��[>\2���Mv-����Br��A��"B�+����h8+������ի��a�E����&�Q��K(��/)�R�n;ЊE��ZT�����Ce�5L�&�L����)�uD|�Ӆ%[��x�����;�%�!s����v�#"r���g�����r����V�d���7��R��X���w$���Tb���NFCϊ�*Z�O��7��� ����Վ�0vcD{gY�-X��Wcu��`>�(ߣ����A/��a5&�1�r� �H����&�\;��U<�b�u{OI/�l��(�M��8�,�D�Zukn�δ�N���뉦G�oxe9{���E)�������6Ɋ<�m��{%���p\�jG/�攼4���l�.a[AO�U�\ ^!rx������I�Z�P2v�Ij��f����s��>�bn^鍿HД�+:U+z��� �%�txX��̎=��.P;�2)y��iN�^u�Ym�Ow�o~i����?���t<�i��%3��u0/�X�^b��.���,zl{Fc���~��b����oֵ5%WNN�{���\8@�i����i��U���z#�ޮ�y�ѧ��"���������7���zo�ѥ���H���� m�h��v�S�`��k���4��eU�*����KQI$2���_��\_.q>��+�L��������0��n�ud!��LW��������حq� �������f�y��������&����63�aM<h-����HfH���$���[V�RĎ�������RIN�ӎK$?k�ZK1�J+hjg�!�J���+2�kȂ� �w����&>�M�9��LS�-jr{���u9h-خ�/�7��N�S5����Ax�[��8R>�"���$��o+N"��p��=M��i~�W +�����UU�ȅZ�Z�:>�7�aGǶ��A�6���&҃$y��OD_�Q���3���v��1$���W�� ��;4�-���E�ٙA���_#�q(���2�[���;�Avd/Нm��*���]v����O~�&̲e ��ߪ~�ӎ�8P:h����s��S�������k��gR�vCfWu��E�к�x���:/�{�K�؋�Ʀ^��ߥ�d��b��U������}5�Ը"3"~/JͤGm��]��j�L��t~����w�^ ��l��_:�����k�zw�w��� !kc�M�&li�yC:�/M�~����]T��d��m��6�C����48���Í *ÅH���N ;/�ln�ҷ2�Ex�*5��0�U�(�*s��(��n����bJQ�gK����9���a Þ!0<B����L������� e�?��f�~p5w u�YyjN:Q�<D!J��B �iKMy_��5Y6hc��044j�3�hN9)ix��_�T��K�Q3�I:�9[N~�@v���Q���<�Gy��"q��K4��ΑA����.b�i�"%�'�&2>s�5�!J7s���|��%�́���0�/���{�h�\%,�D��N�O�=�Eur:��4u���t�˿�kT����։:�%��V[�0=��>�ZF��E\s�3���t�������Փ�>t�?�A0��U����\�����+=�S����mzz+˴G����j~C+�/�R�/0����x�~����*M;�d�ȑ!�\��뚣����[��_��O��B��o>�����nC(�����W#���-a������_�����|`)mB�%��ҫ�������/̂A7����'��8?�)���n��a"� ����%rލꡁ@�岇������!}6*�t���d.��:��YTa���b�+�r���ŭ�GZI/���U���s��H�uж:o>TE.?(v�ˏ�K�IW=�),ܛj�r�2���<��z��|D�Rs�!>�B�f�OhM8vX8�D�?���h���B(���Bf6�P��S�3Y!N���!�ʊ����_�^:gG���4\hȆ�R��sh��d��q�H�e�&P�>#��VMo��X�RD���3��CtB��!8l�J�a$R1 ��^`R b�b����������6�rkjdzl&N��:w·��Cp�� u��1���C��'B�.9躄q{EҬ:GZ�q;��R�L�������_� vY�pm<�Lz���Uɪs����Jߦۚ �� r����h T+���q�o�ފ9&W���j'�ic; l��I]h�wĽ�Ǖ���E��f�zQ�"~����'��lQ�JL�Z{Lp�Ws�U�>m�����v�q��������X��g���5'b�����1v���i���5Td��s�gΊ��fP�����z����9�qSlԛ�]�ݵ��N�ǹ��ɘ�(��u `�_p��d)�4}U�h�`�>���Gl��TM��?"7)eߖ�t���>��ָ$$}�6)��U2(�=�钒��z�+&�ɬ;sDZ����\�1o���\�����2�� ��,�39~�o%�l?���؞�L=�^6���'8?�0����l�����'��f-�Xu=z��-��{o�J�4��8+!Pg3�܃Ǥ���z'�X��gJ�2.k�p��G��;�by� hO��ݫL����;��B+Q�xc�+��G�1^������W��)S�Om�#��� >ȍo���(D�1?�Hp�[�ӫ�KܠPV��]�,Q]�f�O�xx9,n��l���,��'D�,c��a�O�uD�����ާ��b4h����^F}EUOj��@}q_k�G���� b�;-��w+�&Q�����ՠa��/^ p�tX���m��ˮYB��Eh��K�_�������� t�D�ts/~�lS�C�P�;�|���C3��J;/S ��K�'%;����h�3'}��Rc���0�p#r��a8���� U�����RT��W�3���8M������x��a�Y@��<):����ݟ|br�M���}gв6���Ht��(�C��/�Dp� e$Z���M;������V��3LI��ßS�<���7x�~����_.� �X�oV��K�յS6CB8�G�#4��8�
Behavioral task
behavioral1
Sample
37531182474261f292f770ccc266191cd9ebbfb02c8cca329b6ad05ceeaace6a.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
37531182474261f292f770ccc266191cd9ebbfb02c8cca329b6ad05ceeaace6a.exe
Resource
win10v2004-20240704-en
General
-
Target
37531182474261f292f770ccc266191cd9ebbfb02c8cca329b6ad05ceeaace6a
-
Size
164KB
-
MD5
2e4dc2504e957a4a6665e85d647e0b95
-
SHA1
c12e5f7cfc51ee79333f741a7bb094d98606c79b
-
SHA256
37531182474261f292f770ccc266191cd9ebbfb02c8cca329b6ad05ceeaace6a
-
SHA512
3d74f3beaa71b65dd5fc57afae9bf66f60c96514d284b3fff505e84c529e45662eda9d684f2f87c974ce475e67f2385743e5e28cec2ef884b4549bfcce6c39a3
-
SSDEEP
3072:18StjEj1IOsxVDUyKLhaMuccRTVkmkE5tMDDA1NTknxWNdFqi3:19tjEj18xxW5gxamkEeYNj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37531182474261f292f770ccc266191cd9ebbfb02c8cca329b6ad05ceeaace6a
Files
-
37531182474261f292f770ccc266191cd9ebbfb02c8cca329b6ad05ceeaace6a.exe windows:4 windows x86 arch:x86
0d5d8512b60cdb90035d25364e3142df
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
__vbaVargParmRef
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaRedimPreserveVar
__vbaFreeVar
__vbaAryMove
__vbaCyMul
ord587
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaVarIndexStore
__vbaRaiseEvent
__vbaFreeObjList
__vbaVarIndexLoadRef
ord517
__vbaStrErrVarCopy
_adj_fprem1
__vbaVarSetVarAddref
__vbaResume
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
ord553
__vbaRecDestruct
__vbaSetSystemError
__vbaNameFile
__vbaLenBstrB
__vbaHresultCheckObj
ord556
ord558
__vbaLenVar
__vbaVargVarCopy
_adj_fdiv_m32
__vbaAryVar
ord667
__vbaAryDestruct
__vbaLateMemSt
ord592
ord593
__vbaForEachCollObj
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
__vbaCyAdd
__vbaStrLike
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
__vbaForEachCollVar
__vbaStrFixstr
__vbaBoolVarNull
__vbaRefVarAry
_CIsin
__vbaErase
ord709
ord631
__vbaNextEachCollObj
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
__vbaCyVar
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaStrCmp
__vbaCyI2
__vbaAryConstruct2
__vbaVarTstEq
__vbaPutOwner4
__vbaCyI4
__vbaI2I4
__vbaNextEachCollVar
__vbaObjVar
ord562
DllFunctionCall
__vbaVarLateMemSt
ord563
__vbaFpUI1
__vbaCySub
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaLateIdCallLd
__vbaR8Cy
__vbaRedim
__vbaUI1ErrVar
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
ord601
_CIsqrt
__vbaVarAnd
__vbaRedimVar
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaStr2Vec
__vbaUI1I4
__vbaFpCmpCy
ord710
__vbaExceptHandler
ord711
__vbaPrintFile
__vbaStrToUnicode
ord712
ord606
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
__vbaFPException
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaDateVar
__vbaI2Var
ord537
ord644
ord645
ord538
_CIlog
ord646
ord539
__vbaErrorOverflow
__vbaFileOpen
ord648
__vbaVar2Vec
__vbaNew2
__vbaInStr
__vbaCyMulI2
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
ord573
ord681
__vbaVarNot
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaFpCy
__vbaLateMemCall
__vbaInStrB
__vbaAryLock
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaVarLateMemCallLd
__vbaVarCopy
ord616
__vbaFpI4
ord617
__vbaVarSetObjAddref
__vbaLateMemCallLd
_CIatan
__vbaCastObj
__vbaUI1Str
ord618
__vbaAryCopy
__vbaStrMove
__vbaR8IntI4
__vbaI4Cy
__vbaStrVarCopy
ord619
ord542
ord543
_allmul
ord544
ord545
__vbaAryRecCopy
_CItan
ord546
ord547
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaRecAssign
__vbaFreeObj
__vbaFreeStr
ord581
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 152KB - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ