��^��R�@�<�$�d�x��� 9h��O�����2�\��ej��f�a|ZK��_��H���f���ך�Ѣ�*�=n ��#��� �'P/qi�h���Wq������o,j<����.1̇��p�8W�\tQj�5NDž��p������l�)�0�cb�0LJ�#X ����<t���f������ç�g�{�AB��Kn �I<DJ�9<5p �j���R��=�1Jm�9/o>�ד8�Vh�sM�d���K�fgC��]���� ���M���t�Pk��|���T�f�i��o��� PK��5��C�� (I�Y�Q�ް�Ѡ�-պUw������U���Ч6S���9���aD�����~뻫z��ց��������Jg�#�}\�'���t$�;U2�l�|��2��SӞï\G0O�D��$"{Ÿ�9��Xi\�p:�F�r �2�:�1�J`B8�X����M����C���zVbϺ�`>���{�L���M-D�A�B��9�=dn* =�u�G��s�qcF ���c�����]r����P+�R�!�^R��)��fNz��բ.A�dF�.u>G����z_X(������p�B���p:�����r���`_��|�CIdv}����P��<B��?[��/p�=�q ��h���Y��g��$�vw��L{}FQ>���`��>1��E�8 �.Zc�h�Sb������L#��X�1xMn�^��T�k?��f�G��U�9�����ewG�R4k�C�T48Zz�Ca� ���Y/BO���]�c����F8�n��w�/]��v��&�*�$b�-ˊV��!��R+���7�����ڊ�S�?�A�x�R6倶?�sl;�C���_V#_ibd0�1�ٟ۱�dp����+����B4/C��[x�7�3�V���7FA~��\� ���6�����!�y}c7�Х�YE~�E����#d&�j��h��ٹ�<��5��f8H��ee��_����ٮ��<lF���;L�u�fj&1�g�����*���6�*^QO��kWl��F���-�vs���a��KE�`���}�E� �m�����8�����ʎ9�Ȇ�r�|�L��LπÖ7���r*pSE,ק&|zP�P��@���8����]�{SɎ��~���mx#�����P<&$Б �_ �)T�����ն���͓�"��S�]ˠ ��Q�w�g^#��ƔW�:�G��v��룏o�M�\��,���&��M�`���YHaC����E�X-t�j5�����IBS�~������Wl.Wdܠi�n���C�(�0vs/�� �.'� �Jz���=T��ߚ��йI8V�xŭW �X���f���Œ������K ke�+\o���D-���I��%�����-�`��N\�.��U�R��B�Ƈ}*�l��S�*�JrT��t$7q#�)�^����M��`5j�H��y��H�>���&��u�6wҝ$w���(��a�����j�;���R��amx��=<��L��]g��K�}R9< ��A������)ͽU&2r,�K�6��uGiN���M���5pYt�+�<�U_�q�s3���ӯ+K��j��x��A�-�2�G�*���_R��3�s��*����5�B��]��ł목*��1k7����,�Q�h�����%��V��n/���=ܑ�����ډ���{Ư���=}Ħn��m��{�]�_��V�T]��O��r�dɮh��d�1�u38���Pݐ���NFͅ�ch�`#��^?������J/���D�=��Y����2w��^��������fF�&fjϿt��.�OSԆ�,�9@[ �G�-N ��k1�Jb ���/�X����WqTܚa��}���*v5ڬ����9�T�8ԡŤ�!ٸzv��㭏�����4���UlyQ��wչ�&"�w� ���p�W6��ܸ��yh� ���(��3w�R��B�E4���r�9�^"�Z�+�� &�4)�b;E���bE|��a:K�����&Q�P�N��9\�,�M�A���?y)7�&��Cw繹r��V%!��ia/�Yw8LS�˨�6�W9"D��5�M�ͨ�<G�Q�3<� �x��B�Cɜ� ��]�6�P�T25y��w�ר���!�H}e{�}���W�����2C�aBb�U��s�0M����O�U�aE>5��_L5�TV�]\j�?>��.�O����b��� G����IL��~��D&�2+�c$�lG#�Gh=�x%���s��γ�k������ylb����X��&P��X*H�R-$���&e����>�jQY�Fa������Q�n�1���0ty�\��뚸� MS+)�) � ����K ^�(p�5���D������|�o7O��vw��1'���>q��89R&.$�|p�8&��|u�J�t��r������i��Wܫ�U���"�k�=��l>����zH�M�YJ���Q�+M��|T��?_�������@(s]��Iw ��Bl�l����7c BQ�p���o���3F Ǻ�@^yA�1guŊ``KB�oW!�g�o��a�꽠����G�������M��]���1�Mz��)c��%��y��f K���U2��Hu�[���H`[z�����l�9RT���[�vB�0g� ���Jԕ�}/�&��NN��>�� ��:��E���+�^���t�ln����Y���I����~��2�����D���ё�^���~���4�tos�� =r���ژH SK"Å��I�� 7E�UL����5���4��:��ܱ��TG�_$c( ���1�8���-��2_e(��62T�3��l]�D��D������w*����]ۓ�7m|������{�����mL�2_�X�o��n�i�1L�>�|��i1j�o��q�?���u?-���'���=�2c�ӱY�&v̈́.|91�1������ѢoO���-�������_pE��'�h��-�NZ�2t#3���i��F���U�
General
-
Target
3D5716DFC5.exe
-
Size
6.6MB
-
MD5
90b56c5c6f0ea69e4545a1964bb6a611
-
SHA1
b110ca2b734bf90272700e10a640fb087d28be90
-
SHA256
270297f90bf2d2cc4b77b943e13061280fd9384d054448bf44a4b731bf714208
-
SHA512
6b78ec1b0285bd6bc87d5e456557fe10a6a0b2b01da59eb18698196b43a2e9766a5b0c031c0dde255d8fd57e59f81f135c2c604965e761d4f566dc1a630ee911
-
SSDEEP
196608:zBV5WhCuSwfukNhVm7PGbhviCEJYwc1eD6pUoohZ:71wxNhVUo6fPD6pUooL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3D5716DFC5.exe
Files
-
3D5716DFC5.exe.exe windows x64
4c6ca1ab1cf8f75ab158d76ad94f9b26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
BlockInput
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExW
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertGetCertificateChain
ws2_32
WSASetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
_gmtime64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ