�� _ߋ�᱄ mG�.������/"P�u�F���ڭ�Y�I?<\<��*�F>I��g̊.���t�m{������]gꋫs�pUj�np0�@����4,yf�� �8��oW�j�(g`��y��~�dd�����E&������~hZ5��(��ue�!���ŭ{1N��Mt����uO���0wg�b���*^�7r-K� ��,)�.Ĩ��`�8?�0�y9w��8��~~����ӎ۪��\տ�ې�Q��5˘������n��4/�L��k��}L��| ��φ�`����)��3f�Wx3�2jE��J�5�:�>��)�����0'��^��4v-��ښ��b��'��h�YM]����\X�O"w,E��EUJ�"%�?���$�6��� L6R���+c8.�s���p�4G<4�^�xX���QH+{s���#����J?�4Y�I$f���A[JP��1����g�fg�gy�!LT���}>;S��k���g:L�5l#�S�f���Ps_�?s���t�3u:��/�����˽�]~�̌A�9M@J��h��٤Zz���?�z�9���A?a����Z�=��"g�y����@"�\ُ��@Sf�9�繽�:1��uB�8�~���A�J ����U��[�7�7�lX/�8i�y1/a?�����'����I��n���� ѓ䕞W.�8���^�#ԓ!�ib�� ��r*CtmalƳ(��c\˘)j� � ��4�(|ْ��މ$�ߪB��-�������[��ZV�a1t�ДŬ���}���%��jH��_Z���U�ED�� .�0�-5�}�>A�Ylw>U�b����I�W!Y��GF����G�b2�r=���DKwW�T{Ȗ�����BtW*� c�Ysp�7b���mh�n�|���Ń�@��*����%�U;\�{[��Tܳ�cp�E�W�p�E��9��og��P�tG� g�x%y���Aȁ�B�m�_��Ύ��2�l!9�(��1�HC�����6ʻ�����鹢XU��⎓�3��w�������0pT>� �`�B�*��$���UJ����D�!i�,��u6��KM�c�u$}��6�@QR���d��ə���t4[����TΠYԗ���ǽ*D�{�p?��oM��|,�Y���������*&K�l���T�� <3Rp��1x��ϰ 7����iqҳ�UC�T�G�|�P�"��G��M�3c7Hxe����i�.dR��U+ۊ��+��9ۖ/À�+����������x�m�@q(���� ��^�l�q�����]��v28G���̥�,��~���F�o�F=/e3���L�\V���:�f����ӊ�6/�z^%��ҟG��F��G�R�:��X��C�[_lv�$l�E�T/�����ot |e��1��y�Y#��`X���.Ǵ���Z�ϳI���:�����Rh ��MR������ ~������2�����6��~�F�N�ЬX�����<��2h[./��f�����ړ�6ʧvC�P�� >CY*J�xZ��w��������Y����er�p��Gl�]� s_"(*����5z�/2���>Ů��GO�x3��ˀӳXyA+1lA�����e�Sz�;�FyL$,#Zэ�0�ag�-��F"e�Xib�o6��-�dH5�i#U55����q���L?�?���&��td�v���X�g�>�x~p��0?������W������9_Ƞ7s�w����!(`���}M��H��F����JjAH�F�/;,�M�"w��#_i����^^F[����#vzP�E'�5��B������[8��QvC,��VӴ^�����G+�=����=Z@�]��������ɰ�qz� �5�B�K��h�_r�qV%o��pqV��h�����T�D�w}���ɗ ������LC5�F�jt#���H4�3�K�������Ț�:���2�aV�}���5�Gf��(��u���h6�_pC�ɣ�zPchڎ�?Q�\����pʻ+ ^lL2�d1���?�Q��Q�!YD����Dh.e��,��e��cIn�����k4l�_�m���^q�k����`P�2�䩬�gƝ��~��!RZ�;��J�anI �KI�B��$�W�/���z7צ�#�nݶ�U�����C�Ϲ���$�����M3 a(˻����B����\�{�J�·�������e�8� ����Y1��R��!,����<�Y":e㦪� ����{�����w!"psQ����~���!V�����=���1E�� �O�s 1ki#Ϩ�j���x����|�BF�:X�p~�Q b��j��+T�� O&;\�r��PJ��j�Ay���3`�v�=�r��;n̯�؎�J+U�v���q��Hģ�� �!0m��V�d��`�[�������J��?� ��l;��<6Q���ָ�iu"������^���s�y9��{�L�&fm�^d}U$��[�H�"��@˴g�����@H*���� �Awnle"������d�.$u���u��-��)0�������h=0���N�xg�ǿ �Ō����1X"'=�� ��Mk��z`�ĩY�����1���+�4��7��md��0M����P��]4�����=0�&�5���bB�9{�2D�z|�7���f Dv�4h�t8���QČ8�����w�ҙ0���V���J���u|�-��U i���@��f� hR}i$���{���ek��:ou��˘�<��v>�M���06�����/�Q&֜X�� ƾ����?�ʔ��G�w�mg��>R]�X���=�Ұ�]oؠI��|#_��{4�ҁ��$�6"eNi��ھ4r�|N� ¸g-�������TYo�g�����)��!fc(uW�5���}�z�@�e %�ʨ��.�#���6P� �B���0�S�o��)�X�B�S��X/{�u`�\���.u(c��k��ѐ��hs2��@�\���1�������)_E������f�C�↥�܂��Z�K�$��Ij��=�B��0:",t���
Behavioral task
behavioral1
Sample
yxKF76GX87IEWL34.exe
Resource
win10v2004-20230220-en
General
-
Target
yxKF76GX87IEWL34.exe
-
Size
7.4MB
-
MD5
96a1b9fbef28a8f6247a8a21bdc83ac1
-
SHA1
bd3bcc668b449a0d5e5ec81a620ca660572a23ca
-
SHA256
501e96fa3f43f605dcbcc8b47795661a89200dae854654d6f361e7b8cad173b3
-
SHA512
db3a3c62454982d148dc47e330a7afe4dcdc78664480d09548993529302b0d5e42a8849cd63fb39677abf43f4a52a75856808e1e7dc20ca33e6f00a071161c27
-
SSDEEP
196608:FuQE5F0GZyVHZ9MJQFpox8sGAW72xAa3:FNE0Ey2yQx8yW72xA6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource yxKF76GX87IEWL34.exe
Files
-
yxKF76GX87IEWL34.exe.exe windows x64
129953c6cba689f2ee2fa80ef1903be6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LeaveCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowsHookExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
shell32
ShellExecuteA
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
imm32
ImmReleaseContext
d3dcompiler_43
D3DCompile
xinput1_3
ord2
ntdll
RtlVirtualUnwind
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord35
crypt32
CertFreeCertificateChain
ws2_32
ntohl
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sinf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ