��,A��Nt�Yk���]��0��RW�u*(���lL(1��i�������TCΈ�'�W���ff%V/�ߪ��+�#��BI۟*�[ W���輠R��L{�������k�#����K0��v^ �X�9JDx�'\y�W��G~��gL��#op)<��$0�(0q�����E�s���F=!2<^���f�y���4y��h��|����UM�B�G����^����Hx�6�bڲ�O,�Z������{���mU��Z�*�-�B�Yy%|�}�Mi�`�p��a�7�������EA��4�֦�?�5ѕ�U;����y���bN�Ӂ����ҭ�w��*�U"��ɀမu�J�F$��ᴡj_M�l�>Pd=L�w��hSkR��� \��n� M����T�^ݙ>��`іi;��%jQ���A#<b���q�&��D�(�Γ����6"��?��r:���� ��9�����iK�i�"\�_^�yh⽪�����<�џ��y.3PF���ka��G@:f�� ��_zg�$h`������.���`1�����ZW7��(><Q=)��ni%2A@9vGxM[���>�<3ڬ@��R /�� ���n�h��~�NS~��nzG^{0"�+)}0��<�s��u㘱\�w ���R�ʖw?P�~}h��kexGe�� ��_v�P��γ��1]�t; �Y���;���C���_L7���C�o�A<~b%m��d���@c%����~2��lZ� ���g�)���� ��{ ��w�t�]UY�[��CW�h^�6ȞPT�ȉB�C�F��Jb���G��b9�~՝M*#���4+��-K���=����fF�R�E���̻�*�`��D0X�Gn��ݣZ��]k?�.�v�a�J�5Lq�D�7�� �8�w����(R�d�R���\9�Q{������%�����-����@���6k�� E}��H��P�Rf�A�zɵg��=铠�聱�#O���!ӱ� ���A�@��Θ��1h�o eXy�x(�ap�5g��V���A���d���3��Ipf��p��ӈ)�U'Ӵ��u�4]���F�w&e��=�i4�d��X,e��w�:��'��-ZQm��B� Msw�R��ո}�Dﭤ��Tk�g�O��4�)8�3$u�?z` R�:<q�W�ᜠd��s&>h>uHG���S�ŀ&>������wSg1���#����#U���:�z� ��p۽�(����m�º2ACC((G�T)�.k29گ���<F��GCƩ�ƌ�p�{�X!�Y0rj"����ބ��M�?��]N ~a�p⇤����h��.꣤�c�寝:�����P➉�<)�%�st�}72r٭L����Tu��E�{��c�=�$14��PHǠ5Y���d�� s]p�kiB*/�YVa�.�_��©�b[�7�,�!��U�AĖi�7;���ͧ�n;f�B%,��δ'�����|�W�d�儒�W���������Yos�-Kt�V^�M�:�F�V��c�o��4V�O�&�.���G��qf��A�`duw�D����5b��M+@C� z�ƄI��m�t)Pj �W��L�;��_GU=��<�!�-����Ŏ�l�$�1��������@�5�[�7p���s���>��7�rx���w����|�K���B<�᷊A��=,2 Ϙ,��@����։�'"���<t�j,a.*��',�����#d�.��[Ҝ��H�l��t�2��� W�Gs3��oG�fç����g��JW � ����WQN��\������%�4���G,�h�#}���zI���C���<?6'���IcGF�5�/����7�|�-4�mW�P��ڶ�S��t:u�8����trJ)����z�0xS�0�����DYӠ��<>�K�Oޠ�«�ơ�܆�����9��D�l,۠�^j2IS�������5�"! -�����C֔ �I��lGZj~bNc�Er;in�����'!�<�����*�Y8���? Zq"� gr�es]H�[�zԆ1��_�Ȕ|d}o�rUpL`H�~v�#?I� ���8�㼕K~V�.�z�^�iF'dd8qT0D(��9Н�;5����7���z�OFl~��mغ~�f�P��<�:����̆7β��_5�����x�A�!�3�w ��n���m .��#��T�$�[�q���"1�VcA��=9�>�տD���1�������~s���$��dv��5i'i�L4i�����8�^�K�/�a� �������3�u���rZf�`=�ڈ^�@{ͣz���O���g4�{M��Y�)���<�HA�N��"�U���x�~����P�aDBv�a�B�'�z���k���9��J��g�� �4��\`R*���zQ�ǝ?d7��N19�i���d�#r^~��0q~|�ջP������YTk���V���h�G���+��"�]�eH��ڜ#=sU�*�2���i8�`y ����:��[��ږ> y�y�>jɍW<a�# ���ߋ���� @��}�2���8��d����` z��LW:������o�tk�b��Y����i7�]�t���p|:Q�#]8|�?�JW��>�o?~���ƀ��j�HS��{Qz�I�0������!� ��Y�|��Mn>N���1�v/��O���Lsn�4'�#5�4��%h]ߨ���-�z�0�nd���t$l��YW"���O�S�t�ߪ��U?c-t��(�|5J-@z"�{�`W� eK<����qY�ߤF�g@�U���.`�:L}���|a�^`�w�uCy�?� ���(YD�!1�,$�H���5�N:�DxF݇3!}M�koP�i%N�k֗3*gy����gJ�k�A�IȥrM��_��ʜ-H�.�Ur�&��JK1�c��#��å���[��<��)��fH#iH+ ��V����̈��.��������#�U'2�c�ݓ6?�d��"�#
Behavioral task
behavioral1
Sample
wWYjYBAuVCGW.exe
Resource
win10-20230220-en
General
-
Target
wWYjYBAuVCGW.exe
-
Size
5.1MB
-
MD5
18dc34c08c0b048d6df41984ca7eb4c3
-
SHA1
f39ef31b64347a412ac8ff4efd8eba65c085d4ca
-
SHA256
f59e7ee14a105348ce4131f8d86cfa123b0ad22d6a04e090940e275fb6c5e2a5
-
SHA512
0abe18206f445aa19103b6706c9eb8ca11ef31a4c5dd9b081299c5d841a87d3c7f088193e8b18f835d72a38f9bbb5e4012a4cf757c0d4c64aefcc8287d8a38e6
-
SSDEEP
98304:kBTSCd1zS7qeghh+7ixySIy+q0F7pcNfGs0Tt+sc53qqSThxKJw:ETHd1G7JghhTyQ7GsmtjcQJKO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wWYjYBAuVCGW.exe
Files
-
wWYjYBAuVCGW.exe.exe windows x64
6681fe122b7479b54ee2cb5e5919a125
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
BlockInput
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CopySid
shell32
ShellExecuteA
msvcp140
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertGetCertificateChain
ws2_32
getsockname
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
isupper
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ