g���Ɖ �������B/���a�t����1 Zʔĭ�Ԋ�+_�3��DZ���{Sy5�$e�d��Ԋ|5:L�2봬6���bm�2I�����_ą�چ<����%ٽ{Yy)�y��C�*�<E���-�Z�b�=ˤ���ȱ�,��/*|��������H����y��D��=�8<ì�r��o�t!�zMx��ÄnD�a���دm��4�����}�7�!��� �C�^���E�����,�2��^T}�|����2k�8��:vz�� �a�T ��(���:҃��K#�z'XnN);o� �-ʨ�����y��BݏЩ���?�,:�� �v�b"]�/C�<$fn�'��!c�Ҿ6R�dȹd� !c!�j�lJ��vՃ�B��1C�6�M+'vk��[N�>K�]0�22����n�oa�E�A*a�p�j��L�M�ʦ�,�R>`=n�]%�J)���M!�[�<d*���\��h�4j]�,=r_���l���Q#:���4���a��i��}폎�"���P�{dF͓��^�����Vmm�-ʭ�k��Fy���l�K!�5�p�O�еG�L{s��5�����j�w0��N��K�M[91�J(�-dH�eˬ�<.Ϭ0]a�l_"~!�^/��g�&�4���PRA��J�4�Nʣ��8hj��Mt�^���C�`��/_T �� ̑�e�KY�>������F �h�S����\�Y/^���Sp+�e��.��P ��3h�I�h5�B�S�ø���qՈ4n���3��s�2���*�=����pm�pl�})��s����xx��N��։z��P��}��H�V����vH��hm`�5f^��� �в�������Q֮�C*~fs�~�]O\x� ﴾����v2&�*�1t�R=5�xG|��>^.m�풼k�� �����e���W�E���dRܐx�V��!ݾo�������z8��L���2���CH<H' �����2"��G߮v!��b�zv�����AK�x�/��p�|ĸ����T�-�q�R�M��j�>��H��Ы6.sf.��o�Kf �CƁb�� } k�Z���鱼��t�~�j�Z�q�prd�������!����n��PR/b��s����q�Bi)dv�QN����û���6&��8]�e���R�.���tk]�����!)_뎉}>R��Ρ�T}�O�E���l�\b�V��n�����E����:�Z��;`��t��� ����'E������J`�ï1YU�Pg@t� �f��.g���*���Xߜ<O�ʔ81��������&�����i�$Дr��������*]nH��w���VAe��s��4J0����h�:��,��h9�U�H*7r�J�m�ؠ9��|��Kq��02Ԧ��\�A8� �f� �C��-�^�L̾���"�p�N�n0�A�L2��N�� ��c��P�g�d���H�ם)T�H�/�8lu]flַ�o~��.U?�:V�M��Ca�}�� ����B��ȕ�o����x��9m���n���|Nm$*r��B9Y�H���ǭwd���,���J�6��v��BO�!*�ѯ��d��d��n!�,}/#���m��FR��hǜ����+�I�R�C�$�> ����P��T��{��'[�ϑ~P0�t�)��6<vt�'�I*\Y���J5䩐�3sV���UJ�7 ��,y�9��ʰ��7�[��د��!��RH��֝���P6��'��W;����>��=Q2����@P:�Ԙ��/��@2b��B��Y�⾍�0{��;���iiuáAp[�m��Zu���F���*��������(�&�π�r ׅ@����8��٪�l�K�ԣ�����ʘ t-�$�6��u��Һ�S\��6��'���D�d���0���ϖ�@�P���x���T���F/ħ<�O�;����â*���zy��o�f�3#֓1z��ҚG,��Y-�ysQ�Ƕ��?��=������ ��Ow�d'��:K.$��4���� ����S4�@��y1��d���� �F�7�E-�xq:�T��nW>w4�8y��Y����M��8I�l(b�u���4l��L� P��hr���R^=odž�0T��-��{�ea iaݍ���p%�G�HZf"�袟�A�3m˪�����]����<CY�dq��=��O�'(�8��:��Z�wD]ɛ�����.������z`-��hP�G �E�ݶ���;���)�]E(D8;����;H�m�v�r�5�,F����ln�э��B�n��ZB��ݧ�4�NҾ[F�d�m�����jzC��w�<hw����w�A"�LZ��C/�l�7m�]��|=*�� ���%y#�L��Q�e����� iX9�w@"³ |��g�3���A��,��D��ƀ�U��"HDV�����s��Բ)Y5ңy��*���ܵ/�uz �ܐ����FGuL4Pr��,�w'�f_�C���;y�`��Q`o���E��x��;�&���g���u?�u�K��`�¾N�5{��Y��B7�?�_��`���?���Yp�{9��C)�����SY�|�:s�ן���s������w�wϠVHEY�-���i�20Y~}����%I���*bȀ��7��Α��ZQ�u26��X�[g���$dr�`^���2H����ʎ�V��ݷ�O���TQ�U�t��d�uׯg*��|ṿ ����������t�ڨ�{|�H�3��S���3�(� _���H�:�kd� 8�^o��rU'g��Ly��U�벳����m��Ok�����k� ��S����vx�Jh�I��&�4���Y�a��ɧG��VE�F�e�[;3�.�F������\�S�����絙����9J����o(��V��� ����q�8�1L06�]���=�6e����+��r_��R�>eH�c���Z��ȱ���8�n��@�E�Z��d��Vz��f���#�=(������z 34X �3Y3 k�Ҳ����s�K���+���%�|M#������eB3/1�=��5\��
Behavioral task
behavioral1
Sample
969597a7d1b0191aefa9a3c38a626ed31eec647b0cad5dbae0abf2086d3e9d60N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
969597a7d1b0191aefa9a3c38a626ed31eec647b0cad5dbae0abf2086d3e9d60N.exe
Resource
win10v2004-20240802-en
General
-
Target
969597a7d1b0191aefa9a3c38a626ed31eec647b0cad5dbae0abf2086d3e9d60N
-
Size
939KB
-
MD5
dcc0ae154778093205522497c07a4b30
-
SHA1
4a33e301e8689e16f2db11e7c40610c5ebd63fe8
-
SHA256
969597a7d1b0191aefa9a3c38a626ed31eec647b0cad5dbae0abf2086d3e9d60
-
SHA512
453a674313fe8b64815eccd557d7d72bfa2d42176fe1bdc33797b3f2c1f300f7be2486e7960d20a8068d958ba93cfcfc0aa375e95f38eab0cfab7607dd455bd5
-
SSDEEP
24576:gWKqa4hnzP3w7L3rmZmpk7FSQFW2iJ+N07/TNPwWLG:gSrwf3aZmpOFU2iQNIby
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 969597a7d1b0191aefa9a3c38a626ed31eec647b0cad5dbae0abf2086d3e9d60N
Files
-
969597a7d1b0191aefa9a3c38a626ed31eec647b0cad5dbae0abf2086d3e9d60N.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 636KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 961KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ