!|�i�iN{�\k����1���1���� �Ѣ�ݲ�`6�>o'�㜆<h����������0���Y2Z������m�P�&�E�0jR���-a9$Z�C��>�����>[ػ;�8?�����/m 4�� ����*��df���K���)���#�����-/���� ���^�<�)+鮢r�:�xlwWX����@W�Y�:V�wVL��B�J��s���ޕ!�N�b���#�.�,p�s��VZ�u�'��*�T؍��5��ܸ�}�d�u�ۂ%Ǜ�0K_ pu�-f?m���W�����6����1^ �� �Q\;����tFd?� �3o �uT,X٤cleP*�1�G$e.�%��\��X:ϵ�.����Ac����f�rVB�P��H�!���s�{g��Ux5bt����Sq��+��������N3�@Q�C�H@ə��@vc���Ё�<:�Y�BGo9!�"("��-rS��Ͻ�č�w�r�V�O74��uat[�NPis~7J����h�3���B��Ĕ}�(z^��r��o�p�� �.�(���2W4��ら� 2�Ns{xV�iS+R���gMʐ���G��J�fS�zX��0Zs[����E\�3-�����e�^������<<k�˅@��b�g{�v|��>h� �*2̽f IG�\=��d�^���N[��:���C&����aUo���}Q��[A�rK=��ٰ�"*�����e�6��D���t�d�.�XZ���+�>����R�u�~�{������\wT� U��.���GI"�4ߞ���ܸ֯�a~��1�}��,G[�f�nŞw�2�B�|�=�=u3�q��7~Kw���>^��z�-L���]qV"�q��rq��A� ߵ.ޗ��y҉�\meCI��������d�V����)k��!#�I�����>r3(�����dz6T_]�8Uy� �3 ���ט�IT����A�F�25y�Nd�U���"Xf��Z�z���S���p�G[������5��f�xJ�: �`3�ғ���#3�Qǿ�CH{���^�I�I-�c�u����� ������Ţ�zU��`�0�;%�Qn�W+� Ԃo&���C��;ö�LE<�_\Xޣ���P�R~�g�;��>INp���,�_�4�to��Jz'�� ��v��3��T-ZJ�I4��%:� &ǽT��1,�-C�Z8C��Ӕ+���*�.)����տ�:���T�5�E�Y�ީ�q�����_cl��?�s���� Ԛ{�J�_�� ,���F��YU\qL��*�b� \��x��̧�@���[?�$0��в0ͻ��tj�aU,��Vȅ�p5���2�?4J��F�y�#�2Є�oE:#��t.���)��Ӧ,��봘����z*�`}w{Wq��z˯�u&Ѳ��,Q,6%[�+�`^ur�$1 Ů���W��L(��2�u��M<�nS�²F@L$.1��}Ɗ��X��v.�y��۟��J[�?��J����a|�� -��3��잉�y�2����gʫ+I�6��Z��2��|�ȥ��oo�7a�����R�sp=Ì�����d����ݦ_��љ�����l��a�/f9:**Y�r��s �(&���,Q��_C�P6���Czv� ����H��*��I�����3�uWE `;kV���Kszp�g3te[��(sCF�J�c*Z8�,~����v����mK_�c�y���^8ᥙ����$��r�G�2��]�d����l��]��9p�-�*-�:���X��b~���a����6��:�C|�������<^(������у�y��o�q��w�R�$�bF�I�A�I�2j�x��:��|��đt�F���Ȩ�=e]�a{Y���@_�l�H^��uL���e�� ��,&Sϛ���5�^� �C��AE�g������� *K�lu롋n�(��0a�m���(�G�M�(W�R�ٗ�,mi���'�}11��,�½Fye!�JV�H+c�ϱ�o0�X=��uߕ�:����߿PLT�D�J�}��wnh�T�<�"�\�x�RLY�m�!�?�y|��k)5��Ч��������e�;���IS�zx*�8X�� ���� �2do�'G��-�$5YA-͙�u����R��Pt2�S���,�ȸy�qqa��'�������k���ޛ�I>g�)�>��Q~ /�kmI�Y3�U�5��NTF]�����k�� n��xj�<@6q8Wʺ���"�~Ak�|y�X��� |��P���3����a���+���㿽OtS�Z(U�� �O���2���v���@����s����4��� �&+�dh��xnV�����y��������� �K�sި���M�n�������0��J����[Po�v�%�_ao[�mf���J�F� �lF:�F��zp��_>n�j���}=�Sj���H��ʋF.�$���1g( �i��!~�� 14��_�����2Ŧ��q>�?:x�QZ���/��ۈ�qKү��ť2���B��yh�t�^�1���W��v8�ƜP YQ #!B�j���� ���S�� 9k^�J���2a��'naRy['4�c��w��z��]iSAh��IqPh[���'<=�p��g�lb&-�x�R��뚀�e��Eۖ�.U+d}�oDxA>s����*&h��.J���6�/[Ӭ2T��b�� �h���_�0�(]3��o�1�����iH�8�@�B�U� M���H�����AT`�w&g��4���nl-�P>���� )�|�N�/('�����F����NOV�z5��_������,�����U@hfLlS�n ���2 3�뒾�݊ma�M.5�5�4b&�M� ���A6^/~��3��GB������m���^2p֍~9B�w�,��,��AL�����a�'��;"x��!*P%�)��z�åu4&�=��d1}]vQD_p�,��t�ח���,u[-fSb��<퓟H�,�p��G Eve��=�J��b����3B����ݮ&Y�o��
Behavioral task
behavioral1
Sample
240b4302_306ef92a9e862d187c890fc88b26b395692e93c2f92eaa6430c5de2177d269c2.exe
Resource
win7-20230220-en
General
-
Target
240b4302_306ef92a9e862d187c890fc88b26b395692e93c2f92eaa6430c5de2177d269c2.exe
-
Size
5.7MB
-
MD5
240b43029263fe3e631e3dc4f7e16125
-
SHA1
b385049ab4b14e12b352c691fd0939d182a8804d
-
SHA256
306ef92a9e862d187c890fc88b26b395692e93c2f92eaa6430c5de2177d269c2
-
SHA512
c7f9c4bde648b6e5d48e068a6b9898ef93ffdd97e4d4a6c4cceef0ba2280fc2e6e1b10171941d04eb588212532c6645c1b43d808836ef5ef1c7674f683a2567f
-
SSDEEP
98304:j1bGLS/Ly9Z3KA3ntjQf5b+EM/OMiap+106sWu3Rf4RNY4NdH7ZA:ELYWj/lE0j+26sBfIYYZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 240b4302_306ef92a9e862d187c890fc88b26b395692e93c2f92eaa6430c5de2177d269c2.exe
Files
-
240b4302_306ef92a9e862d187c890fc88b26b395692e93c2f92eaa6430c5de2177d269c2.exe.exe windows x64
a561049c58dd1e84d42ded90ce2e6bd6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SleepEx
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
shell32
SHGetFolderPathA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
ntdll
RtlLookupFunctionEntry
shlwapi
SHDeleteKeyA
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertFreeCertificateChain
ws2_32
gethostname
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 468KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ