{L��u!=�u�h�qk��b�����g�����d��MT\G+J��m�~��cq��u�,��'X��M*�ję��+�mb��S�9h�P� �?���j����|���� Bz���J�]�ApyF��(���R�"|�q�x\bڻ����צ8���퐅�4�4�$��l��瘩r@��\ z��F�xU�ټjU���7 f���,��>��%�a,��:ޅ� �:AR��c^����0`����j�Dz���㵯7��4t�܃U���1O�|�����{�!<�M� ��w����Бq�t�p����������OR��1pgue�[��>3�.��ԚxJ�L�}g.�Z��C�����-.AMRA���47O��������y�3�Զy�4V.gE���y��V2"�����i����\e�^y��k����ժ�m6YZ&�UA��`���th�7�� ?5��>^�����H�.�F�P��p�|�8�|0������`-�ꩱ� �8n4�1�l�l�s<�0���$���Ր����ˡ��"ãĨH�6�I����XoXX�b�4[,����9�=��QJwL�<��cRٕ�P��F`��3�Յ�a��{����8?��fdY!d�8��N��/|0��uu�}e#�B�ݺe��˟z�o�4����UT�H��R?4�z��d�QX_�UC.�D�zՕ6vGϰ�@�'�[H#�a��>�'C�%P�¯�n���'w�7�=��b�����~.�\1��N��⠔�"XG��kF�5H��`u'`�>��xq�_G�˩�G���b�{�j���[��c죊�ö|N�O|������a��g �����V������6o&]�Ye�K��N�cۧw���_g�����*�)_L>C;������\��(���=~��ꙙ�D�i�Z���D$"S�p3�����a'Nb���?-�W��%��>��V�Z�������#�^��ϴ1���%�ޝ7�@��@��O�y������B����*��n�+��?�76�83g�/`��nI��\�����J���ČvH�a�2Y��c�'{��-�{���j�y�n� .~� m�c���;���T�Է�c\,n=�`�P�Se���� ��-Z�Y���R���U���v�\e ��~,~7q�\��cC_I;�K��yZ 1�ŢpЗ��ޘ��)��'��4��g.}Ӳ#��@�K���LE@��ct�(2���4���W;e(zh�pc�p��3#F��{Y0/ �õ�X��f�3�.x���6�B�����l��P;`.͉!�� kRg�a�8�^���(�4�:%�1�$3���� &�F&�Y��¡��Ձ�$���<I&S�4�-x�6�\�nO=ݔ���<l�w{��� )�e�c��Y�U�t��U�އW5s50%�%�7���++�& +�n|��P��e9���)�p���L�0�3������H~-|���e�ÛOd$v�PϼOwP�J=��F��#j� ���E��2�[�g�~~͟"Ѐ������zT��L���gE�E~G�iV�����Vl�%�+,@$�f��{-`i������+����d?�/�}�l�P����� ���㻪W~��K�bij�H�hZ=K"��yN�+B�THٕ�(�%�D֘u�a���ܩFГ�f�����q��ԛ-4u@jg��}iV����y]��L �;Q�PY����2��25�~K�e%�e��=����&����FA��¿�e^�(�V�$~�P�����D�lPc�`se���R9� Z˸-�-O���8������A�;]���7�c�&�r����P���`������>aG� :�<,E�ʃ����ah���G_�-P����$Ɛ��ȧ���Ϝ�*�B�@!=���f9tO�K<��@�"����-�fC(�K����?5��~ �(� �A)Jp_;h�]�P2aE6�7v����F1�1]6ζV��}?ͥYs�������h=�k��b�=��xn��U\�, S�~C��[�4 7-�u"�����:�,=Z� ���Ȕ���o硩��T~t��Z�#{=�Y��&�U�%�����7����6e1U�K_r���#*�M�����S4��nB�LqZ�f����˨r�-ѕ�ɢ����;C�X��P��5�0��6�x�n�.�qt<j�RZ�Qf�R�Pt(���}�ٵ4͚��=��Ly�c��\�<���~���[�9�e9S�����**�Ċ͘M�m��Ւ�}}l9���/�S�Da�`?DD��8��0���/�g�>��uU3Pq٤ި�y���u�;�>4�\HA+���s�s8�d�1��(���u6�2�t���3}1b:P���͎9}��l���6�~р߈Q���֙���!����v�CpO��M=tc���)f�D�� ,*�Fb����/���lV��Я�?�����6�fy��P����������@��}8>���z��/_��5 ��r��9bړ֍��F5��Ax�����?��~�+�n�����]F��-�\8�� �&�Ɂ�vQ.D鮦�%c���]��}�w����MsXD��Z��pZ��K߽��Ң��^���\wt'�V�ņ���b�L>w���6Н|���H�Iޮ�Z�Xd���xZ8���-;_��'B�/�Q����D�w���.�ƹD���o�H�vsqֆ� Q���6#�Js��fG{l� ˸�J�T�������/�*"�0�l��RRj��"뭷Q�4���UN�?��$n�rG��Lg/�*w�Sȯ/���{�tG�/ (��"�/����`����hxB��Ai*��!��-NF�16��O)1�1z�+X�gG�+����B��ln����(8�#{� �÷��?� ���r���)��y�̌����q|�� �~�>��M���'Rl؈��4h����m�����k�J����������ۥ�$nE���or�i!Zy��*��5���04��y*���0���3���up�ΗC����4�
Behavioral task
behavioral1
Sample
e2217865dafa4d88a81f88e9f1c63c4cf3f4287ce0e1d4ca8e3e5dc4a8609d8b.exe
Resource
win7-20240708-en
General
-
Target
e2217865dafa4d88a81f88e9f1c63c4cf3f4287ce0e1d4ca8e3e5dc4a8609d8b
-
Size
8.7MB
-
MD5
2efb8d0e81e6182a33786afb415e1688
-
SHA1
38b5991ec8537d0d361495f93087821c89ef2ef1
-
SHA256
e2217865dafa4d88a81f88e9f1c63c4cf3f4287ce0e1d4ca8e3e5dc4a8609d8b
-
SHA512
931c8249a34de18e915bdea905d12046687caf264ba89cea8b7fe5f82fba9dfe6a0ea584e2bb88875863c57b1b0ac6b0d767448796c4858a80cd7387f3dca3bf
-
SSDEEP
196608:3Zpq7JchHvBcyGrP73PoQvl4yyNoJa5AvvYMcrEK:3fEcwjrbgQtBmb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2217865dafa4d88a81f88e9f1c63c4cf3f4287ce0e1d4ca8e3e5dc4a8609d8b
Files
-
e2217865dafa4d88a81f88e9f1c63c4cf3f4287ce0e1d4ca8e3e5dc4a8609d8b.exe windows:5 windows x86 arch:x86
ef0cbf465f7fd9e20c6c07baf4fa164b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
MessageBoxW
CharUpperBuffW
advapi32
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
ole32
CoCreateInstance
ws2_32
WSACreateEvent
setupapi
SetupDiGetDeviceInterfaceDetailA
version
GetFileVersionInfoSizeA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ