�IV�_rY�a>�S����5i�����0P�M�X6���>�/��GR���4��=����p�� �`�HVlm�R��[����ް&%G.9�9�JXź�)� ��n���2�,�;gD2'Ӣj���� ������2�ٶ7����fY��Nw.ǶW�d�62��Ҳǘe�#��a�=�IS�[ ^��{�BK��if����+����w����_� �o�� t�?� G��W2R9���ȐhM��w��l��)*���)�HX�h��{{'D�`35IB�ۈ�)"�:������@��z� �?>��Ԭ7?�ϝ��>D_�Ma�t5�� 9tTY0��՚>���Ȍ,�P�����T��O�?#���q]�oQK��{W ��9�W�HC�������H�Rϵ���D ���q��o�V�.����ID���c��Q;6wiYf#���D�,>�<����nf��Bh����⪐�w�ՆϏ���4��?K���(<� ���!�{N:Mp��J^�7%�������]��H��j # t����T]`��;��.�|#TeJ�e��f8������Yz��2<���J,\�7�"�Q�_.��5�S�����T)�|ʴe���.(�U��[g_�l��h��T�މH �����:R>}�"����P�mh�prސR:L���s"h�[9T�����[�>�r���9�Q�.:�sׯx�%mU� m�%ŧY�� ��71�" ��l��為X�?���PB�0F��P��B�.l�1����\2ɐ.��n�:�����/XP'u�3n]�4���r�S��!}V�gt���z��W����uxVs ޓ��*�h����BI]�<[c���J~Tڐ�qCh�㎥��LP!�og��e�IE��\����4��aX��2�0*M��2�yC��b8���v2�3P<��2�P���R��@��`l� }�)�j��NVf,Ǜ�hx���&A�)t"�`����4uq���F��R����{+�§�I�huR�x���9�vc��ځ ~v5Xr�g,��X���"y�=��*&c.C�0�=4�S��ע��«�r.|�+:�,���Vqh�/.�O(��Z��֞�ד@0a驗��[���wE�������\DJ���E�Ȕ��g������o�J�L����- �*yAG+���F��Q���d�3V#$��(yI7��?Juj��4�����4?���p�N��q��H�>���\�C$Zر�*Q��>��5����+�w� �u�N�?�h��?GD.��*��!k˺\�#��Xbe�G$�u�c�e��2;��ɹ����0����s��9�f[����s�� �& � G�)������|��g���0��p������g�Dp�������!�lk�Nh��ދ���qt�^����S �ւ�G���zUe�A���j����d�E$]��PL�q�uvϮ]��>�!�Ya�z������o��P�_Tv 9B��-��X�{�ռ!4V�$4����Q����u;6���g'� ]�}(����7>>H�ro�nG�&:t�P��I7 <088n ���ê��ήg%�Kw��.e��XZN0_B��^sk�#����Fj�<�߿����`�*���˜���IS;5�RI�[�b8�.E���C[d8�KQ:�Qp%� 2\)o#��&z�'j<��j��]�XO�W7�Z�Z٠+Q·"�p(%6��m�]��(����?�?�td���"|�*�T�@��leX�sW�v��^�o̾��v����F��6Ϝ]��N�@\w�Y7AJfrٸ�JH�^O��!�a�`ܢJ��t}H1YMf�R �� Y̅��ψm�>1W��v�UC 4�2v"�e�AϿ�\�ڈ�)�a�'�X��X�����MP��s����\A�[��9��M"4Z��N����eDAzp�lA8���P�re�~��\�kXʄJ����C����-�r���/w��{�C�՝B�yi������$vqW�ϋ\*�S������+��m����y�p��^@$b��qdF�:���$��f$�v�ä�K̴��eC��CA�:(�� ��M�q�INԾ��� ��;}kc��co������l~�O.��Y�DZ��:x������=�ֹl ��6����x�#�B��Ҳ� f@����P�̈f4���rP���HZs������iA�!G����k�ΎP�=G���4i��N_!�rf��Tޟ���a>+-����jZ��A�������\s�DN�"�p)8���E!�����r9�C�����?��Sg#D� ��˫!V|%c*$e�f20��!����&����3��, �9jO.2��3ZD�=��Ĥ?����_�s�����]����)�2Vw3ӛi1F��v?z�� �s�)4��H�;�e���mp-݆�o�!jd��S� ��p��"���.]�� ���s=!�A��N3�TX��xy����� Y�$��e 1k�Y[��-���G1o�#�mH�z��ΈC��zA� �i��kT�$�K����l�QR{f �~'.&�\g|=�����Djx�-�|���&����`��c�읃�J�n�ą/1Y%p��� ��F|��Ǧ텤�6�~C$�ݭ#��5[�˴>�C���S�X��xL"�J+��������}���r?>s�<%3?+�������@� u��n&���iX;�ݞ�:�PG\���y��[m�?bn:&_@/�J�p�\Rڪ6�5�+�h7z�?�mU����O�1��Г���J�qN����9��#i3�Z�*#.��ׇ��vC�cs�r�Q����T�}�-�E� �͆��}&Y�������������p �a!�����j$C�؞�}������8��������ޓi���ϱVLÎ�����e7(5���~JzE����[�|��F���"f��P���ABea�<�.��:Ot�Բ�EB-���{6`�#S-A����<�m��))�ߛ���g�y\3�=g0���~��~F~q�T�����չA����;o;s�h%�/p�vv.Uɨ�[ǰ��V}K��a�
Behavioral task
behavioral1
Sample
26bfeaac41f2c928829da3b77fefb372a7a495d4ff468ff72875c85dc5fd7616.exe
Resource
win7-20241010-en
General
-
Target
26bfeaac41f2c928829da3b77fefb372a7a495d4ff468ff72875c85dc5fd7616
-
Size
214KB
-
MD5
c558fd4918ec03db1d7964b5b02ee01a
-
SHA1
ebde53842d57e8d191e2a231a89670b9c3981cdb
-
SHA256
26bfeaac41f2c928829da3b77fefb372a7a495d4ff468ff72875c85dc5fd7616
-
SHA512
c9d4ac0ce743bf28efc79e18f6799f142d40634da9a27718c6f2782bce7430d46bbb53e152c4fd0a44952783a7b7fd228e9b099cf441efc46275545901114a7d
-
SSDEEP
6144:83+WBvwJiec1OtkoLWWytPES5n3j8P+dMrtzU27tdEZElz:o5BvwgeZkoLWWhSJ34PjOQdEZEF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26bfeaac41f2c928829da3b77fefb372a7a495d4ff468ff72875c85dc5fd7616
Files
-
26bfeaac41f2c928829da3b77fefb372a7a495d4ff468ff72875c85dc5fd7616.exe windows:4 windows x86 arch:x86
38aef8d9f3075fa3fbba42e52b483a96
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
VirtualQuery
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
_onexit
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 213KB - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE