�={����h���l?����)4��-�����0�36p�Y��JI�C�Vӌ�Ԃ|rwXf�j=m@���o�V�.h���F���"k�P�y;X�ǿ!�`�ϙģ���7� �TW3��o��������9��{��5��-2�F^P��k.���4�\Y����O��+�Җ����v�!S';��E�n��3��VL�Z�.� n�W�շ�x�VG>�N� !&��B�s8�h/��'s�4��Dԑa�-=]J��jܐ����G���?sf�6�sh.�]V���z�o={�����Qߞ+g(Ѝ���_�������ˊg26�-�S>Pʰ���მ�RyU�{�P/p����%UW{����TlD��?�@;wo<a� $S�1�u�R���\��Kҫ�w�NlM���r�g�ҍ��[8����]d�Fr�އ���V���������⿸�o-��������Uw�����% I!;5�<J�!�Y�Xw�`��9�F�Ҳ�}q"3�f�S���<�[uJ�i��9�(}���\����t;��L| ���1��g<�Y���ڋ�!i |g ��&r*�Q�sj�=�IE;���b�x�%��aZ F�ɵ��"6㚃�$����R���1(>���(�N��4�@�IJ,���>��#Yۮ����T;�U; m� l�V�D�&0:Q�s@�FM��c�@u�5۩����QM�F,�ޒ�4W�-�����}*�狰ܹ���h�ZZ+½P�.z�L2K7{�^{{Q���0���\����u��AT�ax8Z�j��sgh6 �\%�'yk��I��Z'Z!���,� T�rU��V��/Tk VRR�yU�+Er�!�Kd�:,HT�G@�k��@!;7�Qe n� ��01a���IS�wv�pI�&�#���o��n`\ʕ|�q����%����D�+��-�%]�Q��7�LJ���u�A� jk3��s����E#Aq�eJ� �n��5���;-��6m�?rl��8=�{���Jb�`E�qf�i��? ���]x@ʣ\���y� (�X��D}��;ڍ�����9����/8�� Z������M�l�v��ϒ��m�RmQY{Sr��P���ړF�B{[7�� ���7�������Z�m���V���{Q�:��4c ��Cx���74�#'K6���*���J��X��� 6'k_e�]�����p���;Y��G_%�0C:��T�Wwe�G p�[�|���������S{@'�^r�%����N/��w$���'3�Hڏ�Sd����91�z=�x�r���1ʹƭ�I��B*����Y��3�#��L��L��+'�2k���&r�`k��+5����Zp����ڣ��:F�*�G-vq�)ڽ�N�ύ1]ܶ��FE��'Wz/t�/���"(�䅠��Ȉҭ�HK�KCn���kO&@|��Ca��7�P�����TTy�@��I"]��B+d������^Q7$�c�t�T��z�3�����>�H�P��u��w�J�Se?�6�M�(w9���W"��KFX���0�b��N�������_�ԅ�P�:�K�oH��>1�ut�u$��Y�v��ogK�y]��hs���|H*��Y5 �-�Mpmi�}]eY�$�F�%G$N��iVK�;RE�$_�0b8>�8�ób���q�^�Cg�>+�^�D�n�Tdv*��$�l��k�?W�c����}���������;��>�~��k�$��˻%@�y~$9 ��m��A����~����+�����×�J��e�v���FӘ8V����J+�O�.�(��>�F.�L��Ц���\z�=H�%'+���FH9n�SF\9Р��u��R�*�d.�/QȮP�&g��&{8J+v�W�r�8�t����g�T3>r����յ'����4��l��>��tZ���Z�X�v1����V��.d������x�Ѝ�.d�~T���x��w#? H ��`�6�i��Zl��˲,QX2�����LL�Is�p(�9�I7��2sd�u>�W���\L�T�a��� �p]��,K� ���R�b`�z�2Y�q�uFk��^���� �3�*9�)sMi�L��������'Q�'e���c��9���E>)ь�k��ʦ��$�,�MK�vJ��z"y-����H�W���a�V�w�2�Nj��:g ����r��n?z�j�ۘ?S�J�u�z6*�x]Ҋ�.�r���� a��B�%��q[9qs]kꄛ(���ѹFB0�`�`���&s����&�������t���y�O��W���@Ҫ��ɬ��<?��9LVV�[<������Ē�`��R�:�����8mm�K^��|Y�A5��SA�>� �H�7���� 縨T~�X�����Y���%Ҋ+� �B[m��f!�.�Dn2�>�ڇ�j�uE����H8��7%��4jzRg�gn�q��h=@��v[�4�����G������9�n�$ �'�tBv4�:I�9c��Xd-�A��0�Lsc���=h;>���)<�>���48g0UT�^�Z���j���Z�7�v'x�3��K�lߺmRz�ԃa��V"��늇� D��l�1�vRh�N|�y���O�x��jt��F/��U֞}����ɏEUe��}��� Mܺ�%���n������;�A��F�� b��o��1�df�+�Hެ�, ;��'�O.�mA�uP�6/(��� �;L��B��'�����_/5�<���ˀ����q6�G��Ǭ[~�OjN�zݏ���md��7����lÐ�|-简����݈g�q�֭OJd9���]fv���/�f��j�Dl!\�Mc1?=��K�/|T�}���:�rv��/�Y�ាv�Ƚ{Bx�I���������S�������ji �:CN7���Ū,�v��27j&�Bf�q�n��k�b����+P�v_ �B�yeh�]�ؾ@(�t���T��Vz�*����"�^vI!&Ҫ�hl����8��e�x%$k2b�������n�K���m�^��E�s��jzPT���>�}�l)Eo��s̏��e���(������c�
Behavioral task
behavioral1
Sample
f169b8795966211f5b4b1ed4a0b90a6ac152fc35e5a786d9d9c8600c794fa2edN.exe
Resource
win7-20240708-en
General
-
Target
f169b8795966211f5b4b1ed4a0b90a6ac152fc35e5a786d9d9c8600c794fa2edN
-
Size
212KB
-
MD5
77d8681b9f8dfa50321628609f2eff50
-
SHA1
61fa6de30f175013e6883dd9a88acad9fe36fa76
-
SHA256
f169b8795966211f5b4b1ed4a0b90a6ac152fc35e5a786d9d9c8600c794fa2ed
-
SHA512
436368bd31e9438f201f4fa455021df87eb6772bd1c0dc0adcb42ca50dae37555d3f030fafc0e5c11582f577e1b694e7827eaaa7098a14a904e51bd8b16c1091
-
SSDEEP
6144:mb8UCHRVAJpz4ZIueKCXWORrmWMOU9kB6Lql:mfCx2Jpz4ZIueK+WORyFOU9kB8M
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f169b8795966211f5b4b1ed4a0b90a6ac152fc35e5a786d9d9c8600c794fa2edN
Files
-
f169b8795966211f5b4b1ed4a0b90a6ac152fc35e5a786d9d9c8600c794fa2edN.exe windows:4 windows x86 arch:x86
a3058c02cd11f5ca01ee7d1db936edb6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
ord588
__vbaLineInputStr
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
ord620
__vbaNextEachVar
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord626
ord519
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaLenBstrB
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
ord591
__vbaExitProc
__vbaI4Abs
ord301
ord595
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaStrFixstr
__vbaBoolVar
ord307
ord309
__vbaBoolVarNull
__vbaFpR8
_CIsin
ord631
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaAryConstruct2
__vbaPutOwner3
__vbaPrintObj
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaFpUI1
__vbaCastObjVar
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaVarMul
__vbaExceptHandler
ord712
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
__vbaVarDiv
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaI2Var
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord570
__vbaInStr
__vbaNew2
__vbaR8Str
ord648
__vbaVar2Vec
ord571
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaAryLock
__vbaLateMemCall
__vbaVarAdd
__vbaStrComp
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
ord614
__vbaVarLateMemCallLd
ord616
__vbaFpI4
ord617
__vbaVarSetObjAddref
__vbaLateMemCallLd
_CIatan
__vbaCastObj
ord618
__vbaStrMove
ord619
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
__vbaAryUnlock
_CIexp
ord580
__vbaFreeObj
__vbaFreeStr
ord581
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 196KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ