�z��3M���$��y3ٴ�%Рێd�rMi���%�>a�7;'(hiC +J���,.�Ew�~�g�E�.OJ3��"�w��M�Wbjz����&46� 7���}ϝ���5���8̾���i��T!���,���Q�r2 ՔI�cI��� �I� �Hc��]��ӏ 1�L}�"h�2@�A=�=�L��y�=)/�������X�<qF���(Q�m^U�߿z������Q���9���x$�Uk,���tݻ�I^�ÂU���?�H��6�@���g�#d���^]r�>�m����K�h ��_ѽ*{��Dw *֥�@ҰڸRZ��<{$���Xl��V�D� +����jW{N����o�>��6�Ĺ�zG{���� �)�'��#���^$|�**�D��2l��ո���SN�}��54�z�,��%�J ���3 u[�����=� � �^ ����=�V�e�UۋrV/�R��% .פ�\�J��a��;��xh�T����C�ѱ��2,?�#��ɓ�ȉnig�9����t���%F�բ/�ٱ�_��S�k/�̆\L �`�m�|q����zX�?�o|�P:���R�x �2���_��#(�(�����Uf�%�{�F�PO�������'��-ޑ2+���] rCh�Gc�TgX$�5�Sl�n��H!��b���G�?�Q��#�r�̧��#���]dJ��[�p�(�x���������}�nl��Kn��T^��A�H�����vi�06��E��r�*!_��V��/B�o �lE[��lp���ڳ�Ǵrә�j�zQk������B�"�p]|�{�]Iq*^]R�=9� Cu6��3��{��W�8T��>�(#���Y0"e�`уU����,�Y��I~�l����Kм&�~3�Ԇ��{���"��C͚ �F�;�Q:V�`tsa�i�[��l2엤Jȱ{I��7�ɷ#�3�f�Pp��;��"��.ۙ��U ct�w\F��ĭ����7�ɡ��A<pq�}r�;W��W�Yk�ŀ�]Wy�|��5�9�1��Q�o�?�%�����d +i ��6!�; a�����S-���2�7z�%@��VT��GZ#�^��ee��_�udy���p��'ET�?���{�a�0���e�6��I��h�ei]e5g�\5���h���2x���3�*q�=~��Re֠��^��G���!�h�y�]��0F#6g�%���.܊����{5 =�y�d<"Rצ��R��1�\BK��!��~p��O���XI�Z@��q)G�xn���1���Ρ���Ͱ���>�(������2�Wz�/5�:���eÉ���s ���lp��^$GH��Z�$�-�:ڣ�@_sJ�<��'c��p������<�%��B�xjqZ��m��T�����eP�=�R;��+�� �/=���z�ߊ��8"X��:҈��O�&`j+pW�x��İjv��N���b��1:����Q���A�����N�ؙy� M�I��4��j,�/��ӷ4�S���H����ˣt��0���ɺX �l����d]��ç��gVm��L��nt��:��{З� u��G�L�wX���&��M�܊_s�;x5�N�WբZ��W�S䚍�v�u�θ�����2R��)�����DP4r=�[p1]�5*�*���`�z?����-�X7[e�����a���b��H��)��٠�ꐜl��;�0�Ϻ��? Y� H�9 �7(o'p�mA싷ԥ�y?A�5�?{���"���P�GX��Q����7B���?�cM�6�?;�Ѣ)�m� ޖD�����\�t>K�Q�zx��l]6J�0��f�(��!ͪZn(*��ɶ��~��6����� �m+B� �C0�&�����!\���T��C�ZD�ý<m�0�;Jھ�z����gR��q��&m%�77^> Qk���嬠I���w�.^_�8L�։�w`gb����sgN#��4������9!� �o6.b:������/��6L��s����J�ɖ�Xo�8Բ�d�r2�n������X�_��]f �����+qCa���: ���[����m�ɳf��y,��c,�u�Ƥ��,F�1�N�2,�^V�x^�I���M+���4����Ұ����T���M�o[CpRw\ʋ;��!E��yy�U�a����O��~oD�����T���� =-���_{J�\re1��uϚN��a�Yp�R�ã�˳�C�ءm�4ݲ��i����z�s�|Vz�����߆��-���K�eP�W�n#��P�hp[g�U�M���P��� I~��f�W\�35E�Uݨ�q'�~9�IW�g�Z&�,�,�#�ɶ��� ��2 ?,��6y/��Y����Ȣ��d/)�%�u2`�K�-���mٱ�?Y�bnjW��`XMۓ�ܧ���҉�b��[� ���lJ6�P��c�(ˎ ���=��N��>���'�d]x-�̝����6,Q~�%IC_N�>2&!���� #I��.��^�T23Sp��@/M0. 5v����a�Ub����_ 宵giݮ�ؓFVy���R��/'���� �?�h9�a4�nP� ��� ����:'�}Y�-���GSknC�~�%M��nm���Ӳ�<e�@���̮]q�D"�Q$�5��!�V�L���b�;U̠��B��n�Sx�:��`{�*E��Z��A��<�� � ���cGw�ԯd}<��'�>3c��a���p���x�J�z)40�@��H����!�#����w�)����\�?����q �}�����+���Z�v��3�rs�z.iQ>b�B�_�5�W����4:�-_�>����V�{�?T+RSQ�~ؠoV�)�����q��Y��������D0Y.&�A�gug ��@�h�L�C�LQ��Uѥ ���eyp��_^8�t�gg�:��YɄ��O�L!��}�PP���ώ���3�9$"�C����YO����>�R�p��SĂ��P���K�� |�݉,� h�/Z��"�8��ȗ��0�(P��X?X�������g� 5����{c�8
Behavioral task
behavioral1
Sample
ba367b9fcd768c9d98d9d8d8fb0e138065b63bc4c75710ac50616e184559feb0N.exe
Resource
win7-20240903-en
General
-
Target
ba367b9fcd768c9d98d9d8d8fb0e138065b63bc4c75710ac50616e184559feb0N
-
Size
4.4MB
-
MD5
94e64dbaa03da494b9aa502a64b04d40
-
SHA1
82b4c06c048ae56604b8fa042825907ea2c7500e
-
SHA256
ba367b9fcd768c9d98d9d8d8fb0e138065b63bc4c75710ac50616e184559feb0
-
SHA512
db3cb0710aedc1c9a3684605c2ab0102fabca01f684f41c8519e6201717dafd7f0191658ab7320b20dfbbae686a47a1eaa324e764d29e84a0f019deb19e91388
-
SSDEEP
49152:cS/Mx8GKLj+qzUj5Fshkmq/kk0dynOXKGsxua39PjmpbwaAbO+SL3amsK8kHxl/Q:Hf/+L9F5IkWy1Gs1EYO+Kk2lCf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba367b9fcd768c9d98d9d8d8fb0e138065b63bc4c75710ac50616e184559feb0N
Files
-
ba367b9fcd768c9d98d9d8d8fb0e138065b63bc4c75710ac50616e184559feb0N.exe windows:5 windows x86 arch:x86
46e5f48d46a688709becdeadc96132e8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
GetVersionExA
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
SetWindowRgn
CharUpperBuffW
gdi32
PtVisible
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_GetImageCount
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 401KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ