����G��S����Ejf�l�W0?����R����w�O�_ӿ�e�������'���؆5�����h��2�s�I� ���߾�`R�#+�}�Q�Uس5�`��g�Z��V��(\!fu��I�F�?@��DO��I�}��yC�OvKJ�Lo;+ �*)>�v_y���VL2{l��=��"��.�B�4W�$h��*���� }0߄��.���c5w�z��Yf��,i剱B�6�+ ���n�Q(3���'m�2�2;�v%Lt�+Z������~jx\j���v���)A�����+�� ����p4%���k?x�-�e��N��n�o�_3�H��^�5��*X�{��J��(ߜ�ay��y�I2R.������#(Ej�a�t]9.�pY�����U+nZ�=����#�V��Y�|֊C�e�����)8[`�E� �=�A���,-�Ǜ�v������&��a<�+�J�Ⴃ���G��o�-�� ��~���`j��B�&.�"��L�3��i6E HInz���鳩w~�+ö����3�v�O�W )QL�%+�Цj���s�-?e��*¢�=`z�������-��Bs��t`��c�UW����ڈͤP�ˌ+B������d1l�@&��ǃ�7��4�������Q�(B�|��pk�(���$��x����^)�Pa�;���oW��Z=7"NN}��@�p��N��<N�T���`p�u����;G��z��P�_m��������@:�&5�O]vMb=G�N�z��ϋ��AW��Ht���8d���8-r�TWG,._��2�p9I��f�zY;*���V�����h,��c9I�t�����D��4��#� �j��&kXD���?�R��e盗� QB�S"�ګ s#�%˅���j@L%�� t(�t x�f5�řx8�7��T.�%`���h�5�����H�>�3V����i��Z�ai��R��D{�M��8� ��Q�@a��2���ɗ�Vj�f͟����d?unS}��� �����7��Xj��&_�q�L�U��dw��{:(|�;�X��B�����H��$Iҫ��;����R\y,s��m�"��{���9f﨤zݝ��A��,t��@�+���c��BG@C~J�[�(P�IJ༒��i���~�"3g�fZR|�Ռ�H�����t��6oHu�����L������P��r�-Q���+��j+�GT�KUY�tC�!�T���Ƿ�g.)����������S���=�����/ �0��oڏ��$. C��Ϝ`������<�z�vx&5(����]�Z!�d���Z�N�]{r�fop���r ��2����K#�.�W���sCt�Z����5 -���P��5{��@��G>���DN"j�I��39ȇ�k{vT�A-YK�l�l��v�ݯ�ܴR �ڪ�"�m�K(,�}�X��i�K=�g�X�b�:�\_�%���1�4��a�c�s{Y�n%/$Fp������F�ZO�X��G/Q�Y�A���Q����jħ�i%:ww�J�*[���,���Y�J��u�*��Tʔ��sB�ZL��8���2-%.+�P�����^�����%��PY��X ��L�i���z��.��4�/bD�����ܲ����1l�]�Xk���,w��\��Tfz��Q�:�ֈ3\�"5�B 5b��I��g�q��"��B<Q+��e*��-����Ǚ���ﱌ�S����>�a'RH�DɛA�>u,p6}���Tm�v��U�1�����oѤ��F�'aݲ>�N]r8Qxsk x�+a�ϝ���KEA��#]\$�K��T��)� T5F�#�~�/���@A�!]WXa�V��_��u���-���xvpQV]���G�W�w��mm���$#/���@m����tu�P)gP��% o ^T����;��*{��=��aŹ��A|cCp���49��hrޢd̞4��Ƶ�|����&�Q�?�Pb�J����坿 B�[R%mv"��姃I������O�c'4R��]S���tՊ����W|�} Up�FC���)@""I�ŎRt��R��� �(t���0�.e�i��`����Hf0����l(��鉣�Ĥ[���cH�'���W�L+g�)��nM��$ҭCF/���ku���K��J�3�i Q6�6��`���q�Iv~�66z�%P��T������ �qζ�p�֕�w�KZCX<�Y���3���FN&��P��dr0��:� 0R��n���s��ċ̆_�#3��4���^d>�:�f졔3�o"F��g ��n��L�H�9֛N_Yx�ΐT����R���ϝ�����7^F��4g0��M�>�У���A;�n?���c�A���5ϔ�mFr1���:�I��)�P[<Wߖ��%f\brM�Uq ���$��f�\r`�������F���6N���L_�F���Y�>����Fk�A���z�U�&�I�o���-�]e�d]E��n%��Ђ�c�t���mл����{dA�z��u��8�ۿ�Ng>e�q�@I8xP������C� <��̢�E��k�@j)�(H��������5�?�HnF�M��@��.�/a����������q�לì*��Mu�le%B�_A�@̑�e���T���& ja��������������A�U(��g`�R�aޠ@:'s O��!���`��_���ӻ�c�ɤ� �E����D"�2���m��n�������i�׳ǜ����^��آ0>1NF��^u��]Ѐ��h��վY~@;��p��� �a�����̐Sޜ@��v�a�L&�Dr�Z銡'-"�yuIP�駼l`ꭎ۴ܞgNԘ)v)9���M��~��g~����ai�b.OڳH隳a�z�5j�e�w���� |ʺ�đ�[�E�g��w�#���Lj��Yj�d)+늒�����|5���|��hk���p%�h}�ڜv�5�#��Nx��Ti1e���c�9�3H��C�;�n�8���[ L��&��y����5�����S{Z�
Behavioral task
behavioral1
Sample
bb291302e9dc62e2a5af5a4f1a47a3f0N.exe
Resource
win7-20240708-en
General
-
Target
bb291302e9dc62e2a5af5a4f1a47a3f0N.exe
-
Size
3.1MB
-
MD5
bb291302e9dc62e2a5af5a4f1a47a3f0
-
SHA1
5f31232c06bcfabd22a0eff4889fd82827543ac2
-
SHA256
e22811a1390a0e5bece3abbfbb476712d20b59548032d0b876c9571535c0621f
-
SHA512
5ea99c93e468f2f18b89bfdce123719e33fb7cd0329c4b36f42cf46ef9a21f412dfac99ca00945bf9c70af548b2ff54232a8197b083c7d5c24b1fe1da3212a46
-
SSDEEP
49152:henIODeJkfGEvp3odE56mMStOB2m22mf1TRpWD/AjcQDCa1xEseVlO6/9cnMrl:h7JlEZSh0CmFRpO51a13eVlO61cw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb291302e9dc62e2a5af5a4f1a47a3f0N.exe
Files
-
bb291302e9dc62e2a5af5a4f1a47a3f0N.exe.exe windows:5 windows x86 arch:x86
54d2db825764d2c1f5ed469978fbb302
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord338
msvcrt
_exit
kernel32
GetVersionExA
HeapDestroy
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
shell32
ShellExecuteA
oleaut32
SysFreeString
urlmon
ObtainUserAgentString
wsock32
recv
wininet
HttpSendRequestA
msvcp60
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
Exports
Exports
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ