?摦��̃�����!������Q����M�y3�<��?&ʛF)嚿� |�P���� ���"�� ����]��k����X�{��W9�Um��;����$�6�������m��);��~�H�=� ��]_Y��ZM�ɖ���*��0���D��O�� ���Y8�Z�v ��|2�6k�K�]��bYNU�ezgJ�o����h��C���j���/��k�2��WZ�U�&�m" K��mh�c��g������o��&@S�!·|D;�K��($B'"*�".ֻ��������L*����8������`��s���Q�w�a�#���ڊ�q9��.Jsy�t_�ɶ�C��H������{zך=�v�e,B�-K}W�Ml��[�$c-"�-^ '���lN��>�!L�h�W���@nq�>��[Ƀ}�a� mZz8�{X�Z1;�r�Gó�[�Y��D�25US��ր��7s��,�46���O�E ��>H�{�M�js=:֥o�'����(]̥i�6�s1ݦ�������aNGx6Y'h�I˷ u�Ͳ��s�]�|�5Ê�Ǒ�N:X�!�]����i�*�/!Op��Ne�*��K &+"��r��bH萧y�Ǫ��\��W���F�����"�@��X���2څ-���0��q |�ҔiWT�c����\`x����ܦ� �1n�'�N�o�9}�+ˈ�n��yR��U����ۂ^��� ���Y�VK��jM�#1 %��<\���<�'�@c0���&>�ϛ[&�4����~w��?�ZgERU��w�$�4�S����Xlv]a xP_F�|Z�k��5�s��.7ڵ���P�S�J��n�a�m�:ts�+%�6� =����U�g������zʾwGFBD~聆Kv�fʮ���c-,i`$�����z�ޛ�� �#���S�������d��6���2��@p�j�E�0���G�3� <��'��w��Л>�1e�+ѡv.�aR����J�f�Y`�)� ں��uD��� A���y�ˈ�8kjS5��4̾����\t9C� Џ{�r���!LZ���/#��& *� ����Ѝ:�}�V�c`�R��dw��]x-P��R�.p(^�eۨoHW� �C�4�(u������n-5>"�qH:�u��֏(��:��_�N�'8�퉰��Q�y�2�l��'�аSNTC<6��-�ԛ4L,����$Ϋ§�; i@��86q�8��-�+<���O��L f�lro��9��h�[g��@_����`ŪC�x�r.$#u�N�E�� !M��p�����K�}�����x~�7���^)����;H�nC�|\��0�-�Re��S�f3�7��۳<���*��?q@��u9�9��2�g���$H!�.��RP�e��2����ղ����į R!�<�"�o$n"�}H�1�69�e�?_���"�(j \u���B�m�AC�E��.�JO�Oϩ���^i����Pm���"�:�I���1�QL��<i���� ����1���͝pe�[� ���&kB����6�j�Ɨ�t�$�cn�7+�>��,ܷ�"�� ����}m&D����rܩ�ț(6B��3ڲ*�W�ᝲ��p����E��糌c5��?-r�q6֬����P�w"�4[�sB57�CP;G�͟YS@���8����PACs�1��5<+G����i��fMB���w���J�D(���\���[V��}�Y��}�8)T\�Y��>i��G�/��\<S�t�3�,4sD&�����yM�ڪ���|Sx�������YS?{�`#l�z�|��o�/�d��8��AX�7F{*��&<r��ChtMI�.R�o�M��͢ԯu2gqX[���"���G������ޗ�o�W��b��Y(/4�/��s��˽��M>]� ��F�!���OH����<N0q��_ʄj$�y���-�� �BSlFm�0Ƹ������̡�=�f��g5>�K�7��m�m�]C����r��m�Ӳ�q��>�<���s�A^ƣ l���jG�@�����?��? ՜"��� ��i+"���g�ʾg�N�^��ϓ����Wo^0�3�6���d���� +-L�L�2��]�A��F~N�] &�V��L���U� ՛�� ��ց=:�I�s]n~&V��0]�b�\�vB�NĚ��2���ޤ>��$9���gN�&ü��N�e1Ұ�E�M��ޱ�3O\�����s*L��/��#��}[�a�n��L�9����a^�����vc/U��,vq(q��EB����7����q�7`R��s�05f���������\���i�֝LN"O��V��9$ �!FV�^t�������K�B�rp���j�Y�:�J=��Pj��gI�?˧����4O�v��%�=n䰘,�M�=�������SkX����#��e�3W���8� �6E��y��'}&�h��{�g_�@��z|6�90�Zk�;�̾�b^$p��M=v��[�z1�ʗ��i;�����~�s�mե�6� 5�|���͊P�#�4[�]�47��ي��s�5�q����Ǥ&{�5x!����K8�5�^���4T���߈_���4j� ѹ ��VP����� �Ҁ:D��$I� ��zX�ra�i 5�)�<��k�t�tY�IV��5ĥ�ӈY�=���{6w�D��4�*����?zS+��cR<���-���h�\�����ڻ���J�9�K�4q�7u��R�ԃW�4Vi#N����[�����H�H�@iY�9n7ʛT��/c�7�;�������W=?���e�0�"X3�$��4<a��da���XfCE*�I<����'1���2su�<aV^���!~k��XXc1�W��������K~�ӻ;����*~�h��N �Ü.�,dT��2���sO�(1Ѐ5���1!�U�~�*&g��ؼ�4] ��>��Cy����hLU���r�Gp�:�4�3�t�N�O�>>��/7��� �b�����{�Q�wN� ��~�%�E|��q��6Ox���j�pm:
Behavioral task
behavioral1
Sample
02daa59a66699a69427f24e0bdbe1143e351893f9840eed875cedcac5b72bb66.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
02daa59a66699a69427f24e0bdbe1143e351893f9840eed875cedcac5b72bb66.exe
Resource
win10v2004-20240709-en
General
-
Target
02daa59a66699a69427f24e0bdbe1143e351893f9840eed875cedcac5b72bb66
-
Size
6.2MB
-
MD5
5c59db53074857b3841601714bc17e1c
-
SHA1
b6192ee4b6c4dc5f94e523efb13ecdf1bad57e76
-
SHA256
02daa59a66699a69427f24e0bdbe1143e351893f9840eed875cedcac5b72bb66
-
SHA512
82eecdea21ecc36ca33011923a3666c4fd02f9292a6fe8d9612c7fa28a74a1af5df7a572f7fd32f46a8078b6bf915a3be800fb01bb3204f4def58e9ebe8ecad2
-
SSDEEP
98304:Lmd7l5dKs7CczKevmTXY0l9ZWvZAxoE2GRlbCdjXVz3bGU2ts6esqz9HgRQk0Qlr:Kr7Xz8vl9iZAx8eoTGUPsqz9HwljhZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02daa59a66699a69427f24e0bdbe1143e351893f9840eed875cedcac5b72bb66
Files
-
02daa59a66699a69427f24e0bdbe1143e351893f9840eed875cedcac5b72bb66.exe windows:6 windows x86 arch:x86
065803adbdcd9c2750a55cb42644f7fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EndPaint
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CreateProcessAsUserW
shell32
ShellExecuteExW
ole32
CoCreateGuid
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
libcurl
curl_slist_free_all
softwarelog
DestroyExportObj
wininet
InternetSetOptionW
winmm
timeGetTime
libeay32
ord484
libcrypto-1_1
OPENSSL_init_crypto
version
VerQueryValueW
iphlpapi
GetAdaptersInfo
winhttp
WinHttpGetIEProxyConfigForCurrentUser
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-utility-l1-1-0
rand
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ