[.Ӊ����mJ�'7+��d�S�G�z2!Z{�D�/K͏6gi��'�l ������l���`����&��g�(<�d�4$�e�Ԭ�D���Ab���� �v��e-�\o}�>���>�X�_�!x,J�<@��Rj�1-�Nu���N�/��~�U��$���!�������� �4������v*g���h*[�%��V�F��{S_��ar�m�(���Is��Rt��C��l�#�v�C�-�#�|B�u�y���uI�|��Vlіv�Kw�?�,�}�����.��F�!����o��|��ԻxN���Nj#�K�[�m���[��33q���Ķ\ry�@|3� �� ?�q,��'~��2� �A��Q�����4�h��kݞ�m9y��� 5,����.1��9X����G�m�p�/� :8RΨ�3V�c@��2����"/�O4��#�l/c���G�(F�a?GJ�������m����oI�����Q�*��Fq(����Ɂ�e�jρ��S$��&�5VޭI��@"��_� "���a�x;C��X�CI�_�*��2��E��?D�60ڜ !�'�dR����7���0N�!��@�wT;vɫ�k"E��I���킱bIKqR����0��a�k��9�Oc�sр5;�����V^��#�åH�9�lO=L�%�~t�s�B�%@|��3Аz��ºTڔ[���;�@��,iw8�8 t��=�sh�±�N�c����s@�� ���Wk}������k�W-6����J|cN���P�v��T����[�� �6�6�����E���H��I2:�x~��́Ū�e��F���#��[% M�ΰ����㶼��T������g2�+���lT�c"�`��K¦^[� 1�V����_�a������,~aS�pp��O&I�����=f�!yx���v휆��1�������Z��4���ڟG���>{�n����bk�{����tK��rl�RL�҃�m�դ�/[6��S8I��n���*& �0�!A�mCj���:���sc�����O���6�������'_� ��xLDd�$:�œ�Td��]Ĭ��Z�Yw�y[ecO��Z�S#�IF��͝�(CQ�:}+�˸F ��x�h4��kaq�7._i���E�i\����Y 1� ���ucxq�cxr�> ��'ńe�BY�KPYh�� ���n� �� ���kR��U��aX��$�O[աOV�s,��E�1��f���z����'���Ѣ�U����b�|��2�:~��5�[o�p]w��� �0�W��Ft���<�D%��A� �+9��}�q�T�-��/D��o۾d"P�6�؝_��kS��r�>���[�K�$VA��q��)DQ����ȰɝF>�?��@�G��]-� 1���ܫ��l�n�3 _��H?���f��2n]�=���q`�����b��E��!�S`��ZC��0���2�EZau�:��a�����w u�k=�X��>�W`�ˁ*N�76q����&�d�" ���H#]�#�)cb;YƧ��5�}4��9�ʥ��WVk����y[�k ���f�q�5�z����ȵ�\�c{"�ˮ���P^OM���%�S�3b�(�ˈ�)-�JA�7U��y�!?J����&R�p���WK�²*�H��#TΔ�$(�����k�`L}p��6�2��!+Ab�0$&�T�L dZo42Cu���L��)8|(.��b�\]-��95�iR��DDj)���e����D4=�j ��������lՖ�Fj�W�|�X���jp���d��I�җue� �h.���@il��Iykc҈�g��Vr���P� �щ��9�v�& 1��e�XH�����3-ĭ`��H|�5�ௗ��ѐ�$D<�R�U���$6�zۉ0m'R�d%�P��2A+Ε��zOk$�_��U+2��=�-l�⑭�7�������;�>����&0 �$������LD��Bg?u���ʇ#ܻ���LcK�1���0S��_����;)���ݾ���m��.(�$�yDi�q�ۼ^0D��d�R|��CNl�� LU�݂#.���髯\'�BC�{\���w�h��-�XX�a�!��or`H&�fEuyg�B��߆����k��D�"�2�b!�9 �3$c�໊�?\��:��O�/�g.t#ɿ:1�c�g�7�����)�^�]n�֘�yV#}"���e+w��T����� z��ڇ�|�m�t��ܧ�ye�簕��쮅����J/_%������˃{�����b�a�@$�e+�"և�$�S��]�[06$�<7'zW�"���^_k����qI�W�C�}���) [I�$�'�S,L,P��KL�ۛ�鄅\���k���SJݛ�>�?%5#�a����a�S.�P�ێV�]�A} �^���P��� wO���U���O%*����#�K�sM�x{�=K*������_��Ha3��NR?�Y�b�g��);M�i��6�ɋ����&�&b��,K��M^��A�ҿ�{�]f�=e��W���@@2-��5^q-�/��A�>�n8����Ӕ���;�X��Er��g��> ,:��4�Dlz{ ��9f �TfB�m��6H��-(���Ͻb�8��T�&0 e�}�ʺ�<G�*Jk���k�e��#�U$B,�2��3D>���>���m*H<X���_��}*���|o�y�� Y�{M`m/ 2⢋=��W��q�;���+��c݊VB �\��v^}�9N'�t:gme��{Uq����9�G�aAhl�sȻ��]��Z�oNAڄ� �X?��l.�fӱY�F��]7��l������E�(�K8l���D�ΆK�r���y ����:�UR��y����*��LO�A[�~���q�\'!5�U�B�=R��k:����T��Qm��oQ���0����T�(�9|)���DMbq�I��� o��n�T8Yl]��e�,�.��"�\��;�}jW��Q2Bb�һo���S-�dC`Ay���^��^�-�)�]�#��e�(Iz�!�����u�$�h�o+V�!
Behavioral task
behavioral1
Sample
067cda59bb2a654274f1bb7840fa1fcd7011e7fac2477f4c3995395aeb83e460.exe
Resource
win7-20240729-en
General
-
Target
067cda59bb2a654274f1bb7840fa1fcd7011e7fac2477f4c3995395aeb83e460
-
Size
8.4MB
-
MD5
82746ec5e939d0d2acb8d45315f0f76a
-
SHA1
2fb8bc3a9a741caaf2bba295182ff9e480c68ac5
-
SHA256
067cda59bb2a654274f1bb7840fa1fcd7011e7fac2477f4c3995395aeb83e460
-
SHA512
55a1758633eed1be062ffd4c3817935c92196510511a41625ce0a3555381b776cf3b046fa937404d85c975190440af824a729df9125c730b9f72a70889ac4330
-
SSDEEP
196608:LPn48lKTsKDL+M/CIOirJHJIbN5FdLnZGPems:5OfDCM/tOiUbNfxZG9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 067cda59bb2a654274f1bb7840fa1fcd7011e7fac2477f4c3995395aeb83e460
Files
-
067cda59bb2a654274f1bb7840fa1fcd7011e7fac2477f4c3995395aeb83e460.exe windows:5 windows x86 arch:x86
78e787382a772c7ceba22b5d9b6ea2d0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamOpen
ws2_32
select
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
RectVisible
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
SafeArrayAccessData
comctl32
ImageList_Destroy
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ