h#Λ���k'+����5��Բ:��Xd��5r\�-�qgP�t)��/o�����Cu�K�4�as���<-�Ü�/�ׇHW�#:X�hfˣ����AZ'cgH\5�� ���8ܪ� /)5(o<�[�`Hl^��c�n�#��"3�ǿ)��5!K�0z�n��2�1��Ͳ�*&y�w�r�W�+��h���MۀlxTs�B�tс� 8pX��HX[O���NwLw���C��c �y��� ���/��Q��sUD7�`�x #� g^�l+<)-p�UM-�����92��c7�<f�T����!v���>�G�����QXGf �La�y���&��Bn�7=U<��P���Yň�����U�������u��1M�l���DƼ�8��$������4H˄�t�m�H_��r��˟[�!([^i��:z���]a��������v�G�*T&-���x��%��v��]�;���~��cg@��F=���v\�y��l@w����$����۩upm�z� ��Q����I?!�ֱ�6(���K�c��;�����@����+͡ډ�z^��M쬴%e�>۵�|%M���%!7_Wͅ ��2s���ܶ~���f�|�*��?�����=�� g�ͯ5.��Azmd��4ec�g��5�d(�EU�}�_��G��Q+����-��KS��-W_�3����!��l�����e6UM���w��T�DG!,�ԭ ���@c�9ӡ�������zb��x�H$�C�Y��U�<`�M����G��]9h�Pm�'/��.��꿉?�.EzL:�����Ƃq%�aŰ�Y��^��^=��h�h^�̯���z��=0��E(��RŜ-�cXf��~؝�q��+X@ګ�z���Lj�.�e�� m� 3E�9�14�Lv5�1��`�5�o�bw܂Jd��ѭ�h���>5�G�e�������DbM�x�@��'�%Ǥx]f\�>��b����S cz��Y��@�q�v�r��{,@�\��}�{4-5�l�Ȍ�Cu��~Ei�Z�<EY��(Ҿ��X��A &���<;Z'�@Pd��XΥ�ln�&�9��8N�61!ed;^Ԓ��T��K6�6./�"ܞ�7�����$`i��(���M��K���-v��<t b���d�� .2E��\D�y����gɞ����i�N�cr��s���`�Ru������ �i�.��#��e�#�'`)�_ڒZ�b}r��5���]��b�Yh�����mm;@x���sF�;�����u]��t ����j���}q��*2z|$����� �-���}�P� ��m�����^��L�T�CR��Qٱ:��S�O��-��������?#ԧ��o�ys�@�I�ӗ�#])��.���[2�)kOϓ��ZÊg�5A��+Q��Y½�q��s�xF?��ro!��g �|k�վ�������9���y/��c�L�����)���E־jG��X�+����p9����OŊ9!_�nՅ��3P(D@�In���CE�"5��!�Q����'����$7�uP�7xFV�?AW����������o��!o�߀5%u"��. SnQk��#Ѩ���!��_e�����#��_� hN~��x!���M�te�͢a�� �aEꇸ8HϜ�B�六%?YձT�n��JOR���z#��z�4��^ֶ9�$���+ C�t�U'㘗�m���=������PX~���t%!=�|z��Ń4�FZ��☒N�h�G��b���=KaK��3k�����-�h�e����p�K[s�,aS�����0-�hv��q�m=�%7L��M���<��g�.ɟ���4�������1K8�C_|F��=MR��C�P�7¶�S��( 5:��������B%3>U#�v���*36�s]��#5QԖ B^�M�c�:#"���wFVK�� �,�,R�P�#�<�3��U���|"���EAo�(�x���Y{�K�<��ɭ|�k_KD����3�>t����0��M�3���V�}�R�G3�1g�����>�)`j��$��|n����fS[��hI<qs����YPA�f[���"��e�P���0�!շUi���yU��!��ϵ�����2��P���xf��L|�t��A_�G��X&}�N�s$;�A���<��8=x >N�Ө��& �M�B�"�&(a���<Rs*/p����cCșL���4��0�����I�jw�e� f�xVa���H6�W�k�D{Bs������q���>��օ�����l%��T����-.t�rRj7��L��+HV������#-�hhoaԱ����˳@����#�՚�ߥ��M�+����;��Z}��Ϲ��Y�_Op�c���̏/ ��oi�=ZT���~ -|�V���f �G��y��f��-�ƿ���@���DBr|� ���.y�����'��-M����E�j�[u��oE�����@���54�c�B�̸:��;�����ǀZ��[ �� 6�*Z&�<��1�*�a�^1ݟ!-���}!�%���4D�����A�m�J�xD�:H��t�64��#�&��v��4��� ��jA5+�����D���Eh��v�(�ڡ����ُ*��ɗoXm�r��ݨ��4��8�S�8x@㚎1�\�A�,i+��"�avN;�Ush����\��bscff�=q�7�cea{�J����B8�W����͡��n���#�\t�4�qQH)��6cṵ����%Zk�g��9�����(�֒X�Z|������&��F�N����J���`ަ���蕠@�����jE����oa�~����E�����tx0���re=_q�xs#*/�P�wP�aWf8�X��N��S����.ӊ)��u�λ+��1���&t��Z�5���z$��>�����k�թ�^�bh��pS�{�b�jj�C1/F���<<n��=�4�����}4�O��Ոu~N��Q2�`�D��<Y�̐P�e)�G}R�;'IKvZ�y�n�����z�,�SW� �{�y�� ���te���nX|V@��D~A{�ͩ�l*>
Behavioral task
behavioral1
Sample
crack2.exe
Resource
win7-20230220-en
General
-
Target
crack2.exe
-
Size
7.2MB
-
MD5
7f550bd8d4691653bf6409cea54ec42b
-
SHA1
2a5e545774952143f99b9f73e08d11d0bf591600
-
SHA256
84cbbe450bb73f5b4b3b9d553e9cbe088115cafa07cdbcd7f11623c8c71cbec4
-
SHA512
2fcc920f89ae821ffa52b2fac74d2419b386beaf8453b78a0581b0bb7864d9b691fa9f23ba8e186465b4a96155476b8e4be99025c85b7e68b4883225be2ea978
-
SSDEEP
196608:Xz+2LF4GK9pziiQSPzyr+XAbOpwUHW5exQGWQsS:Xz+M4GKritSLy6XSOpJHqeTWQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource crack2.exe
Files
-
crack2.exe.exe windows x64
2e94efa8721780d16bef6f247a11963d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msvcrt
malloc
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 768B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ