�OIO�����'m[ov.$� ���BǠ͏�*�+��� �vZH/4S����5���P�����qC������XiD�������i�GZ ��t��]���=Ј�~A]�q�#�x� +*X������#���Zs^����ulG��7��ܐ���W�,��:b�G���ׯ�T��d�W��2/~��& i�# �Cl��]�a��!(�xRi�P��S,@ ��?E���s�8~�ud�n������F��DSgq�E��SV�qB�r�x�x�4�����o��� ���Qh��:�F�]�2p(w��:4��^�������N]ȓ\X&��b�$���י~9*Zg�i��l���Zvc��CX��2�d�q�����ȫ�"�BLީ>`�Y��&ŀ'�%�>��O�X0Y`Q�=�|]�K�������`���:�C1����R1�R��3~����m��5:�G�g�n��#�]?�h�� ���E�������A5�f��w֤u!�x,�ߊ^?Q�A���s��5�PՔ���T ����8t �D��qM9F:�zI�� ���/oOM@��'�����cřMn�M<���ȧ��^��3z� �6 ������0EajA�Y��^8�-��v7��5�i����Oo È�����x��-h��^f'N, V9k�'h/�� ��PA��w ��I�U>��#_0�b�j�+�e^)n��ͪ���%�l�g�/#:ZFנ�c1_'YjAco�Id�#&/�����+���>�5��P����D�8E����c�����ͯPǂ���˞?��xE\�ME�.W��s�V����Y�Hrx6�77r*���d{���a�� �5;�>�sk~an� �S]l���P?7��eܖ�X��W���Z͡��5�_VNS��4/0ʹ�-�0'�3�:�Q}���K���AU� w�/R�9�a�Ս����%��)ODxf� V������WU��8�͖�4B��p�){�Yo�@ -���|�i7�lq�Яp�(�D����� Z�aA��r�\��y?�@i��DK��D�Y�PvZ+���,� ��O�W���\��v���.�$q�wc���l��s˿����+�)����A뎬���&sL���А#Yyp��l��������u{�O{^"���C���w����Nc�9���C�����"����{�,���"�H���y�;���˼��ʅ�_�����^�'|���X�{��-�����6�r;�7�囊���kD��g��%��H���hì�G;]�i��&�hW���p�����$c�q��(���4$����?��B8~k��r�C�N��E���Zo7�9.��A���P�~0C��1�9��2�3�_��Q��b�i�����j��x\M�R�\b�RN���:Xz� .��+)��.X�(͌���� ����b�vJ��,�5�L�ьW�N��r�n$�m4@/ڎ���59��+�,k� �����{j)t\ ה���mޮ��2@�C�����"�h6�!J˂�;{{�X����E~�����B7���\V����m��� 宍 ��6���Nl#o�gil�k3�ް���u8Պ��زr��*;�ȥ�W�ݯ���8z�J��ק���w?���|(/����g�Ȭ�$��˹�T�%�Х�6�F9��լ[����ϲ9��� �����������m&�0^��5Y�k:�0n�h,�;ƈ�HC�9�"A1J�l:)T�\=/��3�4n�I��qY�T�Jw0&�����r�_�=�~4��#-*���<�����0� :���:P8������O;\�~�R#�s�j'�r�˓�fQ�T�tDZ�����'������������:�4�։ό�%�L���vq��#�4�I�~�M��0B'��W�K����ɂ�s��J�ي��S=���c�� ��,��[t�*�Ʌ�o�J{��]�5��ΚŻɇ+�����:���^������M���~𧘄D�f�p������'�`�d����Dhk�U$��z�<����D9���p8H�S�Dѷ�c�RUM�p���j&����}ʓ`�z����U����>��@��kR/S�����r�6��Lg����dɟ�K$����h�n��|�����Iұ���A09IS�˰�a+4��W�o�����7/'$������N�K.�b�H^���4@��P�4�.d,0`���|�a���kNV� �!���G�)���d������zM�n×���i�Vj�� t���VQ�W�3���A��0�W��8;���'4Dzf���]I�m��b6�m�n�Z��X�p�fYh� ���>��å�ٚ� ~�c������B����`���>R����:s ��j{Mf(�c94�+�]G�j�Z�G����-�ێ���F����ц��RQ5$����W�*ɤK��{B��x�}a <�!P���GDET�^�5�G Z� �&��h��[Z��*0��Dh� 62w'o�?��a!��,�QiH"`�y��&j�����d9fΨ�5W�+�������������7M{��@N���-�U>H�r�ʂ���aȰ#�*�����QDk<�d0��ɾY�������6xuP㝭����%�X}�RI�W�Q��Uݔ ��%Y�B���+�'C�h�[1�#�=���b�����]61}�2S��+�Y�5��� �.���#�1EQ�Pp� �#��H&m���F���)3\�� ���q��4�=�z!���z��1όG��w��NR#���p:�(�ܼ��/C�z��Lr,�iܵ9W:��;I�{<��L��q���X+E��I+�0ԵP]U?��>�[�]��?]YV�T���\�>e7<��E�ߊ�p�W�����NT��70y$n�j3�"��E5H��Ĭ�J�vlٮ��~nS�*O� �ܺ@Z���v��Ye���xߦ� �Ԁ5&��6o�,�t�N V��=��v�Ȉ��O%�?����+U��J�$��iN���[��BC��@`U#]�roĒg�=��J$��`1�� �+�I(f��n�e]�=v���Ub�(
Behavioral task
behavioral1
Sample
7613715b_582b2d9ebc15eadfcf4ef492bbf2e8d1d1cba8a79f83671369e322606d333fdc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7613715b_582b2d9ebc15eadfcf4ef492bbf2e8d1d1cba8a79f83671369e322606d333fdc.exe
Resource
win10v2004-20230220-en
General
-
Target
7613715b_582b2d9ebc15eadfcf4ef492bbf2e8d1d1cba8a79f83671369e322606d333fdc.exe
-
Size
5.5MB
-
MD5
7613715b1d6d7c74fe9fa9e3862fd70c
-
SHA1
b8e269402567aa21512e5d6c879bf76801776168
-
SHA256
582b2d9ebc15eadfcf4ef492bbf2e8d1d1cba8a79f83671369e322606d333fdc
-
SHA512
7b0261eeb90054858467bd8e7e2da5329409c37a83e372b978be7855acc8d4d370a2fdb5d8d9b27e5d97158649d1de8a870abbb30402cf61d611f62376af4455
-
SSDEEP
98304:/hXex1xYDzmHtAmFU4Yfi1MoIjIS0c0tb4qxPA9C3XvWmFYAlaG:/hX+Y7mF8fgoISMNTJ7umeAla
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7613715b_582b2d9ebc15eadfcf4ef492bbf2e8d1d1cba8a79f83671369e322606d333fdc.exe
Files
-
7613715b_582b2d9ebc15eadfcf4ef492bbf2e8d1d1cba8a79f83671369e322606d333fdc.exe.exe windows x64
dd5f110d55128f78a3e3276aee2a512e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerSetConditionMask
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
WindowFromPoint
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
xinput1_3
ord4
imm32
ImmGetContext
d3d9
Direct3DCreate9
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
floorf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 297KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ