�A���h��p�m�y�J�����w��Q�g*�@y�c�BU1=��+�ȕ|���1��E3N��ak���l$��&t�]�\�{��� �`[������S6}ܾ�2���Ԋ8�8��(������5A�Bf�/ȺW`��@gD =����>��js�U��Cq�J�F[M�ß)VC�U����?G�1b6��g�����>��2� <��#��p�Nr��}�����A�_v"����G��̢�U@^!�Y�y\�U��3�A`A�:��b�X9�Zǵ�C)i&�����S���R�j"[���֪�희��U�J~ �����^�9� 5�#L�"��p!%(�K)e|\BT�`D�,�'���0�����#{|q��\ZT�̾R#��Ȳ�ġ( ܼ�5 qvɈ��,���<j���1���FqQ4i<��r���w��O�Yh-�S�����nr��ʡ��j�?�pOHWC��O;PUU��O�Z��W9�ib��i>��LW��^�j�ڻ:��I��<=̶~�3�v���JsG�n .�:����b2^L�Z{Cl:�s���9C�q\A8��g�/����$G?o����e�G� *u����i�W���a�JAJM��3�3�]���W[�����D��Z�|̧�0�7�:�֑���,+G+��c0b<q�B���i�_ͯ�n6B�a�J��[W�x0� �,���p�z�'|�ur� ���o�Ǎ��FU<4�v�ԣ��HU4�K���h�c�����hI��N]f�H���`.����/��I�0ڼZ �3�ĝ�i�|?�v|�;�.o����bT��� ��G�TK���>L����ש�YM}�+�%�cz�Q�mcp�T��l0�8o�o��>/yzf�e!�L�P@�����uN'���S���XUq�w��l�����Rͭ�B�o���$2�>o3�;g7�渏�d[��lz��"�����{�1�|�4��|��Z~4��UR=t6��X1?��?� O]�����U�Z�um�7�#��mJ���r�A��5���tYv(�$��O������f�R[�^��}<ؠ���dcr�f�Z�An�3jh�yo�<������-ws�����R-�����(�������*67�ϒR����5������'��g� &}r4�e~0�oP�_�����=�4p�{J��?A�>)�Ո� �S�8�(��|�˿�a������WgÍN9""�xB���p���W|�d�҉Ax���F+1�?tv������VQsF���\��w��a<���*���;�Z�1-�S9ۜ�ʆ��fK��&O:N�Nw�3��3�w�)ꇛ?3L�gm�(/0p�%�;{y�Ԣ|W3�j�P'19v=�Eh�?��>&��%��>,ilz� ��s2� ���+m/ ��ާ�lu�� �wՙvڡ����D!C�5"�#Z�M�%b&�T]m;��6�nōC���"�w;�W�9[$X�A��]3R��F���/��*�6֜Z���^�ZL��Zg��R��g�˒E�k�q���hh���v���=@��b)�븫 �V9v���|�����@࿈@�`*�'��3�MN/�A���at�!.7�����x��H����?��2�����K�k�[���a���� ?�П����BR� �������"(JЌl�Eb7g�ۦ�o�r��V�Z� i��Sd�g�f��6nA:Ǎ�8�iӯ��j����U>�'E$�ےw&ecd2�\]�q��f�uc- :K�FL[ 8@�T £���)xi���W�؏��{k��i�m[G����ޮ�66�oᜭ���99������Z��V�g# �/��V��"2H���|{��ؕ6j�t#��~��*-<��fND��W����&�x=���֔�e�N�1�Y#��'PS�y�w��z���)�o�����M��&2�U���@P�egz6���]KCZ2@,�U�@�7�e����1��f<��7 p�i���}SP���-t7yܪ2l#S��:N��vC���kO܈N��*�3�����bCd�h e�K�`��~7Ls3V� ��E+�}bmW��(��Sh���K@i�F~z8�c�{GRD�]e��$R��� Vh[*h�MFM g��H-�����V�5�}�;��R4;�5���� �퀅��r�8�$n�\,cO���w���F��q��m����7�7T���t���!Q�0�^= p!��|� $%�30������\<a=MG�Brx��6@����A;#^C�6w��Z��UY�?����[jKa�7�Ne�%� � a��#q�T���<���\�7���K!v�0�]�a�W���S~��'Y�K(����]�q34�� ���o�;����J�� O�A����Shrc�O&,����?����������<���d�@E�Ý�<a��A�85 ħN�ɺ�0�7������~�H/2C"�1��p��#�~۶�E:+ r�N:�t{j�� ~5�2,`0�)*&� �q|��>@�>��MD�.����a�VZ15�!n��]E��q�� �*�:mBD���V{�$����%?���S�o���ʭ�y ��Z2S@�hdo����<Ο����m�i�Q�r0R���N��e����~�a�3�HN�0 ƂLX���[�7�Y�NVvuyS�7��s6o�h�"�f�۟b]��B��Caсl����,��?G��誂ޢzI`�`R� m�)���Ա��S���q�����3��9��[�f�T�R����b���I��C3��@�.�p����?Y�}�<�c�Q/��4����g^�fU�g�9B��=Z#����S�T��e@6l���Z.��̃B���X���F^�^��L ���jI���:�>����^�;�o�9�;�b9L�@ik�͊I���;��׳L��0�PO=}�Z,E!q���)�y`������n�?4U��yd�s��/��6l���a� &=���Endyp��=����}�p�g�=�_��sB}��!]l#���Cq)T��k�;3��: 5�"� �mEG0P/��1{<r���6J� ��~�)��2@
Behavioral task
behavioral1
Sample
nloader.exe
Resource
win10v2004-20221111-en
General
-
Target
nloader.exe
-
Size
6.3MB
-
MD5
ba52086fd623fd1bad2d3f326de376ba
-
SHA1
0dfbd5285cbb3f0c2a0cfcb1adde235b1e0468d4
-
SHA256
709a667e50e8fc9a674afcc0be48d2f451f80de9f3ed8a81c9b323b7c2e7ff66
-
SHA512
500cbd741cbcbc15ef87e7a2b8d0c1bf87752e4fa90a85be0bd91b7c9f2bedd5c2b71ca0785ec531eec89b8e741792e8a0ba7666058c6d33ce9870e2e4220a73
-
SSDEEP
196608:dGfEgVqi6jbXuZYDSJjyvDgEKTVJaMJOmEuAG2Z:dGfEuqb6eDSUoVJagCJG2Z
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
nloader.exe.exe windows x86
2d3b38564afcdd80ca37cd62de829170
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowPos
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptGenRandom
shell32
ShellExecuteA
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
imm32
ImmReleaseContext
xinput1_3
ord2
ws2_32
WSACleanup
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
vcruntime140
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-math-l1-1-0
_libm_sse2_acos_precise
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 736KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ