������/Po�\�qk-h�_8���)Y�Q�.�6 �2C�!wN�me\�����7쮚tI+���m+���j�TLcڬ�^�%�&�b����vV�J���ۿ�W7k@U]0�L��|yK��=���݈P��sS�h��F�He��K��-J&F6�S�����="0�'��< ��<�����a��д�,yqK�<�Iݒ"%"���*�/�s����݁.�� �O9�6��bD�'���$$��f��w��8���wIc�'^.�j&y~ov�����!��as�@ġ�&����;}���ks%UxXx�ѮT�>��H&�w5<�����`+G:�,�V�)��TY9��@q���^��a��9xR��S��34m���.�Z��s9�:[P����8W9������A]RaB@�lK�kc�|{�� �P ���JL��D!m�zmF���IN� C�7X-y�s�}���2����b$yN��܃8�n<���fv���������L:� ���Y��l� ���8��7�}�92��G.���x�k�o�O��<���Ϸ}_&��*�(�@� ����h�fS�J�飓�ү�`a]���،����,�}��rͦ$�ܟ�5i#�"j����y�n}�ߘ���e A&��,��|��EgDX}��o�L��։��F�G��^�6O��$��T�|[X0#`�q������������ ���w5U�k����nt�=�d����Ӯ�=<5����w�`hA��s�p��~�f���))���wa@_Lutܶ�V '��D �%���Wy��}m�vp�����=Ӿr����{�1�m]d��4~V/�P�Z��;^��0 ���`��{+��J|h{��*�#NA W�5�)��Ri:���'�]3���ty��`��� ���-�th���R^�J���׀�,&r:䋙HN�g��_/TRT�kQL7E��喼�s����Ϳ��Q/���Od�4#�ʼn�jC�t�%�� :���yb�1���{��VGr�d*�ͩs����6�F^����>P`}�����3��p�n3�����P�M ���=L��{���&&�����}E\�aR���&���+�᧵k[�;BBKsF�0�����v�S���{�7k��y���n �����ֆh��Cm�ƫ�h���fs��+������h,2f�J��m��K�(V'��2��.��w�]�� U���M�3�?D�.��w������.Z�s���.�Y�0Q��F�&�L�"��n��|���d<I9먜dd��=�a �Ã/���~Vpcx������^��'�0~u�}����(����VN�妛� 78X�3�"`>Z�?tþ0������$�]ǿ����zU�a �m;��o ���5ߧ�d������9�$W�I��: `�E��JDWo��O�����<�%��� ��y5W6:CFQv�nd�}CS�4���J:����ӌ�S�J�JiqN.m���;�軽|YW�V\��FC�?!�)���î7ȦYQBZ������%֡�����d��T�B��ŭ~$�Tנ�|P�� �H!~�u��]�;T�݃�1]��O�(�����Z�`2�/\hc�۫n����[�x3ıVP�i7�{���pwN �j/����:v�^�_�� �t�D�;d��yGϗA�"ğaՎ&Y�,����@�\��uf1�,�^��w��4�'�&K_��佻�������/.�Tg�(\{E��9%�[��`�FeMj��F' �z�q�=Ľ"�TBܮ��Bh�M1�l��dy'����L��G;���H��!�X}(n� ��X=�dw�%7�U;=�R\ 22��΅�k]��!ny���;���U2T���o�m_R�4w��̚���wx=��%�s4_�;WW���NB�P�Ow��(]v�tJ�O%jίÕ�/�u��ATҎjۢ@�l6�Mo�SD�O�;~��{�n�|P�)�[�?d���5k�?a�'.kO�S�K�:�^QA����ʺ���x����:�p��`�����y:���:�H)ѽ-�kM����`��s��䒋ڽ`����v�tQ9.�ܪ����"�F88���"� �,'���tɋ�ow� �X�1Uܸ���8�'��;�����x���k!�ftf ^���9�Dq���id��K/�^J��,Yj��ц��9l�1�����E�KL��B��DZ,��Wr��F��7|������k���ih�n�jØ�b|�]�;ns�C��J���E�,����О�4kv��h���U�G�_{"�[m{�x2�=q���C�+�N��r^��H��X��楼��fO}|S�:�U����R�l�Z������h�Jֻe��ɽnՐB%����1~y�X���_8�=7j��A�U!�쐄��L���8���mKMV��]yR�5�J^ꌣ(?����anB��X��*��@L���G�"�U�+Kع��\2f����b����nz��IE�G�����9@���W{�K�L����}��Y�A4r^ւɴ��AU0���0j��qUҕN�˶m�ղ-��eh1�F3ntP� Z������̜2k�ef�d6� i�)���R�Y*e\3���NqJȵ�AĈ۠���wk�-��Z*��:�La7Il�c�ys�{��I�ے��Itˆ�>#��=H҆�'Il�������m�>fb�{����z~���_T� ��[�q�C�ϡ+�J�~A���Sft�ܜ��DZ�"��XY��թ���4sּ4�1Z�}��r�G���� �@��rgy�t VO}B9�0u.����ǫ{��2�K4��f�Fg��oR�PZhԽw4)�1�����r����� G�� (���|����ڮ��f���u�T���`�o�5�p�˰9[loi�>���+�4�3H�to3j(�\��:^�i�j��:�l� ��1���>H�I���z�~$�<������8��bk0yk�P�⣥%qc�K�>��[~�F_��к��8]G�H�?8-%]��g�;�e5�D�Od���& ���4���iF�i���,�}}"��
Behavioral task
behavioral1
Sample
Versity.exe
Resource
win10v2004-20230220-en
General
-
Target
Versity.exe
-
Size
6.7MB
-
MD5
5a68b1ec26ff585bf073d5e94000d6be
-
SHA1
9deb0c9b789fdb67310aef4d20b724edc5b91490
-
SHA256
2f044572c74395daea31ae26e8e9b3bceec28522fbaea902146b0f87b0373149
-
SHA512
cba227dc4cf465bdc12e82767eb30d0779eba4172363c6cb07ca025c1b7c71539de539a22406817b4113deaf3b6913ef4908ae77b73d4aa1c6ecb5361f05b402
-
SSDEEP
196608:7julmEz20+qxI1KBRw9ZIpz5zZm0J1XlrWjBp:HAvl+q6113It5x1XC
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
Versity.exe.exe windows x64
6f8741a75b95fa91c1c3a902c8cd470e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertFreeCertificateChain
ws2_32
getpeername
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strncpy
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ