���5BX�����_�F`.sIM���t_<�֕.�����b�����6j_����rP��i��W���m2�P�k�f���`������i��J&>�������P��Z��0���)�����C5��%�� *6.lyr�b�;ڔL[����1l�(�o����Wd��<=a�)]u ��#A�]^�����b����V�3V��o=U���1��'��q!LΒ�@����h2� ���@�:I��S|��Vwǀ�2N̂�n���D^�s8��6EO�/��~�_("6!w�^9�p��1jC<�, ��4�0#�Gk,H�PP�K���eAb��k� �6��9��� ���"4&�ٙf�n�N~�����Fk��4��f�d5<��\��ر��:\^!� s�Ý�kg�K*Vy�.���WB+Lg][7� ��"ѽ0��l����~{D�WUU�lz�CNZꈌI���;�WI�"��Nh\.>�2!2Z���M}�̭ 8���KB@Mװ��r _L�����[6��ڠ�X$����.����̍�df��U��_�@}?L�U[M�@�]���������? ��:ܥ���>��b��aIA)�����Ѐ����U��4�ڜ. 6S����%Wl勗�V�R2Vp� P_{�̫yO���~��M���m� �9�1����U�Vt�-�xw�Ы�Qq��1S������3�'���}w��tX�to��a|ֳ���M�0��= U�D�;�X������Bԛ� }�|����{��Tk�X<�%$�=Ϝeb�AY�IqD϶���͚���N8A�̓�:��H���|�؊���1���9.�b>~t��-��1���Mz�Y��X����ZHі�{ ���G,Ŧ.��6�7dL���yP�����PjS� �gjt�81;��"����>P�΄Ӊʘo�vb[r 8x�)�v��UH���A�Lv�^"�vn�4N*A�l��p ̞lce����!}���xc]Sn@$����ИZ��C0 .;�Wͭ`^˻2�8��l�c��sӲa�rE`I�k῏��~��Z��?5���H�����$p�&�v5"����-9�O�'�O��&vҤ`�,%/��C�k�:�#)������טh�6�V-���'9���n!�$���YՔ����p���И��� ����Ŭ�-�]GO�����B���a[2�~yT�y�v)ۄ��f܍iP��0-먝�r����'�I&x���X��)������Z�'�&m��S�p�~�g�bê��^���ag�u��c�]���x>ai+���(���|������N*�9��$��6d�EOb=�b_����dp㜌?���54�����!� ��C��,N�SYy�xq���h�'��_ހ�I��;��r�o�Zh�{t�� ��r$�\�1�ܯ�w(��mWH�nrF6�b�S@�$�主5�g�jD�b:�wL������ �~��M�M�T`�8$SL����?BlO� �<p#�ȩ�:)�;��L���(��Z��G\�HfX��w��_6�1W /�%���8�T�5����9Z��2��k��/����"J�md�$��[���S,!czfj�e^��`�n6`��EY/0i���JP��̻��awti�5���A�=M% #+�|���f�1�!U���2���c�F8m*�e�a$WB�-Fb�����?|�x(�5>0���n�ɸV^�7G>�56����+��h�`؍�-R����jS������ڀCD� 4R/�S�}��)��g�͌B6�u����Sl�Ջ�tCQmW�~*.+�i�$�(��V�����r�.\0*� ����X������Tb�N�.�Ƽ��gN�,)�/��� X+@D�g$�/J�l[��WA������b�����2�E{�6�m�Nn�6b$pرg��yW��+@:ט�;�E{a�����5�}�2sw��9\5�.M�c��dQ�j#��S����a��9���p�=��аG����D�O����{��� �tU�0hڵ[�����-fW��ȯ� �8Ff��3ϖ9��9 }�ԥ�Vx\�B�2�UI�M8�!����lr���c�B_���x��K�����Z�C�� ��5���Fua���C?����Sag�d�i�����i���;}Yͧ�����b�|?GݷM�0�������h�LX�#�f��-$���]��,VE\^��$u�yb助fwF�WԬ&���>Z+ � �m�m�l騝��Js� c�;����(Kigۖ:}��+C�Ʈ�gG+PjåC���1��ޥ)rҕ�C����YH���X����[����ȅ�8Fx{�ˮў��x�60�&n��71~38�� �l���ޛ�B^�਼�n捋��N�@Ѣp����ښ��6��j��4���5^Y~jHu��R��p��"�b�!>�k[>�j�cm�,>уi��~eC +Ȃ�F!�(�����i��:�(B�\�Q�+:��"q[�vn��@����U��ho�<L���[��K��-�NT�)����o�@mA���/k�M�c<�I��`~Vg:vߩ��[/㒡�C��aOƇ�5&�Ċ �͚R�L�;�_���X�bsn�Д����i�L��O�U���b[F��2�}o��w���3��8�'��#�衯����N0�'#�y���\t���]�VaJ���E����|2�0co�c���_�����E$`1�y(oY�\9Fӌ�ē��DC��B~�A AV�?�����45w�6_J� ����}͆�3�WN�0��䏈��_>I�1 �1�|CleP��ʑ!��DG�MSq���,,�fE\С���,V}�v�)7Q"���� #LŲ�6�Twu�hG@�c����c�l�"v���&�S�3��I2�$��kn|���̔�e�B�'��*��S��9�-����X%6͟��|�q�e��ib�۸��vٍ܊�;[O+�����m�:�! ����6��zFE�W�D"�+��rQ�潍���?+�{�vI.�))M}��*�g��bb1xK����A��V\_Nׂٻ;��Nh~Ǟ�5�v
Behavioral task
behavioral1
Sample
e2cc225b78168cba60dbc088b00b57b94acae67f9217ac117283b02e64876358.exe
Resource
win7-20240903-en
General
-
Target
e2cc225b78168cba60dbc088b00b57b94acae67f9217ac117283b02e64876358
-
Size
9.7MB
-
MD5
aa76f7d3fd202863935ad7cf0294df62
-
SHA1
65b6277f26046bea0b28c9a9215f5381744a7ad9
-
SHA256
e2cc225b78168cba60dbc088b00b57b94acae67f9217ac117283b02e64876358
-
SHA512
c0fbe955503317f799563d8a8b79a493743e1ca931d89e1ddd2d090abc60c94c5714280093392af4631407885ed23abc9c5da86b9067682d2301e15e1c6810a9
-
SSDEEP
196608:PZKVYSZ0T1dmoOpulnbetrSm+inE/HxMDMK9TTaGb6SdTaWGQ:BQYy0T1UoOklnbe11NGm9HPbNe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2cc225b78168cba60dbc088b00b57b94acae67f9217ac117283b02e64876358
Files
-
e2cc225b78168cba60dbc088b00b57b94acae67f9217ac117283b02e64876358.exe windows:5 windows x86 arch:x86
60bfe67514166579f3960b4f3dcf27f8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
FindClose
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IntersectRect
ole32
OleSetClipboard
shlwapi
StrToIntExA
oleaut32
LHashValOfNameSys
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiOutPrepareHeader
ws2_32
accept
gdi32
Ellipse
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
comctl32
ImageList_Draw
oledlg
ord8
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ