�?��y ]ˬTǛ���EeE�/s"-.7�������LǪ�hv�/C�N����@\ :���/��G�"$�Z2xs�5vy�*X��;��㝑F�zEp&5��d�P4�#�K5s�׳+�.�+�R�w=S9�n�Xt�M����h[ �ś-�D��|��f'������W��8��%bC܁TH��w��?�=�tn�v��%��F�Ɋ�����a��8�u�yq α!�V��^!�&,�E��v�d:^e����+N�+X���G��_����%]����^O'���_���Y���tɛ2��T��ޫ��c}E銿�I�L�| -&84�^� nf�Ey��Vx��N㤟�J�K�꒸Ƚ�AO-���kT�p�y�mv&� ��� �1E� @Z�s���?�K�jV�����F���fͪ�W?��{���E��?M ��`dr���c7�>�����˷M��Y�W�1'�u�|!��{k{`��\i�c`�Xzf8�V�����TQ����u�3��;�:H7��qAa�<���F�dx�� W&�p�� �d O 孽��YS}نq�@`K�����r~uq~4����L�!�}q��t��<�������Gɲ��6b;�1!V�M������ħ��l�)�R�� �Ӻ�]����Pk�VjQ�bj���}WeBF�����dE�[ыek����&�1����Xh���-5%��]|� �r��p��RӬ���;�p�G��,�Q�\? JjZ�)�[�ŦC��0�g.+�)���,$��!��Ed�H3�>�n巀�$d�i:�q 7P��GV�9���������(�o�+��_��'�i��?@���Bg ��`�_���F2�!��G�t5h!,+���|�+��u|/nN>F����4�"���W`������֔�r�����k�#������r#����z�w_w#J}N@ ��U�e&���$���MgF�u�H�)뤎X�?N�Xy�9��>kW��(sӵ�JVK��KB�E��Cz�>�;�c��h9$�3c���S����QCx��4�|���G�o�UuV&qX�9�G�R�Ћڌ|3��w*����%� ����U�4.�����W-�H�y���<G>{�FM�{�@���w6M�PB���9:s7o�9�ƽ��4%�NP,Q��u��~T.pׁk%L_�.�o��pW$��AO����\���]_����}��I=.�A˟5��{�h�����Up�� Bb�}�m�Q�<̥��0q�ַj|:iMv�7��SG�R���i�/"�~��φ�I2��i��e�3$sV=Ui�N��<q�ڐaUA��nU�U�Y���F� ��[�O��*i�RkNOc_���y���RrB�6� <j��P;����Q�#�Lo�=���HXR�)�ݒa��$n",;߬H|�?�c1l;�U�������b �8�n�e�O�����=���f�c� �"S��M��D�VT3+cy��;��TN}����}��[��>Z��FPc ,�z2�'%��_����n�g�{B�Pș8���_?<����ɐq�¤��-���~���*bp���b�R�;gry� � �/���4p|��#b3GH����ΪPSl��ɬ0��7���ۡ�+��AB^�-nZ�U`��jcu7�f8�f]�'��ö��?j�5�H��7_$��8hX��,8+���v��V�eϰv�G���#9`��P_�{b�"��&����ί�?Ť-�O�x�������'[�&7 H� E���h*W�d#���3ޥ �����a�=-N# �^��74~936��s�������ŽT<m�\ǽ�{�S�t>L��69�ђ��R:���d�8մ��y� ��J[HChb�۔��聠�/Gj�F���@�=���5����m�1���[��� ��'�����R'#+�g⋙��T!�H<�&��d��7��>^&�'����:����ە汪��#;��Rϖ�7ധ*��}�:X ���*���(�����/RV#��R����O:�Fn~�mK��X���i�h�4�::M표DõKJ�lVS�!������M\�z�7�� 2�Bz�^K�j�#�MK��6�zf'���m,?��m����7��&e`"r{����8�Vf0*�NL� �E�'��u>�IE�mjJ�ԖY�Ȋ:���&T�Ჹ*��i���P*<�WPjEն;f�Qɒ�YsL�0Ķ�U�"t=�e�L� �=&�챢`�1[���twF�;k��UNJ��:|S��(=g/�}��s(����nlD=9���O��� ���N��#s7_O�F~7�w}���L��]�sb�ad�{JC��e��z��IzUSԴ������O7�4���f�������`[9@l�B�N/��ΰ��V�,WZ�����V���� k0666k�yN�F�I�w&����; 'ƪcC<c�r���Ƭ�|2��s��I�sP�̶�$��s�����,ba�;�PU"E�����Ȁ�Tl��qe�cmY�9@���5l�մV����e��[�W�k���?(���v�L:�c��Ł~�ˈs���]�V)��y`V�����T��I�8=!J �nl��?��d\$���B3��ϛ{��D5��_���I�7Й�h&f��K$��۶v�Jƿ�]�z���RrK ��lc��]b�h$E�z�xlB�%?�տT��G�C�,pDH�,�[ES�r�����b��y@��f|E" �-����w���,�B��?Sj�w�n�Fe�'S ��L4���r�,$Z��c{t(K�>a���i�^�����o�&�|�:��,R5��.q�j7�8�L��ؙ)J����=~�<u�2�lT�9�f��ׅ� >aÁ�gv�z���tu�z~.�!���?:zd>�N:�m�=�Or/O�jr��w������cރ"k��Z�>3�Q&:d<h+�)W���oM/u���%�N|��M��+o8���>\�f��s�1�`.GgC����;TL���H ⑯c����6>���G�6�E��o���:ո�6��� ��pa�&ڂgT�+N��K��7��xT��72�
Behavioral task
behavioral1
Sample
1e58ae4751310d5ffbcbe49916a90e69.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1e58ae4751310d5ffbcbe49916a90e69.exe
Resource
win10v2004-20230220-en
General
-
Target
1e58ae4751310d5ffbcbe49916a90e69.bin
-
Size
49.7MB
-
MD5
1e58ae4751310d5ffbcbe49916a90e69
-
SHA1
948c91f62fa6632ef68d5d78be484c726f9f9e32
-
SHA256
04440e82bb2c3b001c7ee7e3b4dc5433a70922ac3532d50a15a93d84a56b9fe5
-
SHA512
d875c4adc95e8cbcd382ab1fae5d77ea39f672925b6db549277cd9a0d7f6360adffd04bd1f64ca27cabebd105d5360b7b504e024c2969ec54adf4086a405978d
-
SSDEEP
1572864:f5XyfdZuxW5uelZVYLEmh3x5BUqG1x+vjmuUL:xifQnYIH5x5BUqAx+bmhL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e58ae4751310d5ffbcbe49916a90e69.bin
Files
-
1e58ae4751310d5ffbcbe49916a90e69.bin.exe windows x64
0a5a1a7f7eef9015ed4493953d22a628
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
TlsAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 47.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 49.4MB - Virtual size: 49.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ