Y�� r�Ԙ!��s@/dz%�۵P����x*EB{)�� �����Q� ��� �Sv���|��mG9�`zm��k`�C�>�p��/#��V�-�T��j.��_ �� ��a���r���t�\M-�{a�}NǽzX��L�Ef�0�҇�3�=b;'�]GkYCg�yt��LX띴n��t['��Usg,��h$9�{\���$v�ہ�C����3%̌�¹fϦ\�q<�����*d�8;Bk��w5N��0�"��$y��!�e"�ْ���(��y��I����M��S"��r�-v������6cЮ�~�]�"��d̤f~�"�����1��]{�iX��!�4�H��F���F��?9p����b78"i0��>i5�M������L�(��X���:�@��������""0�����ƻ������@�9��q�Q��z�DKv��p�,9�0� �� ��l��Z�?�{��mF�f�[��ScA��� E�L.B� %�(��Ƅ.+3��b?���5�W��o�}%E�yp~�`��K8�VI�2YJ@�r!���U�����G���Dz�-T9��uHmfB�tJXE1.cI�y�3p�W����a�w �2*�kvz�!��SR���ճ^z�E27�6�r�s��.�i�\��f�m�hF�v���,�|j�h0#£��Kq����E��Y� ʚn��5��mtV����&�Cj�?��R����@EY���+@���P�o�\M����I'�yŽ�:��_�O�N7�b+LÙ:7�V�h�����a2[�Ik�q�G�F���y,o`�P�EE��t�a�{����l�"V�d%)���g�H��r٬"����j�Q2����=�=���"��C{|}��ֳf���V�'��`ɑ-ơ��v���q�$*�N�� �V�V�� .��!+ � E��(}z��������{�HC��}��O^:��'|� q���s��'�l�0�D%E*����P$(˃��l}7�Ҧ�\xUn��[��qT�艁"�m[Z�����}��db��?�F������X������EL���q��ܲM\�0l�ôJ�.��5�X�A'/��m�)�G"mք+�"賿� �Fu��6B�?�:���S`�;�%=s?d8 YP�f�nX����$�w�N�5��w��������Ye��vO���c�n xs��S���/�����M�d.tw���W&1́ �A���'�����>U�=��5�%�6����^���/ΘΙ> e��|�&�P�y�����2��z>O1��_9C�z��W� $U���ih;�+����m��YJ�`��\Z5-RG�I� �g��]����n�����\�!'Gq0P�m���^?6�Gt�ICL��2��������1� �V+DxE�S��� =�!i��z1`��s�kp������k�2��4t�-N����{-�К��� U.ʈ����E���ͨyG4��Kb�m4HlT���s���MZ�� �g�! ��[�g��Y�� O�W�[� �I�Ô�*oo�NX���2.�B&N9��4]=�h(���f=Ӡ؝������l|�{q����.)��-R�_S#q�hLz�C�`QKl�~�J��@t���Y��1P���DH�k��Cd�]�rI�+���}0:�5��R�,]�Ce�ʫ*���] d>�����n7���H@xYh<�~�����*k��JWQ���7Ԡ ?��X9��p�0O����>������$��`��gb{�=U�X�����pQ�����X���g�^�R]���[Fڽ��Dzo*�*]�@L�/�x=VR��9��B��������Z1^�MT���[���k�Fs��|�%!�����EijF�Y{��K����6���c�79�L���b�Ԑ4ٓ�a�Rr%�yj?Γ��� �J��Z:Z{�q$S@��t>�&m��+?���q�5�9s���5e�� ���)[��H�5j�c� 5�!^��g4�c�^���$����ȧq+͆�����a%�jh`��+ӫIt��^��)���WO���wy��E�+<��Ԓ�(�����f��� ����u��Gh�ggJ"���\�%(��Y���ꓚ��� �^�$��OÃ�]O�>�N�*�{ ���|s��(���B�����"jЋV� �8���E��(�"���7�p��I�<t~�ޫ����1�ɨ�~�;w0���C��r|!gą2���k����|�+FC6�+�B���� J^z��mV.�;D��aw������ze5���a`�^¦�̕7i5z���v.}��{��E�Y+S��5&C ��'5���s�\5:b`��A��!n �h��tܑ��W9�T�sD��C�l��(NzI����V$:���ׯ����h�(cJ`���x�{�\��3y#��x��K`��`�.c���]�����b�V,3�+y�'�?�#�详�&k�ɹ�D�?�P���>��kL;�ݚ��_���kZ(����T�ɇ?�[����"[ ػD�e���hc&�I�ݽ̙����8��'N!��~a)�¥-kL�����ٞO8��8�u��n� GxC1�˒Ԉ�!��}y���eH�x�4��!�m=0"H Y���?�s�_����,��h��ƈ(¿�}��jd��5�\�}��T'�k�,H�M)�_�O9���H��(&�[bۓIs&��Ne\FfT�l�O�p�loɊf|fd9Zq[�-d�3�(k�b�0���2U$���*�\���"+���d�����6�i���۔�%<��d����-p����� �0��WZ�s^1���s-�3�4���*�T��!W,���r���B�q����O��Xo�U��ĥ��� ˃�������V������gAFJZ |�0�e����~�d��x�M=��g)v�H�k����s���������M\Y�8ih��c'\��&$=��[aL���� &o�eZ,��+���>"��B��[�@�3\ �=a���)7� ,m��+�U��2����^I�U!nq_��JӸ��W����I��(��t����'A��y��G��p��s�L(E
Behavioral task
behavioral1
Sample
ce42e05196257610e5fe6b915338189a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ce42e05196257610e5fe6b915338189a.exe
Resource
win10v2004-20230220-en
General
-
Target
ce42e05196257610e5fe6b915338189a.bin
-
Size
4.2MB
-
MD5
ce42e05196257610e5fe6b915338189a
-
SHA1
8d698e7ea79fcb1a42f1dfb276351ada5a2deeb7
-
SHA256
d0398da9aa77ba9110b2807088e4ca964cf375caf35754847f13c57f3e8086a6
-
SHA512
dac6224dd70ee6a79df322f36a3a6f0c982e8556693498f27b9a1c9768bb8871476f4df93543eda58018a09557941c8d5e5b3fce03e6ca7daffcafca8648498c
-
SSDEEP
98304:m9ZvXBPspsDPp0oCx2+qfKG1E2Mtq8DPU3ptRrbjwasSg/0sa:m7NsKDRS4+gKq/0bU/pbjwD5q
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce42e05196257610e5fe6b915338189a.bin
Files
-
ce42e05196257610e5fe6b915338189a.bin.exe windows x64
25e42b3fd07bf915ea25e93ec2977835
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapReAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
htons
crypt32
CryptUnprotectMemory
advapi32
RegCreateKeyA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ntdll
RtlCaptureContext
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 451KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 333KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ