�|��F-�xT�%�M&l��r�Z��94� B�7i���F�q"*=�f����S�,�W��^�Q���b5u�DI�ݰ��<�ـN�b�Pf�M�H�Dj9Q\a����z��t���{�B6o�y`��\����o��2�$����7�nI���#Ƒ�� ��Uh�=��yS��q�ۘ�������8�g�GQ�)��J����h��z��&��N|n{^�B,��]�#9\}��o"�!�6�ޑ4�m� ����3FG_�_�������o|��a6����ƅ�4�m�U�$ �ͷo�%u�@��A����$j1�����9�2���*xU���1g���B�����8;h=��%��ƽ�з֖tݻ$8c��6���"f������!�C��d��X�6_�,�����O()x��o{kb^���]0B����$-��wDZ˟��k���k�6G�5���@�����l����=����bl���_X�x������� �Wv�w��Vw��{��D:�0͌�lm�ȉh�\4(�'aF�����E�.���[h�`�=��gݯ+n�Kw����P ��7V�MQ�P�������]j���5QY'o� �4���S`UNK���Q1��u�ZKk�j����?�]ؓ ��-�6L�q�2��MTS�)�:j :�H������glU1��4T�vT%��c��,��� �z%R��7��J�����'��I��qy0��΄:���/̑M�x����h��o�N�a�8����w\f��£�(=A��ѬG1�H��SzP����5�Ԃ(��c�#n@خ�\ r<{��-\��UZ��e$f5?p@_��S��~B X9�U]�jb�,D���Ok|�p�7�H�\��KZ�����y�S����2<�@�g���"�(�\�_,ߣlTT�(�z�A���S1g��\��t�w��#�{/C��+����RSbڷ��H�~���$�[+�%u~w��������Xs���#éEV(yoP�@�Y��Aع:?W�#�:X7��h��ف�@���3�3���1�r�px �|K����:��A.���Q�.���"�TӵV��xm��E����n͎��Ć�ѥ*�;�P����$`��G��@�� Z�\����V��0&�Eڃ9�3�zTFG���J"�Ϋ�&gv,�o��y��$4}��\^ E&�x����X����Z�k���֏�����G�*6���Q�c=���cF �r��� �/}k]@\$o:S�+��G`�_�u�h�o�h�_�31�H[�z��S��N����@���Le��4�kW��A�q��-����B�ԼL��ϱ����gU�Ў?v�-�|�����:q������S]�y 5]��z��i#h���E������~K,�꠹ǯ��IIf� ��Yo��y����I�U\�j�^!͞�il�@M���۫����q�� X�����v�t�.:�2�WwC�]G�b��0��^�!Es�ApMJ�&�3n3�й��Ye�����a��� ~d{F��g!�R�-�8E'�.��`��C���0��~�½}�Pī��˳���p� w ����^9o��=��n��l�;�Dn?��\2��g�d���i������V 2V�I�?Q~ �\o����߿e���>��G�X ��H�LT� �v��ܛ�����y�;?p��}�]m���!HV�>k�o��b�A���4��W+Pw��[���ǭ웽-^��/\�w9M���t�j�r�:�*�F�י�Z;qq7�$�tոm����:t���U$u6�q4^��Di�f�b��&��um�&��p��K~��� "�"��&�C�(n��_;��~�m։n��Mu�M��B�G��P�Aa�� 攸]5��}͛҇tx���b�]Yj�����O��x0P+�R�eYd��H�qj�#@� H��T�?*I�|`ϙEc)�[_�`� X��"=ד�p���h�fh �;�����M����J��}kcB���% A�F�*P����T��%c-9Fҡ:d�"$C�4D��W��V��ҀN0z�ߴI�~S}�<��|���ׯ��>h��>��m ZV&�T�t�w�3j_����_�eZ��U�%C��t�Ju����h~6�å;��U0>O��VT:1����KZ�,��߂��Ь.��>�1:�{���F>�B��[�UJ��k�����}���J��3]Fa�^;�@�p��8c��D<��+Wb�eW=����ك�/:)iӐ����4��<����e��n�*v�D:+e;�����m,�V�vQ�8�ܙ����;#R��\��ơ���}��֯{53�^V`�� j2�6�H�lP�f8����}�_�#�������l,�P���US�>���?Q�lMOl�<ŏ�.���Z���_���T{FU�X��<yH����$H�����Ku!F*�fۊ�ܾ�E��$rļ��Oˣ�zK0��,�����>S��E�s&LiE������GG����p'9�����t`ۅdl��]���Q�����^�%?��~�q4�&�6b� E�u�G'�si`�T(����X���k�2��j�ض�Y��qgG�\w<X�a7|�4�DyU�Zw� ��d���e�UAC�mo��o�,o�O5E�:�R <\R�ƽ}s�Sީ��~z^ot)9f֠���)�/V�F>"4Ja��H�ͭ��5qI&��u@j�f�wZA�/����'57����&/�5���z7vbB���ɯ�FiXr��W�Ä�=j�!����D���d]l�`���AIJ��{pnz�����{t�����@ԍ�9K`�+ٔ3HaBŎ)��~�d}�N�0G^া�ퟬ��hA/���#�e��e�۲�E����D���-C��vP�踗�N$�Im��&�ƹK�鄝�Z�P,"W���|��b��jJ�ї���� ��4��#t��nM'KM(ǯJD|<�������&�>HR�n�֠AJޔ�e��t���Mr����J$Džl�2Ć��D�����}��9�gE]�a���ܙ;x#�{<�П�3���
General
-
Target
sdsa.exe
-
Size
9.3MB
-
MD5
6b831a1b6c6b4d2df352c59a0822485d
-
SHA1
d668c881479d1e986de5fe19cc0a76403cca9e4a
-
SHA256
b64f72a1d19a921f56a07a174ede7e6f98a7177bc4ffb40a1685e5e74c8ee746
-
SHA512
36c546cd56a0025f3a1455dd7eb82ca05ecbf535e532550047d3a0d4a2b30db8e05c541b201609f9e6300f8fa94976dcdd0c5b0a37b28f3d792c75c6b4a59d32
-
SSDEEP
196608:t9gCTy+KD1Xsmgp/WuqwJtvtVQj2g0Yg7T7p7hqFxYEdLQybQliBw:gCTyPhXsNWu7vtVE0Ymvp7hqFxYEdLu9
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
sdsa.exe.exe windows x64
7d3d8d8e5206bbfc553707a30834265e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CheckTokenMembership
shell32
ShellExecuteA
msvcp140
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
normaliz
IdnToAscii
wldap32
ord35
crypt32
CertGetCertificateChain
ws2_32
getsockopt
httpapi
HttpReceiveHttpRequest
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
raise
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 555KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ