����P$)�a}ϋ�K��{�sޢ�XP���#@��,eǘ�������p�-�8n3,% �H��B����Ɏ���UVBh�G�m��ꛀw\����|����#� �,�G[��ݺ�p ��b�KrG�^�=��9�kQcMv����h���F�l��/_۸�['��\ mR47���(�F߉+2���H���PtZ�Bst+�V>°"SGRǃ��[��[�3��3�@6l}kݾ��"�vf� ���M_��Y��u��T�|��?�T�@��_��w@(6T�PUZd�`5e�I��`�Ģ���(����(mƙy�N�/u9T�m�jy_A�;Y6�1M��U�W����N�A�_��z9��������7��8����,�TS�+�,y����h��YgN*ϴM�0a����r!.��f���"�n��� �R�)YC���y��u��A$)NEkk����Z'fG����_�@J�-�����S?�� ���{y�.�{���c<i:��&�%���������U�2D����~��4>�取? 8� �l�*@'.����J=m���Z�Ժ���"��8����Z���s���������ɂ�_�a�Z���u�e�~5�X~1ZIn�vY���L|�LΕ���<��r����&��h/�u^��28kB���s���+J5��i>�R����w0vq���6L������{{�N4�Π�!k龎9x���5^te�c�F�Н O Hē3�Y�]��4���K���'��ꤥ}�,� ����V��o��F�ߠ!��9�oⰡ��|ͷA�c,��L�rȶ�n� $tg �{gMh{��-NS�f7%-��;*� �nQp���C)�%�c�3������''�K4qd�13F"�n�E��X��L[�K��C�����u4+tsc��L�Q$o���~:���9;��}�b;O+����B���`È"L�2��!�O#�`��{��` �,��g�I�0��x�̵բ�J�.W4e��CEm�5A�Y�� �5��U*��V����U�B�3�2���cN��«Rv@�#���6t���wY��6�݄���V�8���&�$L<����r���<��P=�4��O����߽�l�2��')������� ����v�-z�x�'u���_�$�/G��Y����~O�M����Z�F�V�M�@ �!���4������8��<g���X���g+ks)�R�Ѱ3����:����1O;�id��&�FqUb���e@o��`�T/� 2�, �e�t�-�x��?w�O8���͕����Ms �賲�ek\ ��W$�^@m��d6�o��n Vqt¢�{��4��w,�!o�h�K���g\+���`�awd넬($<�@���F >�{�\�-E1���cv�d ��E5�� ��~ ��*����<#�-�wwQ��OX7��P�>2:iwQo/lP��Ǫ� L���� ���1@%sTгQ�4f}%������d�ͅ���Θ?��X���v��,v�W�j��X��n��c[h��Nv��v���`�fey�j��o��[�ǡû/�HfsJb��`¥0�+Դ���8y��V��쫘ط�+��v����#Z_(QPMM�0y�in��:SmR�ڥb>y����j�߸��Ў��:b���դ����A1\t���r����\ʆhŪ-P���"څ�Į$p{E�z����$ AD�Acʎ�ӃA4wF���@ Ui�D�rsE��YJ� f�E�'q���)g���ó��篲z��t��ౄݭ���s�����=h��ؼƉK���*A�&�Μ{g��9{�LCڲE�>� �uy;�1:)��~� �k��d4Ds�)XH�`����d*��� ���REh���{�u]����Av��2��8!���zdX�l������]�/L`�&q2�(�e7�{|��W�O��K��VF��2B0����v�;|�)�$������V��eM�X��)��Ƥ����j�i0���v���y��V�:���{w{��!������;�����I��N=��4��\�?��>��+�,Ҙp�{?j���%�����<C�t,N^���h�o�@dU!�U�kq�^&Ҡ�j;X��+m{ � �66�W9��1��4�8)2���*7[>�q���ۑ���Ñ�k��C�c��R�+��p�=QG�⧘�-����<iq!�g��s���nFS����K�G\:d����rFI�!g\U�aQj���T�.0�B����ţ~�.1����۱q@{�&��� r���ڻ�xd��=�����o�-~��brI�� l�,��gHH�a$���E|��+�48��l��Y�m�bi���7���]�co�0�Oi��s���B�SH̫�Gw ��v+`k�ٛސ����up���(�,��a)x{)��s���F�(�����P�K=��&��rRƹ�D���<b{io�!� ��J+�i���t������&���?�.ǀ�z�����{:9.��tF�݂�E�i��I,�V½��t�i@�uJ�5*�n�q�%��2��=�J�a��H�2-c*��b�hQ�}og�� 0N>j��Zd�LFH���2�>� !W�,t���[�Nʃ���>ߵ#��{D��cpM�a��&�k�����r�L�dC� r�����<��㍐>�\ ����Eq �ׯ�V� Y�(�?K%N_K&oJ��D�V�A6 �8@��5X��+T���s�s�uS M@�O#�~P 凞���2��]�Lkҿ�J��Ow�R�� 5*���yx��L����Vh��LZ}�fCi����ȥѪ���d���n]��.s��pJ�my����o=�yĠǍ��mq�R\P36x!$�m���2���I1��*�Z��F&�Љ�g�tj�(�=�_��Ot|r�2�7'm{�k kM�t�`�NI�cF��̏5t��O`p���M-�V\�ƣJw��lUb^��dd���{���;0��{�4�ǂ����xa+��� /�\5�'/� � r�ʹ�����U2sU� ��>O�Jm�B�66=���$����E�ew��a�ˎC&B�4�A�.�[>
Behavioral task
behavioral1
Sample
a477b713759041053481d6ddae6ac205ae31d7b42062ab09548c20649675c678.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a477b713759041053481d6ddae6ac205ae31d7b42062ab09548c20649675c678.exe
Resource
win10v2004-20240802-en
General
-
Target
a477b713759041053481d6ddae6ac205ae31d7b42062ab09548c20649675c678
-
Size
6.2MB
-
MD5
51c49a369d80c1b1cf9dbbbe2e5c6692
-
SHA1
24a1c9967ca7493daf5f03c9a6759f00386325a3
-
SHA256
a477b713759041053481d6ddae6ac205ae31d7b42062ab09548c20649675c678
-
SHA512
a4f9e6006410cd2dd528b922c91c4540fc1920b006b658f58252b77fa52abf8ad0c8cb61c338a766880888e2f320e0d532bfe9d6f6c50ab40d38ad5fdafb53a6
-
SSDEEP
98304:bFL74y8le3xB+dgKpg+PIbC/sLbftQMELozAx5fD6PAB0pA8m0oxw0NkCKHn:5fJ8lImgOg2cZfiMEXD6KAQbxw0NkC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a477b713759041053481d6ddae6ac205ae31d7b42062ab09548c20649675c678
Files
-
a477b713759041053481d6ddae6ac205ae31d7b42062ab09548c20649675c678.exe windows:6 windows x86 arch:x86
6d3f66cc89fc2da5251aabb51132a9d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertFreeCertificateContext
secur32
GetUserNameExW
mfc140u
ord5164
kernel32
DeleteCriticalSection
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
GetActiveWindow
CharUpperBuffW
gdi32
PatBlt
advapi32
RegOpenKeyExW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHAddToRecentDocs
comctl32
ImageList_ReplaceIcon
shlwapi
PathIsURLW
ole32
CoCreateInstance
oleaut32
GetErrorInfo
tcore
??1CCoEvtTranslatorBase0@@UAE@XZ
msvcp140
?width@ios_base@std@@QAE_J_J@Z
tkrnl
?AppCfgAttributeGroupLib@@3VCKeStringConfig@@A
tcomm
?IsAnyComPortInUse@@YA_NXZ
tddoc
?SetDirty@CDo3DSolidLayerLibrary@@QAEX_N@Z
ws2_32
WSASend
tmancore
??0CMCMailAdress@@QAE@ABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
wintrust
WinVerifyTrust
tpref
??1CPrPrefMainDlg@@UAE@XZ
vcruntime140
__RTDynamicCast
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-string-l1-1-0
_wcsdup
api-ms-win-crt-filesystem-l1-1-0
_waccess
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-math-l1-1-0
floor
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 510KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 193KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ