C�����\� �35F�[��Jdv���zD^V��.�Yy�E ��6�*%I:?�������*y����1�Bv%H��t��`+��2 ��AIVqw:�z��L֛��#M���Ԣ�� UG[w���G��l���I_��$��櫫�{W��45^*Z/�6V�?���T�l��HE(n�zcT���Q��n��w�l/��SI����l|�28�,\a3g��w�DπN l���¼�|�I4��B�ũ!�~����17�M^�_I���$�Ǎ�¼�B���B��5ƍt|����f��c���T��+��N�"�}C�i�>�s��X2���X��O����\(�ֽac�"_c%+Yn��3��юE}�����+sv�N-9d�k���o�����EL%�sBb/����AK�gRQ�$�;�R���}��SA�j��~/�!\N��u��{� [�K�1~�����P{������J�O��Mj�Wk��W�)�B�Y~Y��Ū�9��u�2���jL�R&T��q"����j�&f�"��X�P�4F�Qw�4�q���r�ߢ�����+��-S��˧�:�m��_"����:��F�G�H��\ke��Ru����� %��4�F|p����퀍����*�F�z�RQ_�cMo�ҷ�I�r{e�D8]�Z+��7���{d�~�/�B��'��1�W����\�}�K$"���ug��V*!@���Qg�&l(��+z2L^W"'��R�ѽ��}��G���~��w�g@����9`����J3cg8�+Vu85H)M0����n�}dkl H˕,tw��iu���醗9{����`�i2F%:�x|4v��f���V5E�Mp(�mR�o����X�����Ɍ�^��hd�+�ɋ��/d�|�ؼykQ� �k@4�J�ⓃdƄ?7�9�ZG&қ���[\��hP:V�L�֣���dۢ�8~���{"G����Hr3ȃ�����}\ȐT���_���zZ`��.�n�Z=|YBR��h� �3İ�O��BQ�5'�t�%m�|�h� `w���b/��b��\����r��ֶ����f�Wڌ�!m��9u`s�����G��g{��� ���'��UJ֡@c�s%h<������a�:+� ��j���gb��ZB]D�xxӱk��s�D~����v?�2"[b "���?���SΈ�F}P�\�'���yc��T��,�cf�\;1�MrdAP�X���z���,�/��'co�J�3rw�I��&�����.h����p�nū�D��� ��\��rcٍ�Q/�����#�� �y �y����ƅ�a��m���?䆾�q���V/�(qѸs��_"B�D�^b;�����bs褍��}��� ���4Mq֞P���f ?Yc@f� Gm{��0��̑S� R@����H�~j&�M��K������|@���^����/+9�;�[����.��V�P�4` Ͳa��I5mב ��YA��v��u������Φ��P�{a��,ljJ&��F����m�^_0��U[�oҕWBñ��J{C��.OB��ƛ�f��4r+�o�T����n����XH>��\(or�$���^���J�cIU��8P���:֖�韵+R�q~{�ƛ�b��&gN�ʍ�$�6`��xWw���>6Ce㴸�����������P+��]{�&����~�$��eJg;�G��\���V �(�?-��\��5t���=���n���tp��|�P���U�f��=�����h���[����2A�Y4@V�����3��<R�$�Ci�\�7O��"M���e���L: l4Ym�'���JMj[�4��ky�k �$U�B�sr�`9���-Y7�y����4�-=�%_�m�+����+�S��a4X�]CZـ3��5"* �}c�m0�%D̫i��pY� ��u1�F�����ӧ��mޥ��`�B���ڵ�*UM�^U��.�mj �t���N���]T���%�o�L9O�=����W�h�2*c��k������C��o�g�ڞ��e�Ty���F���x��L�������d�.�r>�z�e���s�2�F���8���d�[�/��V�o�z8!�v�*� ������;�y���>�� ���8$:+&��a^�� �����vF/W='r*\y��� ��ƲCJ��t]b�`��:L>����$�/���u��`IYՓw_o:F�6~�g����^յ}7sc4��%*��'�jo��%��>�"�D�I�5��z\�������d:��H���A���d�А �LG��`��å��B��R�h��i��?�6s� ����ϒ�B�js:H�nfha�wc �R� ��ҝ ����ln,<n�g���9�&E�$�`����\���}�Hn�i�7�o��;����V=3�M�e�'���#}ʪY-����ُ�'l8oy�A�Ǣ�Ջ�� �`��kׂ���@��1��p�4���l3fh% t\�]���]�����<o=��.�F۱�j�����Oͯ����4_:N �"�^\�#�Ą�O��4"N��:Z��ڏ�4�}�C�"�!�����s�lƖM���ipg�<k��G��-�BXBiG��lg�����D��W��i��� [F��J��pM\�9\(�9k���? j�U�.�����p�`%/Zħ�笢T5c��q!�F��H�m�rѮ���2��D���½# V��K��t�;�K���ɕ��zoEykY�Zf��FU��}��������2VÞ�����()��%_��kE�,讝Ҝ6�a�,����MX2v�t�����|;�>H\�B��HW�����]6��2[箼:"��]�v]�l��}N`��&oì��\�fU��I����Ű��Y��$I�mmSs��~��Qb��!����]2�k�����19�V~A7A�b`���+�L}����Bq�� |O�N)����&xL�)�z�U7%�q8b!Ľ_kp;z��fW�r�Z��/6�� <l�w6�_7�R� ��'���6��,��Bq��Q�!c��w��B���SY
Behavioral task
behavioral1
Sample
ccc49ec6522b018e3c0fbb69ee89c61776f760f1ce532b0ac611625b05e756e1.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ccc49ec6522b018e3c0fbb69ee89c61776f760f1ce532b0ac611625b05e756e1.exe
Resource
win10v2004-20240709-en
General
-
Target
ccc49ec6522b018e3c0fbb69ee89c61776f760f1ce532b0ac611625b05e756e1
-
Size
5.9MB
-
MD5
df45290e6c759939142be204118958c9
-
SHA1
8268fa206afe4d6931c56414974a4bd073b958ce
-
SHA256
ccc49ec6522b018e3c0fbb69ee89c61776f760f1ce532b0ac611625b05e756e1
-
SHA512
63afbd170e3bc859fc4f3ca6b4b58e9160d835fc9e6ce741e284a104984a60b71a4560514a36adc1463beaf71c498206469bfec4a8416853ebd24601f2417bb9
-
SSDEEP
98304:yFMBtLFbyVqbrWQ9eChmnFDoDams/zgraaUpeFK9fa/ZzR:1pO86Q9eChmGDA/0zFT/v
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ccc49ec6522b018e3c0fbb69ee89c61776f760f1ce532b0ac611625b05e756e1
Files
-
ccc49ec6522b018e3c0fbb69ee89c61776f760f1ce532b0ac611625b05e756e1.exe windows:5 windows x86 arch:x86
b2dadbbf7f13af7dc4c40cb90a0531fc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegCreateKeyExA
avifil32
AVIStreamInfoA
comctl32
ImageList_Duplicate
comdlg32
GetFileTitleA
gdi32
GetStretchBltMode
msvfw32
DrawDibDraw
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
rasapi32
RasGetConnectStatusA
shell32
Shell_NotifyIconA
user32
LoadStringA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wininet
HttpQueryInfoA
winmm
PlaySoundA
winspool.drv
ClosePrinter
ws2_32
gethostname
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 461KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ