K�y��gcT�p ��|��Q+�^M�R'q|��Ù���r"����&8��9 P�zե�l:�hhgС�䜮<E ��`L2YS������'`b��խL*��lz�ڂ�N#����Mt��ҙV�Qg0W�~�PB��gR���'�1=�O^%kqA�Wk�z� Z�)wMjS*�����c�A }� Ւ�Km�n>�����_ T���G��=� ���2u�)��>��R��]�eu�zl���y����mۏ����<��J�GS�u�hq��W�E�I��3��o���j�F�3�� 8���j#�>���e���[�-)D IUv�K���ШM.������/q[���Nҁg �0#�@>O�G �'���JJR� �����2���~t�A����� ����%��Z:���f��T��������ut��ʽ��#��ㄨ ���ҩ����.���4h#�?BG��('���'3�_����'�K�bs�'���� &?�ٌ3�]��LI7s]x�sʩ@�����X��o�H`�_T�����b��Qn�8z�t^�"&�����K &�߹�D9�#a��)k؝���[�H��d������Q9&;�s?�:f�H�>�V��w��x�~2�b̸��R��9@恍)�ݓ���Z����t(zY�� ڕmڻ.ޟdy��M3j@�8�Μ��Ϥ�F�b4���P:Z �Ww�1�5)T���ܼ����L�8�����������,���t�9R�I"5�ފ�`06��,��u9mI?<���'�:��PN_�Z�tя؋ؙ�P� ���g�n��ɭ���5�ߵ���4b�<��To{Lpz� �6��:f�H����É8yX<�r�N�Ɋ���b��[#r]�w�H���K� ]�E�sx���8�ơKT�����Ҋ��կ�'�uK�!�0��� �3�,wI��i�)%�0�#T����?K���4�ȗ�c���A�OX��T**��2����Il��ٺ��OO8Snj�LHs�e�x�cq��������'�4����~�=d������{@ֽ@9�²<qK��Sbr4/7� �/z�����l�)���S��(]س�Y�1��=��_��P8e�(�y��K~J0t�%���b��_ ԥWdi|�������,��j��{W�19\;j)�Xp%ޯ5��bm?(;��Q����T+��x�~���#�B�dF_`�'/=��z���Zu��C���c?%7����,�� V��a�\ߡ��iz��V��q�xj-1�+���g�`���)����;H��В��^_�^�E1�$��� ��*��i�����j�y��j�+8�ɛ�(=Y��Ų����q����]�u��-��0���^� jVP��w���`��>�CY�,C��$�a83͂C�쯋��N9�����N� e|��Σ^P#�}�k���'ӸLj���j�?7���J>ٷ�����֯?�?8^*��~HzD��[�`��9�3�� ��0�ʗ1���&�b+�VŖ�vr�z��M�F.��e ߗ��_��X���R�@d+\1]��"[�5��-hȿ�B�������q�~�� �*��f�`Z�W�0cHN� `�Z����^j[ٸo��M��#XI�����>�V���vN@v�|N# ��ݧ��?ܔ;�W�+�{�����.h�N�N_��A���3�l�bv��^���CW�܇&($�����Vf?�u�t��8Q��~cs�8��/} �C���>Y�b���@xo�N����o�B�u�-���J�i��"r�s*�3s֛�ǽ��9D�{��k���+B:I���a�H��&#����L��m� ��Y��,��X�����s��H��R����ᴣv^�lV��l"0TI�c���s�5㟀n7��N�Pȴ�(�O��#���V�v�_ D��o�k�t~q�g�~����>MA������D(��� � T7�1�uL����t�"�RYË��G�1�fΐ�4�_��rn������l*��s����5A� ���ŏ�Dp4y(�g�~�f���eS?��4)�i o�S�W����c�χ�S����в�N��q�R>2Y!�S\�}��n��H�kvi��B';>�e��YѺ��F�����_;� �!����P� ���#פj��c̴a�K�~>�u�o?�V^��3�i������SmW��O���m���{�kF�jxm[��X~P�s7��qc-)����T^ E�pOp�����7:77p8�7#h��:����>����*�"��h%���q�_���U��p�#:f]��l�[��j��zW��828��B�2 ��<��(�����WfeD�� }��g��n�uY�v��)��1Rq��L^���m4Om�錸�9�-�R���Kb�� ��3fP�N>�\l�ָbW�ۭ��hK�Ͷ�8�Z~���I�Ni�C��dD*a��9�50#�� ���B<��x�c��Lwg��tp�w@���?:�r�����H*��-k�f}=���hGz {�2��0�f ��3ZPt�fڞR�c9Ē�47�R������5��Q5�d�=�ذ1�����D�, ��P�z��Ť�:tL��t &&��#� �qx�-�Ix��wmfėYZ�A�ܖ��7H=F�y�:�TP\�n.�pwO���D�|��O���X��ʷ�Y�����(Cs� �G�!N�Q��}H�q��nߋ~g� �]���Kk[�I�7ӊ��Kb������3�y�D@0���g��M��T��5��(�*0;<G~���Yz?t݉�ܱz.'@��?��0�b5CK�$� �䪑�b�������U��� ����u�[bΥ5�۲�6�P֥�@���[3#�l|�g�4Zd����y ��m�jM���6`}��d���ח���e�羂t�N�n�\8��=2�,��ٖ��}y%#%��~�rv�ٕ��,br]��7����4����?���g��*D��'��x:� ��4�^��$�h1�F��L���+q.]�~;�%�tdG��N6[�cF���Rۥ;w�6��}A������+L��i�(�����|
Behavioral task
behavioral1
Sample
cb5e3b56f8724fd8efcfc57633fb2980N.exe
Resource
win7-20240903-en
General
-
Target
cb5e3b56f8724fd8efcfc57633fb2980N.exe
-
Size
4.5MB
-
MD5
cb5e3b56f8724fd8efcfc57633fb2980
-
SHA1
99a4a87d94a1e7760ee1ca5039e6b5a79d342010
-
SHA256
d82e82550673b3a0bc627c4d3ba6c2ebb9b686eda161ae5d26f95a3720d8c8ec
-
SHA512
2fdfedd48e4e76e4c7b9d5f9a2a1a28da505d6e894f98023f2823faf97c937b189ac26410732bd62891069d87723515edcb55bcf83b5725997bd4f369593219b
-
SSDEEP
98304:W3AuxziZNLsJvb0qKMbDgYlARHHMt01wjIm4rJwaUI0sRUUckyoXII:uTzoJAbP3Dg1wErRUjscoX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cb5e3b56f8724fd8efcfc57633fb2980N.exe
Files
-
cb5e3b56f8724fd8efcfc57633fb2980N.exe.exe windows:5 windows x86 arch:x86
299f11b85bf2a9484cc467f28e6901e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
WaitForSingleObject
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CopyAcceleratorTableA
gdi32
SetBkMode
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegEnumKeyExA
shell32
SHGetPathFromIDListA
comctl32
ImageList_GetIconSize
shlwapi
PathIsUNCA
ole32
CoCreateInstance
oleaut32
SafeArrayDestroy
oledlg
ord8
urlmon
URLDownloadToFileA
gdiplus
GdipGetImagePixelFormat
imagehlp
MapFileAndCheckSumA
wininet
InternetCheckConnectionA
ws2_32
htonl
oleacc
LresultFromObject
imm32
ImmGetContext
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 294KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ