b�����@MQd'o�>��Z쥞���1����?X�O�����`N��V�U-���m��`h��]���êRٮ�^P��.u��*4�����������BYO.ސ�1�ʰP*�?�&��`?�Z"��u�rQ�rbfn3r�b?�f��NR���pr�o�VO���~�W�h Z��3VJ?nǿ�����`�� .����It�z͍w��m���h:Yo���M���kX�1��<ζ�s��O���� ̐Rn���� ��,���/zD&ҋ~��$#X�lc[\��Ӄ �(v X�v{G�)��[��L$Ӌ���˹���yP��:X���྆;,�gA�8&���r�i� ����1����K�ں���q��"���1o�"̑�4�4Z|��nF�e�){���a6Dc; ������'�W =�>��.J�j��<� *9~��OC�ړH�\��}�W��&�!�Ι��{.����U�uc��A��t��D�d�� ��{� �)M���o[��-��:�+#�h���rR`_���T����Т�Z�����$h.#�Iz?��J�^>:φ"^�o���g���ۡ��m�x}���&0"3� ?�x1I{��z��k����?�c��%�~L(�����ٺ�LU3�5�<W��ص���=3e+6�f�ݘ�i*]�Jgf|d�_»{ֹHfBG�*T�l^�_�L��B�DZ�9f2�`��1�����E�>�K�h^� �D��ȷ��5����y�NJ �#ɇ-�Ṣo/$�60����ժ�D�{�e-���M8#���q�k?���gw����ș��x�x��F��~� @�B��DGJl7^{k���g���=�:�d�@�ٴ�}��},���#U�D�����=�*��e�������Wa(���D���Lt{>�R����H�\��.��x/�w�Yl����]�����g�B�|hnq�z'V)<���^^m�� �yw�j���i��ӏ��5<��������5|��iga��U�ki��?;�kr��j�� Z���"̿�}��.��*�`�]?��j��ṽ�_�E ���������ZC~�Q��p��c���FJJ$��Q�9u%3%)��\���⏛"B7�E8|�Q-[_³,)y��ĭ<m�W�u�R����;i-�J؞cIb5��T|,'�m�sц���G���}v�ބ��B�ѿ�Ќ��|����D魯l�T��&�9��l!ys ��!V�@�vJv�� ��%�sի��J:Ԏ�v㌃�}M���!�^��J�4�v��u\bD�臬�q�Ye*�P�A�E�;�Zܙ�n�@E�̾�e^��:����Q��@B�]i��s�D��P�����=vRI���I ,��&y����?'�y*"$"xw��+Xk�c!�/���ys(+��֦�����Qu����D�,j��f�k蔢��� N�� ό�ő�\�[�r&����bM�Y�{5�i6~�;g]��|W��I�z��������d�9����9��v���,����m=������K��S���j�ja=���Lҥ$��ww �(����O�d_x����U4������Q��]�"�6 ��<Z6���I)y�Q��^�u~OB��I��7��µ���4�~t�͡��wʩ��#�ZB$��_��bKr��ciͦ `�!� �z��c��i�����u^TGeX�Y�6�8ȧ�N@|,t�h����-H����l�Lk3��B:�*�hT�*i���53ju��_fST�>�2ˀ�)#��r��g5�h7�o��__=7EJ^���T��_�81�"� r_?�,�RH"�}ִt}PIM������_�c�����(��F�E^�֦@G�s�1�?%�@&\�1�KW�h������@5���^��q݇�ū��-3-;*� U�r����Q�ȸFY*z�c�TWծ�h��v!��4�Y��ev��2�<����kJns��T��o^s�Վm��H�)0�����צ���Y�sķ���+_����~�����fk@A`�|�{���ʬ��|�=����D3KQI��[g�y�^����N���F��ʇ�!5��k�e��,e�U8>?����������U� �7�;��wԠ!J�2Rĵm�u\6shݝy���FȨ=vJ*bP=6c���q���<����W���TAU�C־�����u��VR|����ёo���,��11���K��Z]���cʝ�5l���܄��H_B�*����{!I��_���܈FG���gWO��|7��h�������G��Z�����M}�w���|U�w�in(_���-�4�]��Ϝ��%��tk���\�,Ci+y.�������S�gt�}��7�tO E�@X�d.u�9�c5��Z�2b�X�*g�f�#7�.bր�ذ���߽�E�y�ʘ��1�:�I����u�7�:<���jg��}��(��W�$�ޢJ��̡Ċ��~+X��&��W)<H]ϻ���p�6��8�ۅ�b�L���h��Z'��uP�g�P�q�1�� >���ΆeÙ�J+�K��j�X H̹�g֦��ށ� �e`�K>�b���q��nc���lg�T\)�I�4��G\sGv����5Kl��Qxq�V��T�x����hꜝ���'�̺���\B�;?��!E�5^)4����+��)Y@��X�Y�i���%���{@��g��sm�BT�ލ�7�F3^���z�bv8�8����}���� �����`x��HL ??ME�U�|Eq� j�/ˏ���vvf���GX',:�eN�a��\����(fZa:Zs|�vK'���a*��@)0�{>�߯��G#��\'�ħdk�n��^a����1r�t��];:o���X���&J&X>I��U� d�I��v)Ҧ�]�G�BX杹z_ z��|c��a��T+�o L\�b4%c)P{I.j 6/�H���Ot�D��-py1�^P�*��E�h�`�H�yy���\H�u ��v"m��|�f#�z{��U�u���=?~A�(PWO��)�6+(i��?����(�ԓ�T"�
Behavioral task
behavioral1
Sample
399b6ebd8265012fae6772307acf3bc68206dbc707dbe1a7ef8e9d270b0c6841.exe
Resource
win7-20240708-en
General
-
Target
399b6ebd8265012fae6772307acf3bc68206dbc707dbe1a7ef8e9d270b0c6841
-
Size
267KB
-
MD5
31c067c2b86ab7eb4327ff538fdb0567
-
SHA1
1dd24613ec405fe46d49541e2a0d95154d906b18
-
SHA256
399b6ebd8265012fae6772307acf3bc68206dbc707dbe1a7ef8e9d270b0c6841
-
SHA512
bbf9ff254e1c889125001ec8a88a988353dce7cc26158983ff64aa0c132413c00ef82338b53968aeef9779686877cb0a2e56a7126b8458de113f1f0985d20512
-
SSDEEP
6144:AL0rHo8clmjp4bLQVJDSt8OpY31FIG+0165VFhHiwm:ALwHo9lmEU/OpY31FIG+016l9iwm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 399b6ebd8265012fae6772307acf3bc68206dbc707dbe1a7ef8e9d270b0c6841
Files
-
399b6ebd8265012fae6772307acf3bc68206dbc707dbe1a7ef8e9d270b0c6841.exe windows:4 windows x86 arch:x86
db8e3aa7465bb04cf2d8e651175d7859
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
VirtualQuery
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
__p__fmode
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 218KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE