�{'Jlb�n��Y,������}��!�¤piy�$��|K&O�3��a��j�[!�'-���\���(�)w��+�w2���,��s����|��P�GY|_/�_sh�K��!2V�h���hC Q����з� s$���uC�&Ȅ��u��c1���;;�����GѺ'|H�w�NȽ���4��3J}���w4��NR��� �n�nK��p~��r������?���q� X��j��mk��r�{��}��W��w �pn��Q7�P��}Av����+���h��I�����u����8͡��RS@'�PGL��w��s�e�A�P���D�� ���_���a�gj��6s\��0��.t4����wK+�x��iG$�����<I 2A��XZ�D9S�$hծ,���Ũ��8����1�=!$��:.+�k f;�Y ���d�[��R�ṝ�3����<c����\�t�a�>�Ό����'ՙ�� c{����aҊc�9�{(�J�� :U �K�ƒ �����C����4�[7��yQ�l�6���F�/�;\ݤ�$��>�<��_M��`� ��H�)����.�M���k �ڃR�Y���^���)O'��(_Ӗ�5 (�u����7����+F��쾩4�߉�ƃ<"L|���(��H��9�� ��zؕ;� y���h�=�!���q���6K��-_q�Uo�]�a��}�*:�P_���;c�R\����¹�a+��b�� �\kp��F�Ki����O�1gJ��u���f.��ߏ*����B��( ��L�[I)~E�Kr���7]K$�N"�,�ܛ+V����q��iZM��d}$m����A���7�m��Ԕ�6��垷�>�� I"�%����Ѕ�����)WvV*��>I����In�L�<���¸�d�K�F����{oCA��Eo�:EP�=��4�Ҽ�����wN3q���'ah����|�����Ʒ���D����9��vR�Qfs�H��� ����NZ�i��b&��H����my��h��g�܋������ك�y� 3�����*�p ��A̒��R�N[���}N�w��8 ���=O�*�<��;�F�!�C5sm6-��Z^@P?�Mu��4r�ȿ5����{��;y_0���\������6����-^�a���#�����IU�@t���sy�9��2����$Q�n"v0F}c�F���Wd2`ܛ�3x��<�����z?K�@e4�`�>��L0���q�/*���h �%w�d�l�w�7 �c������L/��N���5���6x�S�ɤ �f���Ff��(b�¦�����O��L���A�N�\��|ݻR��̽�B')�$�b{����顋Y!ҳ~v�U��rM���[s�q��)o˪z��\<Fh*�=���q�{��$7�}=��'�Ngg��)X_I��絢T����rB9�!��鰝������)%��u�Y���"�)B{��h����SF'�t���ߚ����F���Ͻ����1��bt�!��\s+�q�n�IW��[��� �˅x��R<�N�G�z4�m*@��Qm(SO@yH��c�Bm��x� �����"F(�����T1�d�������&K�p(�z4����X "q���j�Z�;8�^KWU)���L�C��Xb����v) ���������Vl�C�a�d%~thΒ^�'W+��:�N��B� �qHVo E������H�/1��^�1�7ç�B��V�R[�eA�)_����&��e�(�5xDb;Ǝk=p8f߭g�%m�jsz�9법������kd�\����������%3�C��V�Y���0��I���6��m���ӌ�UR֩0I{ u�t���6!��є�����o��v���;Le�����JY��@tEѮ���Od"����#���zӑ�u \��馱<u��K %gyM��=Sp�zK��&OIߐh�\'kG�О �-�����g=�����Z ��,"M�$3>�X_��ĔO�m3k�4������'�=i�#��h-$�1�nRbf�+��=.��8b�E��Մ�:�:t��焹�J?9�=8d�%��f��H��ڼ�Q���v�~8��TS?5 Th���۸���T�)�,y�i҉��I�����/T�xg��v^˪CE�8o9���.2�uK�h��t-\ᦲ��oghu�BRH�9Ku��f�V��R��؈������>����P��`���sc����%��l��J�Wv���� ẼBa���(���%S��3�FT1n7j��%�F�p�Fn��A�� d�Ԍ���;�̧5J������ұ�S�������,�9S�� �0�������xCNTH�Xo߈����&�1�������[��%%<y9Yߛ��%e��H#�ٗ���R0��bb����E�DH��JT�G���w����@$J�$� ���M�#%�{�ű��\���%�uE�����T�5�`�]������T8*QA/xd9X�`w�� U[��i��a.��l.UpW-�6���&Ҹ��gǧ!��>ߜ�^ M�P�G0~�s��qS�F�� 4�`_�F|�l���� ˓eu�����s�Z��̆��4�J���:���)�'��n��Jo��t��� jj��W���M��x�+�9ŀa����pK���y�<u�����9�����?b����ZtF��������s���AӀ��d�ᗘ�I�>n�q��������`��^��>���;pF�;o��Fϳ�)�1����b�ΐ(����8Ũޥ�{Oz:as��f@��n�7$�>m���Y������?�������F���>K8V���?�o,Y�^KZ��$^~�0�I����Ik"Ͻ,�G���3���$�$�''L�!L�>��к~�흶���w���Ή��ąL�c�s���֢>���d U���L�P�����%�uY����GO]���g6�15b����W�T�ډѐ���p+�zm�{�R�KzD{=ׄ0J!���5��ͬ�~�5�1�� qj4�_�ќ�`�r��&�k]9�q
Behavioral task
behavioral1
Sample
e4a797262a794db78db28c2d5529d980N.exe
Resource
win7-20240903-en
General
-
Target
e4a797262a794db78db28c2d5529d980N.exe
-
Size
4.0MB
-
MD5
e4a797262a794db78db28c2d5529d980
-
SHA1
f5ec6e2847f560a68ace9c766df6616ec3862ea2
-
SHA256
d167b9e0a92e6b172c90c2f80b4b69dfd2e6b7b2c240a1851bce15e02dda4419
-
SHA512
b5a9e6c5c464a8c9b51c83c90426677876c0fb902c1bbaca9929538090f6a4d8a39c9d88f53ff43eaceed433b8c3d6df8df95fea37dbf67ac167bde5899fce7d
-
SSDEEP
98304:QzO5pEpguAsPbMykb9xxxQ0cgvZ4t/JoR:jS60gb96gyxA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e4a797262a794db78db28c2d5529d980N.exe
Files
-
e4a797262a794db78db28c2d5529d980N.exe.exe windows:5 windows x86 arch:x86
8bda7ff849d1eacaf131ba911eefc60f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 676KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ