�?=J�^䦣��'2��2�o�\l>N����i�\c3b������kv� ]7�W�1��g��K�=,~�7W� ������4����ך��4��Xu��o�ǝ�N�,�ѹ�T�dD�m�~`��;��b:���?D��D�U�C��9��{(�1���<*\*��=�W����|Ɯ.o`�noCƜ����r�X����z�;kd�T>�^�{� آ�Z�� ^@H����r����L �M��J�-�p�E�*�㖘���rOH{!�}�&1ـ͒�Wt��.�E�c��J ��E%j�����2D�kI���pK�^ѡ��2!���y�q���"��w9�}Z6o ���lz�ٴ�h��ic�>M�2�O��h`�u�x��ի�0dž�Ed�k2�Լ�Zj��4�'i���b�Y��`��m i�x7c�nO`G�]�d5�OV�EM�����S83�$ �^�o�NYlKS(#�^������~� /��W��FTt��������+֊�@ksC��V�"h�&+\�A�ɇ�����ll1��cqr����/�$��&�.���� �-wZ������ca����{欺����{&4}=��%�����QcO�M�7&�!`O�ҫ�y%���텛_���ė��*]<R� � �0�Ѷ�^S蟚��)������o�%)z�+�Q�80������3��[�V�4B ���+x��к�e�xEֿ��� �x�3k���zPni��Z��@^�ثخ}�q$w.2������4l�O4�Z�=7J��}���F�3ϗN<V��1j��6����^I�����;�<��vv�[���I�7$��h|��c�>ж�2�%[�$�+9:���Ge%���I���,�ҷp/s'���~��n�*2��a�I�4Q������L���UҢ������9%>�rФ�I��i3��x�i�bҋ��p��Z������N��+�R��鉵@O��}��W�>Ү���!�bC��V`:l������dZ�O쇋����y<��'� ;��s��ߎ�M<UÑ�(�=j[�}|�e��uX��"�4�K�M�F�GZ$�2��_z!��a]�:KϤ�>P�� (Pv���Р�����j�(`z>ʱIY�*!�F�2��o` "�BjZ�Q�DH;�%�%;@�������� ����(��5zT,�{��*�g�}Ą}��>�� qx��`ˋ�$�Y ۫���]m?��}���͍B�C�P��Mɥ�d��K�����6�:��S��M,O����>�]�atTTz,�HF��1lω��M�N�"�#��ĎB@L���0�Tj��'��������q%Ȏd���ywk"�jC~X� "�1�erWd��7���4O���_d��Ҧ�@D.�$>�2ӆ��)@��g�`����r}�.R�i�@�])���9�|�˱���������M��X�v��.'rou���E|� qC*��&�嵧,�x@%Kݿ����<��s��� t�Ӟ65���#�O�u��k!��v3��[�5�-U0�>���&���r��2�"m�Ǜ��H}��Y|Ew������;#h��s?FT�[�����(���7�r�vG]a�>��L�-�w@q]��|�3�Dhq�L"^���3&O��<����K��n9��h�T�7N��>�d�$M����y`�� �K�k�#JǤCC��eG����l��JX��s�h¹k���T���r#�{�7�KF��,g8G���3�J�S��9k���X� �3t��<�V��h⟦�O�o �����2��_�` oƥ��.� �i�qP�v�$�H�Nȃ�w�;dt���Zy��|�f����Kd�1�ym�"���m&��-���������{� �2�5\S�P���k��x����vQN�7��r�xڪoZކ4��1���@r���h�&�}4Z������T��� ���n���TP���A+���p��)AVO�{F ��#��nL�7u���������*����Dm6��f�`X�����\�Z���~ �nd�?_5P��Df���\�l%1W�n�ޭ��g{K8ֹG��~�����R�2E�ͯvd�|,��4q���G���Nd:��Z�x��w��0뱏Y�l�Q5� f�������-��l��E�lNo�D�ۇ�2�t?c+ �n&���6@Hm���%X<����f�:���\����Q�)��}DA�r�>~�K�(3q)�d�qfϻ�� \�A籮�M�V�������@��z�&���r'-j'�@���Po�J���j.�)�C|v��Ik2D2�h������+͛�;d��o����a���1O3�+�u�p�n�͐�W��c�U��W�%_�����L����c귋�~ 7U�'�Φ��rd��x�I$x;���c0*�W�5/E�uO����eq�I/3sہ�z�/h��.�9MӦZT �k����s ݮ��TOCr�.�%9?�D=;�ϒ�Y� E� ��{�(��le6�s��͐P�n�$k�&��z}6,�dXӊE�[����q�C���č�%�����2��z�Zn��t���Ҷ�K�u�����x�H�1�Ba*�G� gRu&c���]�"���w�]DȔGN����m�l3������^�:��h��i���d�|��l_��I-~���n���d����I������[�p������)m�T��G��n���( �IdY�^�dZФ��LC�Z�F���=����헛�Y���z.g�͗��rAD|�6�c�'A1�2�u������HH�S�3n �CM����2e���<z?���N�5Σ/ɭq�Y��ٟ��$�H :p�K��b�/����y˒�I����[�pWB��B��K�m7thfZ�pI��a��I���o�320�t�lг"�o�!�q��Pu����ƐEt&��=�34~!|�\@-���Hc��83�z�I�� -u�������V\�ݭ僿)��K���ؒ�?xt� ȇ㈯;g��Ø���K7s��mXj���<����R *�>�Q��4CO0z}���[ʽ�p
General
-
Target
setup.exe
-
Size
42.6MB
-
MD5
6ea231d6ff48e322557bded16586385a
-
SHA1
f347771ff0d2682fdac007a69d0bd527ec3b81b4
-
SHA256
3b9516cbdccb4e3ba71e032f94df99eddf5ebcd36a613a34bb1eb982ee3c195b
-
SHA512
938bdf16150b980e31db5917ab0232e552610b84f942e55d1be6024b71ebd629bff365792e90da0f271964569820706bff824c4347a6baf06cbd84cc04ac6303
-
SSDEEP
786432:8ebAOgSnVoZ5z4PFKm1HJTY/ybnVMwYEQvANhTdT:8e8x5z+c21lTmwYQNb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource setup.exe
Files
-
setup.exe.exe windows:6 windows x86 arch:x86
Password: infected
ab1fae1710596128236e8ff4d37f3190
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassNameW
gdi32
CreateFontA
ws2_32
htonl
comctl32
ord17
advapi32
SetNamedSecurityInfoW
shell32
SHGetKnownFolderPath
shlwapi
PathCanonicalizeW
ole32
CoInitialize
iphlpapi
GetTcpTable
netapi32
NetApiBufferFree
wininet
FtpOpenFileW
mpr
WNetGetUniversalNameW
oleaut32
VariantChangeType
crypt32
CertEnumCertificatesInStore
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 628KB - Virtual size: 627KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 730KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 37.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 42.0MB - Virtual size: 42.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ