��U�� @�8�˷3����K8=y� �,�4���4Y�:O"�^&������TI˕�w+5�����t�|��h�^:?e�Ĉ�?{Wz�U���ɍ��K!J�����ȡN��W��� f�u��)C��=G�B�� �Ѽ�,@��S��6��R�89�u'�^��:�GR��l>�0�N44�#NJ����jWu6�3��)���*���N��q��U��C5��D�U�u�������:��/U��5o*�<UO��n�#ʖ2IQh�m�~�U��akX։$Q�^F�L,��� R��7ڸfݚ�3��fp���D�6�����&X,�H� ����6�y#�'C��D�E��P8]ќ����t�1M11vKD�t-^sǚUa�ci�&����wzcE,xi8�V�?��zL�jXH���R0�R��Gg�m*[#(�_G�X��YJ�V>mڀZ��!����ܰ�X6�Yߴfa��6�,-�!+1C�� Y���1��n�<4��\�(��H� ~,ʮR��O����5V���݀�r��� ��h��叄�d��E�B]�4��� ����/��Ju5&6����?j��[)R� M9 f�T���0��^�5hA���04�%���L$������j۹O����Ld����i�y���<�qw����|�ۤ��z��Bƀ"����L��͎.���Ȱ�$�)s���b²��jtF�'c5Fu�6�&��Of� ����҉��(�2�I���S{�Z�^EufE����RVB� ���5�<�n,��ƅ�uVL<�v�|;�ڷ��6��-0KG�5���8:���w���=e�� r��.žG���~߁oݦ�������0�j+��3�'�F"�{���j��bM��ۘ��67?|�v�QD������R�Q_B��{�����r�`��m*@b���:���_+��p�ƽ�3��t����J�)-�������ov�u��.���sj�^`۱�W���|Ϗ�5��R4{�GL'.����:ߓ8�njSqoOۢ��;$v�V�EY��n�0ta��it~�.w��d����]*�&�-a��l�$�x(,��h��G�!��q�?� g%Aej���6cxބfu_����6m���j߂X��I˚���}j2�{i�4��hQ����Z[zͲZF�\�BI�к��QG!q���2� s���� �1G�6��և_'?������qV^<��,q!9bWvI7���o�lj'σ%̡ 5r-�&���B�"Md�f�����;���(W�����w�9����D�P�����=[�ʉ��Zc��ڙ�0��<�i���"ҙ W��v�I�l|�8��1���nb}�y/��z%�_$SxM���P��p�j0�����~�D���#�Fv�"v�1mк��,m��ON�|����-������;jh1ɿʉ[�Q&%�~�����D�ɡ�6y���Z4C�yžx�:/eԫl���ғeF> BZQ���e�srL����b �����:PQ|X+4���F�B���;f��!��yzSઁ�A�ȷ?��sb������,>c�I����Fq{���V�_���yz��84~!��l����=�zL����]�KP�]F�����foG.����Cw@��e����^�0�}Fq��c�É!=#L�_��; [�]x����M� ��6�8���v�kk�`~�@`� ��`V峗�ū��啚dp�*�X8/�����u�N�_,cѓ_��X��C�J\����k�"/6��@���è9�Pz�<����;*���/.�n��>�a\�hGZ\�ܞp}��`����~N�zf�����^Bj�w�V:��8:.����P\��fK�!ʴa"6IkZ�!�M�g~��6�����Y<�F����j�*�����q����6A�G����F�$"4E4V]I`��#w�$G��I]xdj���K��:���*�#=O:�Oĥ������������{�2�D\���<�};k�S�*YJO��}�j:8Z��ɕÄ�����8_��.#[�끺���l(X��MgϨ�̾�" �$�������܄^[��S��w[ֺ����� {����mC��W憰�O#1h��#^�x��p��ʾP7Cg4'y�y&����� X�gn�mŎ#!�ބiZ�n!(X���q0���� u,�5�P��L� VC��n��j��P��k��١��d��4�n���� �k^4=�hqʳ���"��e8Xĕ������*��x녇M���=8����{�QZƻ�i;Ĭ-�ڽ�yD����H��Iǻ����2�!�v�;,#�X�ߟ�r����پ��T{�cU��*�Q"UBb�9�讞�ޫ����Z`:ѥ����u�d�c50�[�+�ELKKb^O��$���,K?�C����{��y ��=2� ���7p;onV�M�x1e(G�gش/捴��_iϠ�ے�V���q��N�0!���������/ފeJT����;_�{���`��M�o�7Q���������a]�Y��;�ᕃ^��������.U|��!#�ږ`(�ƤY%��&�Am�D��.G\�f�F|1�ئ%���I*an1^,lf�MϚ�}@;��"�v���ό�(�dJ��DN\�c��B�2��� �ɾӷ�����TH�Ѵ�*��r�=<����w/>��&\��{�nЄ 7?ۇh&aI�0Cm(�� � ��Dz�a2Y��Lz���b�l�bǰ\c��S��x���\�Kn��IH�@��(y�i7����c����,]��z�ڥ��<���� sV��KވGU �#�^��*��><���� �iB���ɰ�z4��������~ v�q�-�f-g��_�R�8C�:_3�z�g�4UC�b�A|`��Bm B�>����� ���x��VVNĵa�%Pa9{Q����3�@���O9˙�4]�E�f~Z6dL}���X�$[)T����EO�m��������:�9��7��pM�H\�=�4��|����C�<��y�����T�mm�"dR��d��h�]�n��F-�EԊ`�y� !
Behavioral task
behavioral1
Sample
crack2.bak.exe
Resource
win7-20230220-en
General
-
Target
crack2.bak.exe
-
Size
9.1MB
-
MD5
14df17d97513bea05352094ef681b763
-
SHA1
42595923ffd077b3c7c1c19ed9c288a10b7d794c
-
SHA256
e04f3a086b5edd75085a6526247346d3f8b69c07e05b93cb5f14d494255c4dc0
-
SHA512
4f37fea13b1937c315bd98df9ecc0db318b909f10cd24c3a8c5b5369d0322912ab7a669cf3c0c21724ce0d9b448180c157557b38a519f59a9cc26d49d50cd711
-
SSDEEP
196608:TtVTiiPUVQA59eeb7tX9T4TYQ3/pSxjanQ6efdUv39huy6Qdk8wVez:/TH2DtNT4TxRSxjGi4NoKdhVz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource crack2.bak.exe
Files
-
crack2.bak.exe.exe windows x64
2e94efa8721780d16bef6f247a11963d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msvcrt
malloc
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ