��2�ѐc���e1� .��H��^�wj��G˲�e�%^����Z��kc�8:�vǖ_W�6�66R�i�� G�9�N��*A��s�\Y��g�HA�.���yR&�)�k'5���0#\g���˱�wS����'Ɗܶ =$>�YhA�O�' ���퍡�,z�>�+ �h̜�k��@�� [�l@��9���t Ne�+�V^�v�M��76��cEٹD�CR����E�-�Ak��Wn/�d�_E8��}O��td�2�������-+k���֛��Yk��^eFaO�#;��Z*�0�A���Z�N�&�M3�۷ �������].@=�(�J�B�����`�m@����� ��N%^C5�tSLI2^�Ɍ ~붑tL�Ō����.w%���'���~���%-����b�����`�h9��� ����2��T>0��TH)Iė"iI#�婴�X�No�T�:��d�J����:"g;��¨fè��[2�A���CX�\��ӹ�J�֔���2��������&R��el���9�q���%3���� ��nm�y��p��`����M�Ĝ�|��duQ��.X4m�����YO��Qs3/�)�\�g�-�H�9w������(���������D�Dbj�*��J|;j҈�_�r�̈��Ь��/�z��e�#U������K�����y��76^��lhq�G�!�i��/_b��IO����aj/��]�S�8�\�؆�NZ�l�����_���_5��£�!͡����?�oW�j>%���6��������Bb�DEr% ���C�X5�ϟ.NMc�Du�J@�R�Lh��}C.5�:�9�D��6@F�4ng7 t[M7-d���e���i5��=:(��=��f���bQ+X[M���6g��KQ��R+ߩ����s������ʦ�q���)�B��t6qb����}iy�ӂ'�.�]U ؠ�7��>����2�.�$�!��~/E?��e���g���6=k��<�P��B+�M�U�舣"P|Ѭ68���&��s�1��"�o�f��q�< �A���w�F���@��f��"�9X��7ZH���|L��h�n�H�L3j�#�#F���fm���#�e]��.�C@�`�Va�^%>Y>D�t ��:? l�l��,c�Z�n�`Ƨ�,���)%~�*u��m/��)��6Jj�O$�xB����lS�*7qg;���H^<9�4��J� �OB3��/ja�{Jl��*0q���B�%x?& D�R\�$��nB< "�u��^u�@�2YJ�^ע'�(q�7Hⴜ5�yj?�G+��9��m�U}���P��e�c�w:a�O>!'-@x�M��2��=a��w;X|�Ѵnپo���*�� ��5��_� E���,ʓr;ĖO�r�$�NJo^�hm.����͆���P�ǵ2�g�~��B���:4zE��EƦ�5�8���O�S�w=����X�l���U��g?���A��r0<����Ԟ(|��-��χ����Q+�@;>lş��3�bw�]���rʄ^9eݝe�Y6�l*;\l����^�W�P��$=�h�`E�B��ekǵo��]�L����w!�+�v��Z_,���4�~�B���N����Ě[�5�ݐ&��E]��g�ԗ����q`��1*�ڝ�m��O��3ο� �Y��X�e躨�D�ALt�NR<v֙��"�[t��ؖ���| V��Ƴ��D|Ai�Rx w[s��r� �����v'�ub�|�a��/��"��\a�nʴ4��� (af5 XYհ� �}cq;u�*D���� �c�.Hrf����,Z����x���a����/�5��]�f.��n� T7�Ϣ�L}�������+GJ�휆�C�"�&D�(�������)�~Z��=����#n���o�|� ���>����y�Ĝ��N*(�����1��� F �XA��f|��߇��A��˓o^�n<�ٍ��|ݫaԇ2����i�c� 5o+Q���+R"�������cN���F��Z��X�dtv��#�+ݨ�$��c�l����l�Z���^v���ڴ��j�D�oD���=��X܋BeT����q�Wg�����2M����;b���j�uͪ�$Gz�t�]d4��]<L��@���ך_�p��=�Ff���d��.qf���]�q��˦n����Vj$��<�aE��5�O_T�E�h��%��4�c��C��ŧ�?����pmlXF��~�E���XVY/8n��� �$>������E��g�r-�V����@��M�YQż�����'K��-vF���Q�z���THl�ؽm?�fP�v��7Z�=��~i�% /�_L��Ԏ�/�v^�UR8�㵶 ���0�S��я��7%`\u�ݖ ��v1���l�����d�ڊ�䒣NY�[�NJ���G���S���0[>٬kM�qǒ� ���_@k�����M~�G|,��HZ�����Vqd����"��C����-��G�lp�]�U��}��i������X��0q����~-{�>RĻl�2�y�?�푛_T4M4�g�&��/B�������j���g�?T��E��F��f���d������җu;�_qÚv�k�Nvf�Lq 3��%�1l%���0�P�*V�+�<��*�M<<!{�O�$��R\`v�R,�h�3Z"�����N��{�K�'}��9�S$�I_�+H�5կ�-F��TW�- �*� b��B�E�߾��]Ux]�r_���2p�C��KK{�����~r��k�h���3T=>�(��92&4�1��É��ˠ��,�]'}o��Auz��֧��/�@S�^�V����V�0d�'q���ǃ6Ct �=k�~�s1!e�����F�G� � ..�V�,����wo������ E½�ܕ���~��]G�-�B��8��*}ckC���m�=��C�CbHӈ�k�&������I�4�5�r�4�C9(NRwqe3Z�ؒ_�����|,�RS����b�1 N�^�������c:_�z���ZL�j�iG)'�(x>{���B�FY`�F����0
Behavioral task
behavioral1
Sample
c547aed0c268776d1c7f328d4c500a604aa2d738a5a0c6a6c41d9b0811b4c274.exe
Resource
win7-20240903-en
General
-
Target
c547aed0c268776d1c7f328d4c500a604aa2d738a5a0c6a6c41d9b0811b4c274
-
Size
3.2MB
-
MD5
c643027fcc7d4768f7b69cc018f87658
-
SHA1
a414209e3ad8660b351c7e5917b7280128af6e24
-
SHA256
c547aed0c268776d1c7f328d4c500a604aa2d738a5a0c6a6c41d9b0811b4c274
-
SHA512
cb51b76a91954b060733d75b055def4b3504d8f97179ad1d1f2077330bb4926b3854fff549c78453d9b1b8b0d3629247bb49f6a2a01be81993500e9f0c3e7016
-
SSDEEP
49152:kD04miiL+AIQ+OGjyVtKOc58WErXMbAlkXl0PBkmNtZLk0MEUa9M1UHQQcw:OHiSxDy+KHl8QfT7Yabc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c547aed0c268776d1c7f328d4c500a604aa2d738a5a0c6a6c41d9b0811b4c274
Files
-
c547aed0c268776d1c7f328d4c500a604aa2d738a5a0c6a6c41d9b0811b4c274.exe windows:6 windows x86 arch:x86
b56b19d654a3bf1867aac58e3856f94a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageW
gdi32
DeleteDC
ole32
CoUninitialize
oleaut32
SafeArrayCreate
comctl32
ImageList_Destroy
gdiplus
GdipGetImagePalette
ws2_32
WSACleanup
vcruntime140
memmove
api-ms-win-crt-string-l1-1-0
_wcsnicmp
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ