���m�#�nd��<[�6��'�M�Cxu��D�{<�������C�nE�+Rr�U�ֳ ,�Z�SV�A�x¤��j�nD6���G-6�#�wʲ�A��!Ќ�ǯ 1��$���|Su���v��]㞞�d�t}��EJ)�����z��Y��{db:�b�8KZ �\O�#���86� A#ã�:�Ɨ�}+�!3b��Ӈ)@�������i�zت�&��3뻍��V [�D?�y3Ĥ�acG�C�`IAW�~hFt "+N��21'���I�y�����EW}�+4��`���myg � hI�%h+�*�ڡ�h��ʨEХ�s��3�}��jq�J�%|Ϩ�[�SEd; 3E��� ���%AHe�O-2�ܑz������E�N�</�w��V�r���5��X���Y[����������^B`h�_i(�g�&P`��~���-�p�C���#�mY�LG��Q�-�jK����w����I��a�~���|U_�Z���4��5�ia��I{ԉ��̋�3[ � ��BֆsJ�Qs��T�����L\E�q��/�r]˭Ș.�R��b�҂}_�M��hh�Qg�O��Y2x�Z:>�a����S�4�/iK�FZwoQΩ8�K��D� ���r|'�L����kv#-*���n�h�SI���9���D�0�u�g��cG��l���@�ʠ5Y#�s��}|���1]���~�9�Q��k�s��4b�����EdW�Ё��q|�01���=�iG�g˧l�c���c�ߩ�> ;�!Vs\AMhG�2����G�R�=�y�s1k����C�mG�e~����9sS�T�m\wz����[���(��iBNMW�:���~�/)f�3�Ά �'�-o͆O����t��{Y�ϷA�.�Q�����E��sؕ>�ӣ���U�"��bY>{tc{���ɕ���]��)EC�ǘ��4���l�f|�����о�O���3����c�A���|��%M���,D\��Y�si��ꉽ^��Y��+����V��l�t[�N͐1�&���Cr�"ښ�:����UF�c(f��c�O5��T]@�^xg9 ��|�(E��ʆ6���BE��N�D!���x�#Cj��gF'�z��1�r�9�+vl$T�3�I#f�U�zd�p�.�)KD�v�ȫ��,��"�{A"w�����@`!�f;����mP�_�r���ɩ�|x�_�p����d������l;B��ar�[q��{��{��c�J��!��t���k���������R�����իG'�s�ܗ4��I���7�vP7V'� ���h`�q��FC��<��M[�+Y���$�:��������B�鬩���}�Dv�� q��l^�h�����a�1�V̈#WI��|_��>t���>{����1���@���=.{��uJ�d�GQ�AZj���aj9���&Y\���r*2x���Y�xW�ߩ���2̹R����遵����,!A��LV��[7�����x��ʫt��fT췣�0�df��lxJ�A �s���|�_܉ ���";{�CKQZ.I���!(���v?�S(Ig�)��{��"��F�pę�Ʀ� m���TwQT�ŏM��Ѻ�G�{v�Y�o�4�k���mE`����3ni)q�_�2���q�\u�k����N���#YM�ƕ��ؤW����e|04p-��aX���*�s�ϨI���j�������������|&ւ�?�d~�P�����j�#Ex<�� }7oԏ���ePd�u+�*��^t�2�b${�:�X�� �6�gZe��(�����Ƅ����h�3*cf��/:d�m�hgD���j����hτ�������]�u�`.D��r��%�C��@�/_���m�E�X����)U���8� �B�R]ٰm���I՛WQ%��&a1v i��Pf��+��;}7��#ы��A�tɕ�l���L�|��^jԎ�$ʚ�E79Q������y�1��'�Ęv�"9�\צ�i���B�2Җ��?E��sCB� � �x(���$jh��B�}�����Xӭ3�Eݤl��S�0�Em�KF��87�[�)�6_�� K�У�dW2�c��:�h��LC�J5��Ć�wޠ�i�"�ͅ0>��F��1��d�|�L�g�@�쥹qF7=V1~���j$P48�֕d����=�Ra��E��_B���Vy݅⧆�V��5�6V�8������2�+-2��B�zj�z����#H莉��hȏ�o��3����!�A��+ 3����~����t6����W�]��i��-���@ �uX'pT��`��w�9<����0a ۶�l.q�q|b��}�+JP�Z�v��hH���(6�I�������?��_)���u�Ͷ �����YZD���;C)z��=ܱE�M� P�*7��%����I" Js�ՠU�58ȵ�栲{M ��0�f�+b����xѢ������B2��79����T�t��S��4����`V[Rd�-O�5y9Fok�~)f{�K��d41@S�'�(�[�i[�6ru<�V줸|ԣ��~j[����/�]�*+��_�����NaH<��y�w4��<�46B�� x;�[�a��t���$)wmI��(��R˅h�"i��vA�\����C���!l�Ah�+��d�Y��?@"` ��#<��іXikT��V)n"&r�F�6��9k�rgQ�v�W�6j��p������#�6M��� m�n���k�hD�DѤ��t���ͽ����{���$mɌ���i��o�>G�%�UBfM� �]�����lI��R����oޞl|>�K�`aMۢ��j�lAHU���7;�2�� ���wv�8M胭���Z��)�ob6�|6��j��L��ҭ &���"���<q�{#H4�1�&Y�4�k�g5�i��ny�%�WUV�b���n�p��m�{A������5w%�O]��������1Mϛ��[�c��T��$���B1��g�>�5e��!�
Behavioral task
behavioral1
Sample
loader (1).exe
Resource
win10v2004-20220901-en
General
-
Target
loader (1).exe
-
Size
14.7MB
-
MD5
2e3f78d5dede2cc88e2c94dfc475bd6f
-
SHA1
89f5dc184fe8fda453243aff7bdcdeb8619f231b
-
SHA256
3e0329f1fd4b2ecdce727e4e3e1dc164adf9e56de2e96f9ab40d65a833c0c69e
-
SHA512
152a0da5c459133c92c61eee8f1bfe30e3e8d3fab5c19ad6ec0725887a1ca99a68591b11d8488ddf71040ef347d0ae5fe4ea36bfa32554375770cefde163ba0a
-
SSDEEP
393216:amUKkr4IftWGsnx+4owNRmd0dS+LxS+wW+Ay5:amNk3tMnkwNRRL9b+N5
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
loader (1).exe.exe windows x64
469f6ca5392db1d8d639c359dbdfd1b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32NextW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
shell32
ShellExecuteA
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
imm32
ImmSetCompositionWindow
ws2_32
socket
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 855KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ