c0�ne����RQ}4[�q8���-R/>T�}�O}�X<��Z�X��VW��7q-b/�H4�Y����/z�6i�֚�q'�ZG؈k��ia��t�A��0u#"\+��t_��uiQVٹ{(Z�L4aI�J�1�za`�T��W�)��u�i�7�ah���`�wr �נ�g`j��u�2O��p�ˋ�ʼn覺.�拹k�ع<������Z���������Z�il�P?��qxs��!4�4��O���7�2�`�_���#��t~�������Yu�~�|^���+|��r�ݯg�W��7���h�\���,D؞��:T��r떈K�'��`$y��Kr����;N��l�5�w�hs�"h��dT�ޛ,��M�e�P�}+$��MT߰Vv�^{O�z�PE�U�B��KR��$���2��L!i�Õ�?�\ʦ뱠��ۻ��ȭ�=�������'(lnb�3�ZǓ(� B����"��\�� ��3y,���cKġ��lu8�8�ۇ��:��ͳb��Mz�̞���r?q3ɠ\�Ζ��dvDb ����F#� }�f.�C���v�H���`⹝(���C������Xe��f�Q�3Zü��T�R~=�� �� ϏO�e��q3����S�-�������qO���Xe*�f.`���)u��b�#R��TIغ���}b4�k>t+A�;����k/��ea�p�8E-�p�z{�`W��o�LK{S�"|�H���r �Ϊ�����T;���n�7\|SL��M��S�N]��{s��K@��x��Qh**gQ�c:u�D��'C�(��7���`�m�b�MڱR�1���{d|���'M _����l�(���N��9Y�C��)��K$e),���:��ӭ5���]n8���5�7����9`A��ި�M��<�6z{��D�w]��6O�HT/1p��&ݒ��&�'K<�w�a�O_)`�+�%����ºk�����2�՟�� �;^���rQف�rwڭ��1�� ��^=���O�"%�}w�s��$s~���^|_�l>3j�ɟ���'�`�+���R����)U3t#y @hߞ�NT�v\c�)?5 �#�U��?RF�����MQD�S|���s{e�*y g��h�gFO�ѐ�-�O��ӽ���f�1Q�+�<�K���������T�9�F7ə{��e��zjI��a���N�hx��*���w�*���J���bSi����8,�g��@%�u�D�j���cmc�n��I�Qq��/&��$d�6x�0�' �r��aVK*�F���*/�Q���n-�xa�u�Ǎ����a:9-�L�dw����B��S>��H5�,kq;�w���4FrM���qF�]����*��g���;y���� į�D^�2��9x? ;��$E��Y!�؝�EH�V aů���C�.7P({�EI`�X�u�;7U��c�N��� ? V�}�N��d�G٭�#���Zc�o�D�hV��#m\ 7�*([�v�O� ��(�c#"�+ލeR�l+h���LY~p�"�c���?nU���0{]�̥�s���r���4j �oܞ������M*]���;��K�A�Q`R좞j�����l�Í�E�ӷ�]��ޓ�x �p<�/VG{�Z~r�.T��T��j�e�(��>A�n��GD^蘔� �����1�e���n�q��%�Ģ�5��+=�!�',H �-��Bחث��;俎����BvfG�Y��|�5�5� ��P>�8�{O8����S��7e�V���:�-Ja�1�# ���˭�zl�1���KҰ#���k��&���hߓm4hL/��M(ў�n�<��E6���{�~K��VO��K����M��ˆ��֧�D� �k$���px���`�W���&D-_��q|��!����q`��~n�"�'(�=�0�����+"L�yK���')Ec"F�έ�rY��b A$��2w�<��Un1�쀂�?��n�� G�o'���Z�k{/�ci$������f�Қ���<�s&���d�J�4Zo:9�ѧզ~����2���rճ�V� ��q�:�vE�!� �: �1G�}���3��6�ل�2o.�2q*x+���/]����N(��k@������B��fhF8�#�ks�ʺw�;��������&f�Ź���#�?�Cb�w��+��,.Z��c7�K�C�i�t)�u��R`�L<ȍ(�Hw��پ����n\_��g �j���u��_Nco���,,P<wF݄'��a�/Ӝ�������E:@���F��C��8�215�A 4�ܞ��n�wb�N[�af ���_��>������;�*I�ͪ2�J!�}���J�x��+x� )Wͷ���A� P9Z�iB9@��̞?�J����Z�Ug���K�\{�� -i��8�EH�������C[����cT�<lz� �N�H��P#_`��K�r��]r̒�7����"GE[L�|a~��1㠴�.Ra�fz֦�֍\��{�߂W�{���� `��kZ���+���e�aYOS���kf2�k|��ct��d�p߾H�l7�)�;�>U(�d�3F4��&|��V"nlB).�#��̮��P'uDws��j���/�$� d�G�s���M��4n!+���6nv�+���/� xd��-�����$7;�9�/�U��PFmө��dE#�N%�H�egh�<���IQ{�63��(W�)?��Pn%�������ʉb�E��|ԒD_����w��ZF��q�u�>�W�d���H��zkI`T $ �������o� b`v�g%K䢠�E�88�n��=��vb���rr�x��>]��y֖�v��#AW^d��/V� _XqҎ�x$�M�${�J���K�p��r3�� 6�G�mg���V���7v���7ʼ�L��3')pT�^�:N��ս�#�G1q��0=��A����L"�.N CZ��]Uk���aZ�i��=LZU���]9�r#�l]�]���M/ =!fʓ�Di��>L�p~���S�h�Bу���U�(��5��x��T���jP%p����\���,�����_K
Behavioral task
behavioral1
Sample
cee20673dfaceb3c3f06495d43ff1c131551b71cea4caafdf63929363b553374.exe
Resource
win7-20240903-en
General
-
Target
cee20673dfaceb3c3f06495d43ff1c131551b71cea4caafdf63929363b553374
-
Size
2.8MB
-
MD5
709e005f41ef4d391d8d6b3c0c0eef42
-
SHA1
cadba27dc9977d8bba72173dec3cbd76d74c1812
-
SHA256
cee20673dfaceb3c3f06495d43ff1c131551b71cea4caafdf63929363b553374
-
SHA512
ba9f761db83f5b0265a93f938e6794935dd76d7787254701f0e183f5851b41f3687a0a605367263dd26c637c3050fb7a6953b9f87d7c48f66e32883b65605f48
-
SSDEEP
49152:6VFxnNAjn5eaOFa6T3pHtE3r0JH5JlSijGWlyHSIQo/nl17SwuvmvysVxP5AN3yz:uxnmsaOFa61HK3rGJlSiKm6SIQM/S5O6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cee20673dfaceb3c3f06495d43ff1c131551b71cea4caafdf63929363b553374
Files
-
cee20673dfaceb3c3f06495d43ff1c131551b71cea4caafdf63929363b553374.exe windows:5 windows x86 arch:x86
03ecae74d990f15296b2cec115ffef01
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord3798
msvcrt
_XcptFilter
kernel32
GetVersionExA
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
oleaut32
SysFreeString
urlmon
ObtainUserAgentString
wsock32
socket
wininet
InternetSetCookieA
msvcp60
?_Stinit@?1??_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA
Exports
Exports
Sections
.text Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ