��r�z�m�1���j����䱶F��nxטkܔ,�A���Hȧ]���"�Zh2z���nbˋ��h�%,xI'��]~A�Ov� N�ha,��W9(�'∓�������sۮ<��hi��ϲ+/)�O�8䆤��g2RsQ�C����j���L��x0�/����n������5B��P�=�F����o�&���<�ѽu�������D����'�o*��ilZ]�B���I��3��H��I����u�VR~?N&�N�0��qgBCx����-���:'h�XgZ��#SekM���IWN気�K��z7؛��h@O��τ�5i5`���¹�2���)e���4v��E��!�ds��_��6���a|��0%n[�T٬�D#!0+<?��ض�?�k]�U���U25D'�W���,b�������t�ѧy&,Z�߃��Y�Gc !���?����F�,Q{�SȬ&7$��b#�ې��?4��1�BV �}HIf�͌� ����!�Y�7�LӒ�86|�|f�uKd�� ~�&t8�I|8�-_�x��)����F,r�����z�Ԅc�tYS�Q��� �vb���Kz#}��p?ᕊ&�@�g+��1m��>���'���@a�Nd��iu�'�wsf(�獴� 8W�~���Z��S]��� �a�_WK��Ø=Umߑ|,�ݪ��e|8 j(�����ga�Ur��>>���gl�{qs�g�I�P2O��z� ��gh8����x���)�u��#�ijB��f�Y�f�eJ�,���X�Sp���*4_X˺*��0���M/�`H$O����a�&��Tj��mg�� �����*�xA��-��"����R�Z*�К[�b�W��O���9�%P�U��N����q_b�d�JNj'Ӯ��P�;�� O�U���*+�@D��o9~F)V�Ź��<l�E#+���MQj�I�m�vç���X*6L崡}���"�t���&�B�?}\z�� ��(NW-�K�&�|���c7�=2����9E JV��P E|�� ��ݢ�o���}��<^�,A�"�,���VMq<���=��x{�2��'���"���oԲ�}=�� ��#A~P����u@�a�&�4�L�/Z�k���h�O�PA7�G�v�:�<�h�h��FPC�%Ϋ$��r@��2������q�C\�։��bfg���t��� 4rR ��Ԗ�|��^(�1�L�(Z�KZ2��V�w�o���d�^��x�Y��+�䡫�ῄʲ�I�]�]+���j4|���zGkr>����7�9�,V%�\MG��f�������꺳�.���=�gãh�t�c�u8>�5�-�����H��W76E.$�;�Ėz�MlJ��>��L!,�Vb7Kc�CH�#N��/�ԫu�ɲs��/ν�������Xr*|��IӤaJ�ٺz�n良Ύ-P��jq��n�W/hߩ<�hI���ޯ$zg�q�˃1�]�E:iݬg��O��{3�M��$tg2ц1���X�?���?X��a����9�*H���MgT��i:�:_͖����Y[h�H"�y}V�F�0���$S�ŵ��4�腝����2JE:"��CohD�c/��V&P"�W�K��c���x��jΆ6���f���z�4��#�ݍH �!�S�v�7�Y�} Sqw��]9'ӭg�]��|�nRᯌ5r|��&��tԛ ����#w�� K��q������}R��?ׯ��<��*l|!v7��U$]s ���ҙ����!�5���K-)�����R�$9�<�[,5���jNG1dp;1(�7+Jɍp:`,k��Ȱ4R�Vu$�ʉpq�ڃ?���¥�J���g婣�ѭ����vW�y�C�u��ny��,!��r���&u:�yL���@|��~g��{���y.�kP4�� I&��ry�� }%���pG���w1��B��JeD �s��W�?�,��4=T�f����u���8b�-tܯp4���.�u���z�;<"�>O�\��jW�;R�S��P�+8镵�9�|t�� e��x��T��<�A�ޕ��^Q Z6J���J��^QB&��t�,^v;E����~�� 1t&T��9�4��BB��IUw0&��C��s�i�N���f�Ϭ�FlF� ��CÕs:�3���Q��.�����E�C��F���w����:�sC39�0�5�=Ќ�?n�����=�p�5Cc�����(�ZQ���t��8b!e*������Z;g/kv7�%9-k����|�ָu���s��+wr�RUȖ4�s��S �!�2:c�,���T���{ �U�YV�N��_*�b�w;����F%���%�������a+�McM))��.��GYT��]��2 �.M��C�T��1�$2c����nU�D�O��߀D���9������ vI���~"��{��/N ���%^�"����x���N��܆nk���j���N�e�3g�kc�ȡ ����BX����zgn�@�����{{`��FE} Pۋ�E���2�{��ڋ5iL#ۄ�(uƺՄ2/َ���e����t*Ѡ�b-W�<� K����c2z�HT����9��Z�}�J��r�Ixb��'&�:���� �O��L�� |o�K�8���;:/���'@�<'�p� �vx,2?u�t�iy���\:{5�o�8��M�͜ 9�����vxm��f �1Ɔ�X�&��v��\G�m���r�z�ʭw��G�O�v ��2)�����0��pp����+�������Kc#��b�k��{�@/����#��.���=��-�b���U\3)r����H��,ߐ��w��G0�D��lf��R.C�_��,��σ�e�O�R~��0���8,w�#$Gw�rZ��VY��ac�R�����a�?���p^N{?rs/�[}R}�D$`��@M�-Jڠ��W|w��]6��Ń����-��^*)=� ��#����l�[K���2rf'�L3��*��L��~�$o�5Fh���>Q$�(��nP�3�)�5�}�/���6G�z��d>be=�=�6_��5n3�IK�B��S
Behavioral task
behavioral1
Sample
IvAEGoijbASEGjo.exe
Resource
win10v2004-20221111-en
General
-
Target
IvAEGoijbASEGjo.exe
-
Size
4.8MB
-
MD5
d9b79da11f22ccdb255572afae699563
-
SHA1
0918ecc9efee1b95d002c5c2884f3108e731c302
-
SHA256
2effe116bae12db344d860be05ab14d7f38ea599a7c8bb873477f101d324c5ec
-
SHA512
875711db059d06368c1921ba41fa3cd07b4b376f2badd3a20f2ffa7745b6cb9cd5d738a99baaf107d0f0aaca8ad798ad4ad1d92956f47419690912afab99a20c
-
SSDEEP
98304:P27dEgmm1/tAE0rlxcFv7gV66KQcwzdHdjEtzGOIkXBfKM:+Cg92E6fRwrkHdMSMRff
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
IvAEGoijbASEGjo.exe.exe windows x64
83d34654d587cd0336d37110aa239456
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
urlmon
URLDownloadToFileW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-convert-l1-1-0
mbstowcs
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ