#�Ǩ���[�3 |=�1����|B.�ɭi9�Q����NRW��鯯���"T���PtZ(�?l0��@y��)$��-� �D��h����+~ ��h!�Ձ�п�n�} ���]W>:�'b8V�&@�2Y��g�vs��� i��n�cA-b'��3a�Z�fz�J�j�[$ �����{��z,����҂�Á��:�,3��W�����8�/�2�"ث�\��R�����Gykj.i$�#����4ٜ+���h�E(��� ���+N����[m&JB�D�B���C�K�R�l�=XZ!&eV��Ck���>I����6P�o�e- �-���d:��}51┇��-�5h���<��N�h��"��!���nz�� y��^�Ǵ�M�k���$�{�U������/�g�7K�)*KPF��y���e�p��Z_�,� NO*�yo��T6��ł�E��7n�}��}��%r/�,����8�4�Ccg��a�n�,�� ���7]W'�I�DqP��.G4�x/�%�!_�{�i��j�QQㄹDr��P1/�qT�q�Z�|�?���I?��$�n�m��½m�&��������TN8�K�,�7��Vs��a�+B��f�]6³�����q�<7.�,��8T����\�<��?���Yd^�"Ξ#[��#,� ���65]1K�¥�#Șc_����a���J��;*�� ��:�ɘ��1ʣ���3�d�U�/W��7jT�`\�S���G�LR�(j.��ꅰ����F)���dʎ�P�����|&�j���zk��LN�~,g����4��tv��"qݐ5��^�����%���m���k�� ��=�5R�����jF�Pʜ؈|�&v��df~}��J��|������Φޟ�a)�y�C��K:jc�S��k�����Ղ�-|�^Y��n��f��+���jzp��bC��������~���?Z oX~�LPv�Ŏ Vo�"p/l���Y[�?����znG~z�T �K���Lv�����,4_��fBz�Q�CD$�������g/@�?����"�u��>i���A3 �6�X��,QB{�*�#���=bm�}v���ʽ̘�[�)�ӕ�_`�#QeWu��/\�x�F�a_u�*;yl��i���P�'�>q�A�Zd�����qe���I��ꀈU������'�P�yrb,���i� �ε�8��Scrv.���(d���^��B�'�DGg��v���=�ԝ5����45;�5��,b���Qa��J��d'�����!x��R�o_h4�g�� ��eW$� �)F_�n�½�>�I'�|��'�9�r.J/�[ʘK���ұ���xC� �P�ᤃ(�7��E?�1�5+|���U�xh>��Ӊ�I >�D��e�u���ʮ.�`�Xe��Gl8����.?��_�v� �� [� �i!K�D..PE���S�{Ex��urQ��f(?!G�+�C�;����������8B_��0�iM���$X>�rt��@�xK��J0�Ɩ����K3Ӕb��*�=�e�y.ʟ�b<��I'������m�V��p���Cк<v���$�)�KM��3�� j�C{�����<���5`�p�b���i�S�s�=�?`�;�����^�����[1dT'P���ܠ�v�*�s�!CK�u��� �9������fR\YE5���>)�(Cl��\���}�'/BUXv*5^��$(�f����9�<֛��~��Ն��Wu���t�n�RS��1?�z XY���TA�̪��f��h9�c4��ͯ��~\�N(:����@,��ZsR%K0x]��A�a8�j�I���y�\��'�_-v���ZW��bD��e�d�F�K�gwD?�p��S���U�k����Q��))jHRc�����!��Z&�o��v��ۙDe���xl3���dr��Xu/���1�!���y,\3/��|�� ���!�$��I�RI��������B�0��i�����k����2���4�oIq�þ�\B�=Pq�����f�(݂h�/|ĸ��)���w�N�t���!r�������45��IoII88′� C5FJ+�o�.��港��S'�y��ok4S��>�����aF�u�� x��m�C�{����9a��.Y¸x@SjF�4y<G�[��=J��P�w,��Mwה6��P���R�7-���$�Za>���$*C1����U�#��_�>��b����C��Iڴ���ǮV�67^� �I�6�jsǣ�ڜ�^P�K����i�E�)���>&�1��mT�(�|h�((��-XD���E��@��;�v���h ��^X��<c *����PQ~�������A�*�2^=D�xf\���f� �N`-�����C�����)fp�QT*Jsl�T/��5������W��B�ʭ}"Q���u�بZ���-�f �(��*}�&靈���5�po��a�@O��A+�w��h����5G*A{@�r䋸�(�jtVLƅ���/]q� ���h���<�����+�b �,ɍz%��[���S�0�vˌX;�ڻ�7Ց<�䠸0��gS�2��[��T�I ���>�l���P��!���B��>�Ϛ�?\��×�Kn8�SB?��!h�_ώ^-ᒃ��1%���G�ւ8�6Xf�i�ִǿ�4}�3}t`Jv�0�ߙ�H! �8��{�z�s�,b}tR�ibi!�r^X��u�J��Βl̎T� D���(��A�n͊����ޞ����(�%��ba�syx�o�]WS��^�#� /��/�+�or��T$��>�5�ZR��]�4b1_��.AfnG&�AB����?% oonj2�E�UZ�0ԉ��=Jnd�s�^҈����u����?4C�$���>��5 -1��ُ��,�� H�p&��$:{o��%�h��Xng�U��u���q����+E(��<�Olhq��Qm*zFm���dU�(L�@�)$5X��em�����_:(E��Œ�,�\�G�%�3lJ}�2��d��$|�� .� 1���ۂ�� 72{VG<mn\����A���
Behavioral task
behavioral1
Sample
4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d.exe
Resource
win7-20240705-en
General
-
Target
4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d
-
Size
222KB
-
MD5
c7252d2cf01ef6649f68b3ecad41f076
-
SHA1
d22460082ca5dc8ba886b7322a0693d6f14753e3
-
SHA256
4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d
-
SHA512
287fc960e93de0e71e1f129f6830b35ff836ce1e48aa154b9c895ba6ee07594018c8b091e2fa409f934eb16ceaf271f541ece8527aa679bd5b162c57474ada9e
-
SSDEEP
6144:sx4EKOcREjfddvzCeVubrmCngalRpdFStK2dUFA:c4PdRgfSrAmpdMK2dUF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d
Files
-
4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d.exe windows:4 windows x86 arch:x86
1ddb6c04a879b43232752058440bb4dd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
calloc
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 220KB - Virtual size: 220KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE