�m0���� ��**�"�N���Qs�ɯ=��m&289�z�����BD��4<�Lª=9��!�Y���i�����|������:ҝH�Eidt�-2�۲��5���������U^����3�;�ra�m`��v}r�[�<\�@)Ur1F^�@��Й�*+z0 ���NJ����i��?�5C�b�ۚʉ��?��C;�N���=�FϠ��L͂��L��P5?'��¶�� g%e�������*��s��lo9�V�����VL��ZhR��c_r��Z�bm�N����ru�%�̓�[�"�]���9��?媟�j�[]]���9�'�N��a�7��(,X]�����SV���P�f�v@�]��p�1+��] ���삀ѓ`�����E�;�dG7;�#sl%��\�O�.��<�E���Qf���1Ft���|]������t�vp~����d��m��p�p���^ pmϏ�+%+�F���x���;Gm���"���q�Z ���Հjſ�Pt�W���f�i�H�kPh ةG����s�J/�e,�w)$ e�k�쎊����9��S7�?%'x�z�e�� ���%b6�oy���$En�"\�ڗx��H���ĵS�ט�z&�Y�E�1˚�=u�)�[tN��]a-x��qx37�ѣ�i��p�c��f�����s�4�K"D�\��zo��ۿ�kؼCw;}5Ƈ�ʒ(�������>Hu[?u�{e�-B��?���0�|��0I-IHgה���8hla���������Y�2i�䏋X�#�%)�,P9D��jMr���P��B�c�����@$nD�T�:a��{����2����G�Y�o�buN��|�1IܐA���a�Ŭ��D@�����t\�7�3�\��͆K��Fݢ ���r\f�����қ�~JZ;Fj;AYv%�N�_T��2[où��e��6�7&� �!G�D� Pf7�8���PZ�?�;_,�����1b��&Q54��:��7���x苺 \�E�N�e`��(-���3���n��J������A�N7}W���I O�y��4�8@'�pA�U�U s��U��>^�j�����қL�aS \y���T��(�#b�m5�5$%ER�H'Jw) Z�D��}x���ʵ�eW4IS�=kt�E��FnO_���N���аKԖs�`��Ml���!��hȰn�L!ɠ�D"םD4h\3�˕|F٠O:�즅� ����I���}p�;&��Bs���.�QB�4�g��U=Ժ*4��K��D}8t �@aP��q�����Ϣ*:@=�`��$��g��t�OөgS�5*/ ��)|�]��1d~q*���w�����տې��<*-� �kr��٭3�j��t�k�/1���s{rB�\���f�U~D��q}��ZO�*�Q_;��E5<���Q��u�f0 ����z(SS�rulQ���^�Q �*��N�R����i�^��u�'}�Pǚ��ݬ�0"7/��E�R�o����B`V�WW *U"����PL,b`�d$o������{���,?<�%{q�Jt�U��8 .��8�d�x�eR�z�Sd5��!O ��ȃ ?k��:��5�>��bxÞ�ϲ,8|J��vz�Я�����z7��{2�k�\���������& �Q�'��WO��&c��YX�X|;�I�U�ś���O�� ]U[�:�D�N�� �AYס��2��dy>��z�ч5ӻ��Y�a�ӱ+�:ՁS:S�8�wƢ�I9��G�#�j�E� qU�T�=����Ն���~�:�8��[˖���HE7�v?h���Z?�a"�9.� �7m��Qa�;�P�OVFfn0��a�r!��\��0�<?���M�{A��m�v0�����zi��K��{�H��QY#�Ү �$���l��IeL����$�O0@iMj��CLg�F��gQ�u0��,3�.V���YM��y�8��:� ��I��Ҹ{~�A�f`�>��Ѯ���-��?E"�^�Sb.꽿KW.�[��{S�d|}�����R��h\��tK�SHLOZZ��9!�o �t�ת1�n�������������U��+i�>��įאﰭ�I U�D�f��������.��������c�4���Y������O�"�]&�F��le֖����.�$��+eH����7��<��'kJh�,�#��}ٟ���RڌȭL��h����$��اSՀU�U����S������Ki=���4��KG�5E��,ܓJ!^�^�⦁�Li%l$Z�f�,�R�3Bц�?�MNs�T��Yw��ȴ����[���V H�R%��?:�z"����g�ϕ�Wxݓ � Q覤0r#(�i{��Z�Pk��,���!�\�J����)N�h��,m��|�����N��T�$��ivY���FP��6�����2��{/���e2@%���~���dcs�1��^*� y���7;��?��m��(�s�����4��=i8�JD�:�y�m,CL��= |�0?W��$��f�]����GaI�УBKKd�c�k>�����ޥ!�� aO|_[_B�k� [������;>���f�?27e��ֲ�\L��`%�O�M��'ǢY;�R(92��E���y�������Z�D=B�{��P8�&R>�E��L�̷�${���`�g�zV*����(�v'�K�w�Ho|� �M��l�\>��;F��p�|���ʦ�F+/����E���큮S_ "��D-�;�$:*d�N�����o��R�Rq��l�]{�X��T���7��0g�[���n����FOF����4e��>�u��t;�x�q�%PUKXH���6r�&�C�e�@�U�Kf�4Oͼc����lA�u�=v�gm����,�D6a��k�=�mM�,i��<l�y���-��d�?�#�75�̚D"N���$c�8!� _<2�zU%qT���B�;�Zb�Q�E���3��Qg?V�`����'{:ڄ��+P2g������I�:���ZR�p�^'3��5���@Z[T��B/��cDF�b,Ś��!J~n�8�;o�~
Behavioral task
behavioral1
Sample
d0cf29de197ea5617a554090a32da175fc0a3a6a2220f2bee45f54ecf606d94e.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d0cf29de197ea5617a554090a32da175fc0a3a6a2220f2bee45f54ecf606d94e.exe
Resource
win10v2004-20240802-en
General
-
Target
d0cf29de197ea5617a554090a32da175fc0a3a6a2220f2bee45f54ecf606d94e
-
Size
241KB
-
MD5
cde1f4d9d310010ee083bcc4c81916e8
-
SHA1
718ea3eec7238bff09ad2a8c872496ca56dd0460
-
SHA256
d0cf29de197ea5617a554090a32da175fc0a3a6a2220f2bee45f54ecf606d94e
-
SHA512
69e971eb837aa63f660d8d98f7499c74049331c7e89bfed3607a3021e900bdf2577c1b870b2144f67c9b49068d7a9aa60dffe716ad509641d52fb03f3748313c
-
SSDEEP
6144:6AeG1yeFfh5S4QoW7ntDvK9CJ7+L40i3Ueqm:6ABfFfjQz7tOCJ6k0qZqm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0cf29de197ea5617a554090a32da175fc0a3a6a2220f2bee45f54ecf606d94e
Files
-
d0cf29de197ea5617a554090a32da175fc0a3a6a2220f2bee45f54ecf606d94e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.packed Size: - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RLPack Size: 2KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 335KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ