѻ�>�43uh%���&�M��y�X�-I���q!fr��e(%I�'�����B�Cޔ�C,(��c�zW�ǐd��� 9�"&��l����F뀮��!�:���vF�I��[�<�~�������@>� �)<��ND�ާ y<T���V ������g+OU[m�#Mi�K,�Gg��T� 1���<f��ࠃ.?|��^��Z� %& ��xl��{nw���D����_c�hl^��d.a��8����>��Xf���?V����+aG��LEsS�<���K�,�j�����I�pi33t-S���� �rԅ$Lƻ0��_0ut^pl�ȼ��:)�k�6S+x�Y'n�������s4�BJ�@+-�V��H��\��m���SS|�i'�^��!�$P���EӚ�_�Z���H��QI��U�\s$��_lB�����-��lS�=���*AB� �V ��P���!�!��#��`�����l>��D�d������j`�iؽ\�JN`�cJ�������E[�4*W�h's�����42���ս��2zf�:� ����3Ҿ�!Ga0;�� ϑ��{�ɖڝ*Pk���9���M+c���r)*�_B �q?'��V*����+/g�l��+`�qTIK��rˍ��_;��-3�d$��ļ�!ZoBa!��� Κx7XZl_���&�8���4���!����'b��U���ϲ� c�Ѵ���$G!��L>l�)���*L!�յ������\�T@���my�z��������v ���z���B< L�>� #���_/|���}S9�kԑ���Dh��?�`���b��H�)GF�+���.�\�`��$P�U�Ďj�y;���,��e� D�*��x��,�Q���]��rX�_�Q��->�)=�QSf@�o7 �Ê(�[y�7�����rƧ��I[Ye�Z̰�����Q3���R��@��`���^a�N|�� (��d�� #���<��G�<�93����5~�V<�����az���\�m�O]Ϲ9@��F�R���9d� پ�dz�{j��⽽��x��wfUO�#w�]��� ��aźg�Z��T�oh(���+�KdقO�S�چ��ŋ���w3y�עRi��?�<���/?��f��V�����`j5��r�Yz��\����"Ӭ/dž>��C����\ ���r�J��)�ڦ��a����o���^��ÿ�뗿�����b7��N{ŵz*6;�_M�݁B�'^�*g�pF)��X8��x#g��{3.����m�[�G��E��Y�Y֩s+���¿.��UErP+��~�7b�o��I�ȵ:�F��������&{�����B�j����dZ�-������Y����<�>[��2���}O��`��!Az��눪)f� �ؽ��T>���x{:F�->�o�K�{|���-&f��IB��R�`OK���j��'���p?��7�.K��pJ��w;'R��p��(C�����Q�*,���֖�zT��21�h|� \��0�~���S���S�O0�S9"���� ;n��i눮Pa��x���'�����9�&�Z��,�'<�b4Q��k�1W�>� \S�P�vuxe����_7�y[��0#d�*�ȅrz�*
Behavioral task
behavioral1
Sample
07f824a32ca8e6296f4fa4c954c54b978953af4afb230d66ca7a2d29f899828d.exe
Resource
win7-20240508-en
General
-
Target
07f824a32ca8e6296f4fa4c954c54b978953af4afb230d66ca7a2d29f899828d
-
Size
14.8MB
-
MD5
53e8ccb0efba5637f7fbecf88858e169
-
SHA1
69ff0254d6044d86eff0467f8b22f01f11c9f1ff
-
SHA256
07f824a32ca8e6296f4fa4c954c54b978953af4afb230d66ca7a2d29f899828d
-
SHA512
696e3ed09068d2d801578ed2824819d092d79b4ab276a03a2d393e889fd7d668f98e93161d54460b116b67dedef1a7be056a18223c5ca6fce24cc5cdf36e53bc
-
SSDEEP
393216:81MVDvA1sqrxKLSQjmQ2kuUyZGezgJ60R0:e0bqNKlKGOM6+0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07f824a32ca8e6296f4fa4c954c54b978953af4afb230d66ca7a2d29f899828d
Files
-
07f824a32ca8e6296f4fa4c954c54b978953af4afb230d66ca7a2d29f899828d.exe windows:5 windows x86 arch:x86
fcb1205a5f64889e93fb79ad3c4ac224
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMessagePos
CharUpperBuffW
gdi32
ExtTextOutA
winmm
midiStreamStop
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Draw
ws2_32
closesocket
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 827KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ