��,�Z�s�VԮ����D�\#[�GˇN�����V��x9�Fϔ��%~铆�JH1 �᪠��ϐԥ����!�n�Q\�����������iӅ�L�E��T���?�-p����mhƈ��D��?�;���ZS������Ѫ�@�87��u��;�~I��̬��K�;�>Fj��OT�J%�>a���,������+�%���P��GM=m�kң3v'���gj[{YwaT��V{�� p�<��6�xV't6}R���M6J v�;��ua<@멳�6�@��?�|�T�?��x�.(m�*��欠S�HKM.��RHi���{{W&��G�O�ժ=��I��q�p����T{^���j����),���[��]$W.���uWhy�o�ϛ��τ�+H�HA���R�ty��rǙ _���:V^>N����/�9YszX�Ea1��P�.|�!�o80!�k��Z�4v���W� X���Ik�%���H�'A�@,>�NpP�/�j k����̈Ũ�{'Q���h�6��O5;�G�ӕ,��� y[k�1M)YB��<3�y����@�St�g������S��}�Sڽ�w@۲Qj[Me�:��h����^@�V��Vl!:��" �]���q��@���s�(����:�Q1�P�<��r������;s�&��C۸�9�D0l(�ST��}�E���v���%E#hk�ek�"�\Ԧ����3\mA^���dtW��jS��@�2)��En�4�����/��E�ҥ�S���Ifϸ���nLTtL:��=��9��L0T�5��b�Z���B!N�3�b�����2X���>[�m����L04T�~�;x:"����=�|@��|RO�5�nH�����4J}��f��d�.lo\Wg�eC�]��x=���a�c�O�Kz���v� b_�x�Xb��^����!!�f]�|����&^��)�J/���~8��}��EE�w+$6ౘ�"���#96���/|�/P��Z��I� ��C� /0�^\��S$8�$0 ġp�#쿑d�g���}�\�s�+��p_d��h@����V��4����Ln2 �+���v��?�!�e+�\���qX{C���c$�2��ۣ�#���t��� 5M��[�r;6�$�ʭEF# ;��K�Z^��K�#4���N]g�TP5��`%L9~}eJ7�<�M� ���W1���N��7�QBA���|�tG���.��A���PX��&�J��E:��6w�`ru2s�d[uH�nM7��U���� l�I�=Gx5zu���v��lLxjJ��{o�3�1����+��2C3X���� &��Փ��s�[���rN.�i�m�C�L�?5�@\n�.;��Oi�w�l��߆x��j�t��J�\�$GG�2"��y��n$;�|�y;mע6"�!WS����i0��NK�*2 ��e�x�eq�L��(�<L�af �t��$6���gt�#����K�;V����DP���>��܂-��u�L ��Z��2��B�v����XkWEŇ�sB�A��/+�.���{L���i�6�J�g�!v.�3�\�8�0����8�t�Ǐ�H% �#Hޒ��4#�x佴�)��h���U��#�?ͤ�M�k�eh��,C^s�V��Y�i� *E���u�u�̕��1�|8���R���m��I�y�.�6�M�I���G \Gv��F�Ky�Q�|�u�ʆ,��c�����-.��j���"<\]�(){h��p�?vo��n�k��4H�~���x0d��x����4�U�o \!��,@�rN��"=ғW���K��/��E&J ɤ���<Y]�œ�k�� IY��h%��r�gGS��$2� � /�P�4!|U�G{�`�\�C��X��L�i��o��A�u/߾��ر t� ��������RնZ�L���;h��۹Y��[o�A��\� ֥�>�p�� B�К$���I����Da ��-��\b^Ȧ�J��*c���6�,���X,�!��� �QM��W��_��h[Sb`p*� �����eA�<.���Y|�^��K<<��G3�e���s�ˊU�� �O�'i����.kN&W����v��~�畑"p�V�nj�E��\��]i���4�K����d[�u2�gJBz��w���@=�>�`�KjTg���p��W����{��;f�����}��K�;� u/�^�a�DCW�'J Z���s�W�⦠U;�����4�K=�J{��# ]|�.���G�cɂ�7� ;��<J�����+��I��>n�������ˢv��+�����9(o�I��R��z%��Y{�@߹�/.'�D��.���d����$U�I�h�Y�����w�^s��J�Y��5�B>���f��w2�59���X?2��J5͡�3_6Ey$R�b��Ṋ��I��XTݴPc�,���N�xX:�8��q4[�Ud9�ߺ�#2��o�)�R�� �C�z$7���n�ч��k����ty�1�&� i�|�,�B� ���C�l�Wn����L�������J���P�����XrV] l�y�Se����(X�5�6�W'!5������f�C��\��?�ǼB�vu̿Y\1h�/'6�kqf��h@���R$���*Hxj���w�9KwL���[N��k�fHT��X�J���˄2�"����!4��$Y%�� �0O�"|�=�q����i%2�nd#H��w�itD�� ����-�?�x:*r���or�ϰ���'�b����By6H+1�� 7cE�:�����PK�~ ](�����F>��T��;���OYONx��U�5��=fU*�_�TKӆ0a �i*�E�X��k�=�N0"��nT��}*���{��=��`XcM��c~�Ź��2���v��i�f���c%���t܍��c2Ͼ�U�W����T�����$=�C�8f�i�N��O'Bv�q�S��m� �q�����w�(}����$}K��Z�ưBXE�Y)_�f|��~w�����sz��Qڒz;�]u�� /7-Z�wW5bs 2X�����EK��e��
General
-
Target
j.exe
-
Size
5.7MB
-
MD5
417bb98da0b98b34967de1ec30bab93e
-
SHA1
2ea3d9a350c6027ddce2f44937501e73c772c918
-
SHA256
593f50c7237a5d4e50c5dec0772cf0f4c8b4829ba4eaefb4b0b65c1f6f7a1928
-
SHA512
34b3da6cc93f45e2ab63b9e9eb38be2da5e925b54606f8bb3fc2f013fd94ac8e92965ab05d30ad0935f4ff2919e2802cebc41fc1e440870b7cebeabaf89b1f14
-
SSDEEP
98304:Kh04qT9ClS8ECXSCAxL4iVeHAvFyM2FbepJ939fEO/PETrLSFvVgeBom2:g09YlSNxneHAdEaFqSWe5ueyH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource j.exe
Files
-
j.exe.exe windows x64
c198912aaf2145e12561f4f9c581f275
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetStdHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
vcruntime140
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ