"�:Hm�:,�H6כϤ�D�,%�H/F �X���5S,�p쌥4Ȑ҇TΦqg�a!G�J�U*�8��%1ʡ'�,5i~1n�UJg�Qq�������P�ܐ]sb5�,��:����a����TSz9,#�[��{�Or���s?A����:H�w'���P��X���7a��%��漴F��6t�]d��(�D7N��q���X�1�����;�-=�`��R�IV�2�1�����&�,�=�( 'o 2`&Al�Xwf�����>�6G,}�in:;����1�T|=��q�cd�xO��ҡ����O��J#��> s��nM=����,�t�6����(X�R���;)xr�h�I��o���gO�*VL�3���!���;��\��A:㈣ۑ��P���3ME��\�-`N+M��]>���,q���싃��A���~�������L���*���WH�5�B:��dX��S�*m�8�I�=��:��=Z�{ld>����z���,]���ڒ�)�{RB�UV��#זh�O�rM��i|�c��u��7��%������x����ꢄ���"{V��]�]7�"ɲ�o$����'ɵ��|�1!�8����Ei�&Y������J���K=�s=v�-���&y��7���VW�@t{� ��Dmp�`w��Ғ�������P���떲�*dX��k��������~_�j����ަ�������11��4\�e�AƊ}��թ�q'�D^g�ջ��ܦ����V�HAʤ�j?��β�IV�Z�M,�������>Y�H"*�EY��&m0�5��{���!�(����������[��nK�,)�ӌ+���뱿 R�sx-�7�|�Kr�5M/ɯ���#�#n������x|��0+ck�c�t�F+kT>��Ђ��HS!���V�3�͏e�q����RI���7:hw���Z����XK�4)�̳���#z��e�}l�p���œ�}]��#���_�����xGAS� �vKTL�Zܳ5��s?2EZ�X�vӱ%�[ ��u��_�2�~�9d�T��za;R�Lh,>.�Z�B������N�sH2�T�#��z��@�˄���o��/)����`��D͛�)W��t �e�4������_��rB�o���.�F�H� '�s�s6d������0.43Y�<��������$A%�J����+<���P�i�G��-�Ʃ9�D4.Iѳ�288 7`�| ̽[ � E�S�ZP�M!5���t�E�y"綠����h��ުhU(��:�r�lnl_�7���{�0b�'�j�Xj.��)�X۪��Ã�O���v�m���]F��D55[�G��n͔��YlĮ�K�ͧ|ܧ��0�j��4���y0>�'L�귥'_����R�2���k�ۛ�#��j����9#�p�X�+*dz=��ԟ���y�1q!�uӳl[]��(��~����/Ř��Uh�ijB)�*)D�'^��g�::���U��.2R��LJw����\�4��YV�|)E��d\ ��E���9�8�bg�7=A4�XN�ԙΩ��G��7^ ôr����mK~��;[q� {R��K��4��)��!G��'O��h9��}�����B?��<��+R��ɼ����GjT����K�7��x��G�#���3��l� �|U��|����&�M9�}*X�/�\lU�jc�sI͠c E�t2o��z�(��W�>���oXر���{�v�K������es+�%����-+�C7�Q�0ϭ���őp6G:�ON�QǞx��Q�Ł~�E�b��P�v����������k�n:t�i�:�%oø��曜;�Z^�����>.0�q�i�ݔ�c�) �M��)V�f�R/Gr��J�6��y&Z�Q�!7+gY��h. x�cu[o/���zq�z���iAXE�l��Y{)���Df= "�[���Z7�a�D����z�3���xsp����L*0�== ����l�8@f6y�c[���&jB��+)t��־�����I���®��̅s���c�-.\I #*���v��I�\�����Ԩ� ���uR�Ã7��O�#����o�QG 2���ə�ҥ��Y�w�F�(hj)��Նa�3m5�9��3h���v\M�J�^�| ��XCn�pDsr�|� �ꩦ��l�:L�M�e�y� ��p�z&1��g:y&:�L5�0��R�W�W�j3hf�0W3�$6ǥG�7�nL�bZڿ�V�@җ�N7�V�T�Y��$�y�C�DC.��_(�y�;��Gڋv�_�t��|��2���{E|��m��Qx�waq�AV}���O5�� ��#�1��<B�7'���YY]~J�k��L�]a[��y�!��h�����T8<���Q�� wg�o�l�̮��j$�Q*�`t�vlm�ز|��B��m�h�J�������~�uů��.�$�n˛*��uT�I�l?n�ޕޤV����i�6�4HMN~F�ٺ�U?�c�!�.E��0�(doB��a)T��T��p{��= ��r� �|d��;�� ������3'�91}vNI�H�<��8����������p�U6I�9_ɲ2t�$<�0�!&8���ͦuW�����|ӻ!ػN]�n<6��@ysS�1��\`�T���m&�A��ߠd���RL��ƛ��� ��+7*q��:�<?(}�?��)��R����3}���A��) ���xr�{C����.C��|$�.;���� �6�����b2����M"^�u�`ar��_«X2+�*>v'��u1���漟��/Z�7�N���# �X ݛ�q��cUe��X�:�}�Z[RJ�ց,˵�,NA�$�@�2F�'��֯�@3�A�:�|���' HlQúy�G�˔���C�ۡ�3��!3�^�=G���V�_T3�E�����1�5��z ��LV�Üj�k%��C��&2fMb!̔Y�܆�1���Xf���P�`��j�je[$g0iN^ә�i�~s[t�N5��J�1ɣ�ڥɪ�l�JM)����l��oKB����a��tERf���x�C��M5
Behavioral task
behavioral1
Sample
021ed61fb1e111868c25a5256f1118a9093dcf310c5f740684f7fc653cbf1e75.exe
Resource
win7-20240705-en
General
-
Target
021ed61fb1e111868c25a5256f1118a9093dcf310c5f740684f7fc653cbf1e75
-
Size
3.3MB
-
MD5
27c87cc4be0fab37ce789d8128562dc3
-
SHA1
39cabf651cdeaee7dbcb4e18694e4dac6978af71
-
SHA256
021ed61fb1e111868c25a5256f1118a9093dcf310c5f740684f7fc653cbf1e75
-
SHA512
6c874cd3c04a1f56ae4b2e0ec92e6e5785f009705a24b227ab84ca84065b781086c85cd379f13b5593bf5dacd289441c4aa5adf6c44915c0f4404bde26c59005
-
SSDEEP
98304:Ehpxb3g2pD/iLHEgxP4gPMB2Ydip4lx4SEtiaZzPo73W:Efxb3uLHD2rB2gJEtiJm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 021ed61fb1e111868c25a5256f1118a9093dcf310c5f740684f7fc653cbf1e75
Files
-
021ed61fb1e111868c25a5256f1118a9093dcf310c5f740684f7fc653cbf1e75.exe windows:5 windows x86 arch:x86
df0cc83bccbada85546ff4e7f437d324
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
IsValidCodePage
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteExA
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 678B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ