,��{�ߐ�x��7,>$�M<K��k�z���&4� ���AP�J�� ���h 6��"vc�R�E ��ƶ�3��n����N�R9l���TP�e�\:����6���_.��e ��?�s`hf)�5��T�P�8����gP< �B~�]�P����I���]�7t��e6]Z��2�4�tAD4) �/�궊�j7&������XN�ފ�Ke�na���eX1���!ڍgXU��U؋i�F�q���^�E66f��{a��1c=�P���������� hxNE 䒇�څ �QJ���'�A.���H �8��>N�T��{z���@z_F&z4g���?�>X���-C��˧NAN��l�l�bL߅)�&`�F���k�9���q~�,[/)�ek.�uU���J��1�E�{8�e0 =[-]�2t�<n��nș�"ʭ���_�q�$Q�,*��'�C����[J�'X�S%�m�L�F�r@��`gO~i�� ۲�՜8E��<Ȳ������ZaP�%����DJ�&��Ɯ���)b�I���EB>a��=�Sy���"=iv����:MjDHPY~5��6@bk/�E��4 ��Aʔ~��V���pE*p��ypIV�%Lf����H�,(� �K6&�ܰ;4E�Jm:5M�z��������fҝC���o`�����Ԗ6$3���)W���<-����e R���?�a�]�|�(/�a�� �q��Ui�H�����h/\.ߌf�1��{�R V�#U4j��b��1E���n�I���6Ͷ�E䏏���4a���o:�)LZp<����r�E��������n�qS������������mq�/�R���B��X6Y��4��ke���o�=��3��� Rfd�d �Sx8z�Ory����F�9��[P��o��E��&i.�pb���6)��ۂLn�@��Sj{�ٯu�x/����7��#�ǩ���!~Dz([m�8����/EJMwY0��TÞ݉y�S�u���D#���@5ʑ%�6p�U�J3�gY��F\O҅~�lm��Ҩg�᱖�0Ҏ\y����K1a�b��Θf� �V�����O\��f�Q�M�+oo�V�=�I6�f7T�ySQ��O��$��ƂDm��h��s%66f+�P��Ź�]w�<b�&���&�{[�3�A�S�x�I.f����`�ֶh�锾�9���)qG� K��>J���5g�6OR��*�Ta�l�����M�'��4eČ���^��U5��t����9���`(x:u�H��6a��3�#�� ��bŷ�~�'��t@'�>K��qG8U��s��P`��@-:�zr���㬶58麙C���u2U�]Ъ�s1��Z�ܖ��D)��hz^~(��㍂�����gz���xwm��4^��L)��̰�.� ��w�&�.f�3��X�>z)_V�~�z�b�R�u�t3Z 1U��������M>/u��SO�S\N��5�ÉY��Y̪lYrY�w)V�+�v�Gi~��<Y��/�-���(R�<�t�e�9$�� us�CJ���,3��Uu):�M-�B�%j� `N��[9J�:P��'h�Qk���@�S!��H�0zp��w��AU��@���q�D�'�����d���|wt�idX��S������~�T�.��ӝݙ���<Ƌ�GR[����PR�g*^Ti_M�Q�W���` F��B�ڥ��E`��˿���a !�0��g�lB���.��AE:s�1�����j<$���y,;SA��L� ɪ�f�U[�����eB�݈*oīO�oJ��4��CO���|?�O/d��s1���gU��ІAi�T�>�6k��˘������}���Y�ů��4�?�4��L�P�Ŭ�RC��Bp���}G���V�g�[���H�mz�k�֔�H��!�*�/��Q-^����hXK7Q���D����1L$6�#w���ף�ֈ�Kw�՟D3�B/|d[`��g��o$I+,�.�Ξ������<zV�q��yrk���N�ٲ����k+ญ��Ҫչ�E�d* �0o������0Hf�bZ�k�;)ԛKH-������ہs�q *��&%Y�� \� �y����X��*&:�K�AB������cͮI�&s7���0}�Rz�қ#�!����s�@˕�!�'�;%vVz���=�%4� ^q^�p`���ۙd0���̓�R����p�O�?�F�N�,V�`�P�k B,C�՟N�@)!oP�^���N���&4XVU����p��t���S�w��F�Ǭ8M�Jc�u�(P-�Q.˙�Y�>��oC�+�Z��T�}�ˆi�ol����jQZa��r_,�TA�^�E8��V���:c/8��.���٢�u�j����h{kq�U��}첍|d7��_ ����6'G�ɭ������PWP����$�����<ʸ�E�=)�h;`T��ĚN��� �jM�@��c4&���$c�ϰ�?_sB���` 3�r$�)�M� ��d�X"��~V8|'�i�Nס��mmp&8�������;�:�>�Br��� E�ܾΉ��4�V�=�@-��v1�@��ⰸ�����H:�'��^m$R�uQ)^��F��D��1��^]�X���%�Q�uou�f�(����]p6W�=��r� ����cf��NHa�%2ŇgZh���~�{���`����=%|F;�4�O��mYE�Ի7�b���2��Ѹ�O!�p�a��"�1�'�SN���!�A�b&�e�ogTL�m��_�`o�s����wB\��*G���Q\p�K�vY�O�}kQVUԧ+&�-цH���G<�������e}�,��`��u=������G�4�{�i�Ēw���Ay� �?R-�~�Ǫ8@�^�^����G��o�2g6�����6 gҞ��f�>��ɖ�F���s��8l�7�u�{|���:l�i� ��wp���jJ���Oz']s��-S#��[��=ZC)���?|���5ƾAee��t���b�/lhnj��v����������^K�o1�6���ʜA��lB!��}
Behavioral task
behavioral1
Sample
63e545f56874b0ecb3ea4592b41ec4269aabc9e694a319f65aa34611d52e40e9.exe
Resource
win7-20240903-en
General
-
Target
63e545f56874b0ecb3ea4592b41ec4269aabc9e694a319f65aa34611d52e40e9
-
Size
5.1MB
-
MD5
79e701d718935166a8d6b2fbb995ec72
-
SHA1
0ec58a82c85a7a87a7ff8222c851f1699e324b78
-
SHA256
63e545f56874b0ecb3ea4592b41ec4269aabc9e694a319f65aa34611d52e40e9
-
SHA512
399a91beb6d80feef5e805bfb7f2708150fdee7c83b109fc60e292c5580538d4cba1c2b9c9607c6221682c07c650e811a60618c09005d56be28c1c8e37502ece
-
SSDEEP
98304:NldA+p0Q5Ll++jgWmP8AiNmjbfrW5IRrNvLKwLbbaj+Dmv5ueUo1Sf4:T2+p0QjsDbiirW5IzvbZDm9j104
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63e545f56874b0ecb3ea4592b41ec4269aabc9e694a319f65aa34611d52e40e9
Files
-
63e545f56874b0ecb3ea4592b41ec4269aabc9e694a319f65aa34611d52e40e9.exe windows:5 windows x86 arch:x86
ac3164c2f8759b9100abff0b3ed8e035
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
wtsapi32
WTSSendMessageW
kernel32
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 419KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ