��@$!�vJ���t�g6�(�� 1 S��"W=`}��2� �"����J���-ll��[�!n X�7$z�)�N��`˪f2t��J,�Re�ePO#������|��vQ��!���*9� ���e5qq���?g��D�.\Q�[�$H�J$fQ����q�f���k�2n��8orY�q��l��;~s����eG\��=N�#9X�[su������iq ��.0��L��tQ�A�f���;�p����F� ���m�9�~����U��07 ssZ��⬵af�͍7g�*2#yo \��� t�C���3���o7~A �9��$k�� ��N���l-����n1 �N���P������P� �y4���t��@��[!p�S����غPh����UR�+$Lc��=�twn��a�F�Rt<�l�n�;� �A�H�p���'��$uV��Fk��ߔ��[l���_��hn��r�W��ޟ>u6����L K��0`���NOFn#�Ad*|R�`�Ԍ��1f������B�؎��+X��������k��:L��~��mB���\��T��nܷ�������ɣ�|�#����x��0!�\���F8����$� o��iEW���/�~e��~'J!U��ɰ���)D�<���b�;�R��5z���������=Zdr ��Ɍ�����M��Y��������t3��3���G�h�d)�O�W���d��7`C�?�� ㆳ��|�ߓ���U��x?�� ���QF�p$���9�=j'� t����Ev�VÔ�n)w@~�'�<��JrPE���\P���@F+E�KM��F�Ȇe�]<��R���t� ���G���SQ�g��PL�q 6&��蕏�K���F�晾� ��� �yz��}�_�!WCi=��$>��5����q��iL�(hHǠ:�%�!�5�I�Ɵ��������B�j����l��-��ەK3 �|̖�g葭�%�Ao�yqd��4�hj��.��`a��ğ.��ק���s�/�缃��8�4v] P'�uB�H��]G�79�X$ �-� 55��.�iӑ��� M���v������������_�r�F��W��◨�#�8p����(�9�A�ُ��<)���h���ٜg5Ύ�0sUW1{ z��Fܝk �pL�5���/�x"��ڛ�~f�t�\��"f�tAN�����pIsS�v�xHD0:��w�����R l������t���BK�Y����G(��L&���(��� �}K�09� /�X��U$�ةu_�we��H��b��������J�mWnP��H�N�X�T�B��~<B�w��i��u�^�8�6""��(���bpw�<���{M�C�/z�>��?C`fݬ�C�vno��+��f��y�Ct���ɼ�۽�2{c.2�Y�\�Y$���m I?%w!:�m�)@�1�զ�y,�������@w�Ɗuk$�i/��+�^�;�T}�կ�� ��x���T��L�.^�䦄 �?E��7�y�3�,��CK�p�-%�LAQ�=�=���=��Ki@*aޝ��Ru���_��S��;���LUbRDLzE uI��F����u��߷C8��S��hz{��һ����Qq� �ߪ���V��!�^KJ̘�"/�<�@��Z�ބ�S�V/t!�oE�n�u;��-2k��U��J����L�;�� >��!�<vSYؒDM�*�Y��}ѝ�Hn:������4& �'ɘ��ޙT����Rcx�RH�Dké]Ǘ��^D�� mJ���jnw���h��TC�vc�G_��u.��Pr}��Ί$`��_�����N��E]k�����g��Ɛ�m���Ov��Z��U�W��UY�s]���r8Ȋ�P"+�����@��aK���sL���a;��������o�r��G�8%���x�A���xi��Ë%��=T��(|�S?��j��|��vh��I/N���O8پc]�P����[�;�;i�t�8�x��в�Q�7�qA�pT�;�u��d���R56�bvM�"���ZW�ǀ����A���&8��S2*���cB��h>l^.5Na����\oe����������"�%���s!���Y��l�(�7#v��6ux�z}oc������W���P2.��DM{�M��y�.!CA`���~^���Rٱ��A��j˸zܷ�M|T������NF�:Y�*���·8 �-�b�0�i��rw����P?Y��s�&��cVK��>�Ż���C���pdw\����N�R'#��bA�jA���k�L�kf�p��qQ�(�A� 26LjȢ�(9�d�q�I��q$���50�~9��!� ����H��Z��N�n��� ��m�!�t���u���m� C4���.cd�;8rǾ0�6��.��`���*X�1>���:�S[�UH�L>�o��U��M����*X��\?t¸p� �@�;�!����Ü��R��CԎ�+p�F��٠����K��ժ��u�$O�!���é�x��Z���z�$�&�տ�R�������]���JMc�T�T�A\����2`�g�;&Wr����!���������N �E�6\�P����7�umL���āBѻ��[j�b�|QԒ�n')A�~��3D<���<��Ŋ��C@�MQ i�_��k!4P��cY�!�D��z�HY���/Sȃ�H�L?������.��E��0� ���~�n��7p]?��J�e�ع��ކ���`9/lC�i��W!*G=Q�h��ZL�T�ɓ��XϹ?��>k�RQ<��3�AZ`�{)m��T6f�(��@��`p��%�� gX>"+Mg2y��d�:�Oa>s1�JD ��*��y�����z�e�����o��:�IWq7Hn'���v'�ǟ����2�t�Y^��D.]]�,g��T,D P� ��G}��W�O�ڇyb� �'��:��<n����Q��ꩈ�rS|�5��p��M��pc(h�eN��L�H�!Qy\T�X���$�f�n���kO�
Behavioral task
behavioral1
Sample
OverflowGTAG.exe
Resource
win10v2004-20230220-en
General
-
Target
OverflowGTAG.exe
-
Size
5.3MB
-
MD5
fc031ee7e73091dbed201e90223cac8c
-
SHA1
23195d065e5c6d3af0bdddf74ff5bba169b2b405
-
SHA256
ab7d45c44b93f180777ee5cb599b5384be3648635d7c6477b2cc5cd6ecf692ba
-
SHA512
75d8375f8a769aa57cf2d2428adb9e596b73f4d94ed1dfffa7349886c5e84c842bbb3c25b4c8725abdaa5f22928dfef2fded31944c47be53e1988c6aaf8a5222
-
SSDEEP
98304:KTg2nBTPVDdPqUAmJwbMycQJY3vBPfayeXHSJHbx+uKYJhv6MnIRyarmKOUxI7QN:k5BTPVDdqUApvJYNfeXSJ7aYJhv6gNa/
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
OverflowGTAG.exe.exe windows x64
b626520604be389b7cf4ad83eb0f3736
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptGenRandom
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
shlwapi
ord215
imagehlp
ImageNtHeader
wintrust
WinVerifyTrust
imm32
ImmSetCompositionWindow
d3d9
Direct3DCreate9
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertGetCertificateChain
ws2_32
gethostname
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-stdio-l1-1-0
setvbuf
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_gmtime64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 707KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ