��ƀ�꧁>��>�8�As�x���O�|���o-^AA��%@�|����]}W�x��S�E����!#�P�L-�n�L���/���*G��'���la=���� Dё��7u�ZŽ��iDIHx��M9�k�����tb>a�%h�5��~�ז��G�gFX�*�g^ �r��Ht�PL����*�iMK��K�!_����&���w%�ULJܦ>ʦ�̦��ɿ��E6��ؽ����*b+g�,��=R�)��㈹Քlze%�T-©,�^�Je$��]�y���V��6�@~}�J���dzП"m}m�˾7��y�~�PM�r��}���]��[�u�>�3����M��,�� �8�I���SԂt?�Ghns�9�^���hr��H#��>�Dx*�!���?�"�jg�;�>�=�b�>_�]�W�)߆���q��<.����E�|Q���b����$ �,�>d]�����5(~��iH|"Xc�Үk�� 5L��C�5��Q��� ��7�ֵϜ�LU5@�X49� �; ?�6��?������Z�|�T)��<8Xk}*\���bj��Հ&��k߱���"e���eP�֔��*iٌuN���0�Tq`��U����'^s� Y�@/�'��^V�#d�[D��j��q$B�jn���)�e���;~�8�_�N��X݁}����'���~�{�/�u{����m<�9\�_�{N�υF�F�1d5���Ί=��>X���_)u���������!��j�}���~��U�b���N��`>�qT�ER���rE+L�M�dR�j�#`�+*��Ţ��ִ�F1�/�PE`!\W��y��>�n�"9����eNӣ�ղq�>�5�J@4�T�b`��Z��O�ի>qk�gg�<ObL�|e��?�e�E��J��� ��j�`ԑ�Y��rh�Q�IzL*OK�D��V��ȓrk�uQ4��To�� �F�}�����<0�Z�Ӳ_�v':�W��,A�S��k7#_�%�,�� \��l��P���SK��"�a�4�d\FS��xZt�n�z�[�ѳ��� �����+(a~-�hTb'��'�Р�~3��ҧ�ݳ"Gt��a�bߘ1�я*ra�>��l����!LƤ��h�=i0J��9�#g�|���!��$����'c[1��DhY�)�-ؠ03%�#�PN�&"�FL�pX��=�G>�y��������%�+"/�C�ű8�����V�����r��e%x1[�ڸ=o��E"E�%�l}��p~'l Õ� �YBX��V��!<�[�3�Nt|�������ݫVxTAe0�� ����$�i���8MFB��N�+������X��r�6#�9i����Y[���(9�6q�4a[K��w�Tɠt��|�~ȹ��6u'�{����Y�j$� ��u����U����/b��}��=d��4}P�iW�?-���W�����nd ���"��L�pĸ$��,�9�U[�u �1�a�7�<�P6���İ��kӺ�`����j�U���/8���r��(�@M����jC7E���c��ّ���t�Rީ���Z��K��gG���7�����9 ���D2[��}���^g<�`�% ˢ���}ϰ���R�0 %��'k[ap��=�h���oF�B��Q>`�ha�zbI"u#�������E���G���0 � ~xIY3�J��� ��x���"C�;7��o��Ja��Zv���P$K����/�0�l����5��1I7���;PP�����T� Y] bU[��C�q���v�/?����@�Kw�f��>�j�+���������e����0(�1�߮B*Yn�z ��p�:����U!4,����q�X�sFI_<���>���<��j�܌�H��`^yg˞@g�f�ժ�g_��H��bY�|tMomB����>$22�=~���EF� tKyp��R �"�5E���TFt���ym�Ѻ����Q+����o��P���FFe&�w����ʝ䭣��^m����Ъ I<��~��S?�~Rmi���<&z %t��DW͗>_0���������+�X-»CC�2�;��+[+�Q��<�W�G��%���Vޒ��Ҫ%؆9�����%WC�K���%�ڧ�P�t�"���8�e+�����t��\Ww� � ���~� 2n�@W�|�DߘZb纑���b�_���b��&i9�O[_[h���PEGs�s���J��/ ��\����0�!,�O)#���1��\$K��n����0�e�Z���.[7r�k��؞@V�ؼ?��Ѐۡ[-�[G���'�\8�h��*�{ʡ�f�k�S '���tA�hC;�U ���)��(�w��B[����I訍������gF�ޭ#C�M�A��靏�g�ז�ā3Uʆ��L W�=�Dݤ����tP�N���l���$�G`�1 �k�x��J`B��n�����k��ޒ���<��\��s����tx� (��.��#����i��B��6��ם�Z�� �#r�p��Br`N���X�H��x�>2�[�۷�5_ܻ�ǜQ�+��H����� ��_�2}r�:��1P���=�]y>�kt�~�BAO��ˏ�[��A{���h�,ʼn,_�_s�=a�.���Ye x���[�]���^7l�a9�ْ�m��>֊$ ��~+�ONA Ƀ`�di��>���@�t�]k�"�u��z�0H�Ժ������5n��Dv��4�,���!O���`�#��?��8��X���48�VL7eC���}�P����J'���n����g-������(���,2P�":�y�x�ls�2�f�����Ċ7���h��)�D�A��Wg��d�U�j*���C�9w�%��6������/�������M�� �V� , ЅB�����u4���wf�碠;%�=�V��� �n�!?nj*''�ƌx�����~T�#/*Y<#�A�R�/��@#�����@UkE�*���ٚۂ�gI5|����)��Y�%͵E5�d!H�#�()�dL5�U�0�O�4�R�� L���ۨPl�~i|$���� jm
Static task
static1
Behavioral task
behavioral1
Sample
loader.vmp.exe
Resource
win10-20230220-en
General
-
Target
loader.vmp.exe
-
Size
6.5MB
-
MD5
1bd1f56bca95f7b1153564cb13257b47
-
SHA1
2ff609f8e1f2c0a59c91360f0005d0ef31e48364
-
SHA256
d61ab24244f5998b81ee05fb60d53057e02e1df2065d126e8bef7ec4cf427862
-
SHA512
0d58796e0bd1a784e522b628cf6165fd7b911b3dddd349a2ad88cdf5ea4bc800207c4cd4147134b9a017d2615c738bd94551883c6e04322b7df2cd9736be6eb2
-
SSDEEP
98304:eo6vKTJhOxBX17298qlAISz19WJChK7UPMRGwDm/Bo04+kVuCWaLn89U:eo6yl07X17XVz1ThK7UPMRBDSbULn8
Malware Config
Signatures
Files
-
loader.vmp.exe.exe windows x64
0ddf13a3b80317fe0a29d333f20a8807
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
GetTokenInformation
kernel32
GetTempPathW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetFocus
CharUpperBuffW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
imm32
ImmReleaseContext
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
userenv
UnloadUserProfile
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
urlmon
URLDownloadToFileA
ntdll
RtlCaptureContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-math-l1-1-0
sqrtf
bcrypt
BCryptGenRandom
normaliz
IdnToAscii
ws2_32
listen
wldap32
ord143
crypt32
CertGetNameStringA
Exports
Exports
Sections
.text Size: - Virtual size: 779KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gSL Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.E?j Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Oq& Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ