�XDE!#�?sZ�Vv xTb|Or����$:�YQ��H���\����CyW �<�]fٷ�[��n��ҹ��S��*�4�h/����x�c] ݚ!wO�C��ޡ7�+k��W���50[�ǢŎ��}�.e�S��i��9��y�#�� V�M+�UM̳H{^^mm�Bq��N<�Y�5U6$��Fq�s��7 (�.�`��ʐ;B���@�$C~�#xنj�i�ߎ��LH� �*q/�x�>�䣔�Zq�NU�uط>Ӕō��e��&:������!�*�C��ђ����x�'�E'Es�,]�(����u0���[�Gjq����E��������w��K4ٵ��8�|���9���ΪN?�kV72�gբ�c�M�t����5צ�:�~79�\BI8�C�wn��N|CA�_���1 Z���P`���1�/~7[C���00�$ӣYNf�MWf��ݡE�����|Gr�/I��m $��: ��P�NRJW�n'����SL@.<��okh ]��[�^Hr�V�p/i=�&���gL��u����xg����o~��r�)VS<��Q����V��b�T <�qa�o����/�c-a�v$����� Fr)O��Y��_����tG:�P��o,�÷�I���QM��o��]�� a>��-i�@���Tn��є�ѷ�r�j^?f�̆i����~珟��ZQ��H�����_[��&�~���Uv`��Ʌ�Q���&Ir3�B�o �Z"����k�P�� ��oN�tg��ڛ8Ʀ{����{� !�(q�6�W�!p���Jo]�l7;2�C�NS��`�ji$z���榇��K�'=X�� "��1C�˞�'be�oO�0����k��-[>,F��?�S �3a��_Zl�0��x^Y���a�7j��P�o�uW�����ޅ5�R��\N��p)c���¿}��䊰�!%qe(�_B�:�.^�qZq���&CŲH��Z;�Gݦn\��+ݪH�Uگ`�M���&�tM)dx�U�Aǫ. )�t��$;:2��m��k��3��� Z�ȕ�o��]������w�����}�ci������~��r�9���]V�U!KWM����\:U�w=c�t�Ї P��w���e�h��7���x<�tf�i�Gvn+��ٵ���X3i�/'�_��5]�W����et#dk��9���؇���`�1�Щ�E���E:�z&��f³��'��?�ϙ�_��'/;!�� D%�ӕ��4E �'k _L�R��l��� 4�M�s!��k$:�x1KmL�D�o҂�/K���;5χ��:���sC�P�ҒVd1 E`Em�����#s�s��� ծ�3D�ܙ��DR�x����}2�8}��H�q��|��!�)� Ś�+[(����t�hMD��3�A�*��.,!Ө3FH�ƈ'�#509E��ꏨ-8��:l�w<���E����G"�� �V���������5�lV���b���-�d�E �J�r�BVP����-�Lj� ��m�)��6�5.�v^�z��n���.�r�K� �p.�ר%V�.Áݒ�[�bt�sU�=��d-$�z���g�2Vr� �j_^�!�q� ]�0�y��#D�ҧ�}�=�*��ʢ|�)h�)=�v<u�����]��u+�8@ɣ��g�Hy�K��^����`̰V�h�o rSS��m�4un/ E-B��fK����GfB1��HP����?{IR�h VLRJ-� |j�;�q\�73B�Y$UV]=18��}�����[:�HV\��"��EsĮ�fG�����9-�G,+S*=b�$s��bM����Eq�z�S�i���j���dM#]�o��]>06���3Ȥ?���t���j]�g�y^(F��xx���,K�.���[�I|c?��,|�6Sw���Xx�(����S=���Y��J��D3�G�_y1�ڂ���i����r�>CO�V�i-�G����g�����)o*zN^:?���&���4�9!��J��p�ae�u��c��~m�%�9b�k]���F ���|�L�-FkZnO�� �n�9 [( ����0f<N��w�Ky�+���������X�����������[i��+jWx�˿��a�TTm`��]?�l���/�ü�+�:#�e�yw ���_P���9����H�w�n���T��='B"�_<���3ǿ�=��A)��R`=:Mh��.P���:|وM�>i���{�B�R�� B�X�N�)�1��뱔R$���1��iv���������������oH�~Q�6�����8�gH35X�s��;7�� ��~=x[�\���Tp6tB�Zc����W��ަ����\��[d�B����n�����K����Hl��շ��ԩ5K�+�7��2���L����+��=������1^%Y�W0��� 9B��O}ؘ��i p_t��.։�g&Y��b�M��H<<�0[䵒�����&ũ�#�$��Q<Km�� ΨU�MBC�\�S �f@ /���b�x�Q����À�1";' ����})������&*����Q�`�����.k�g�=1K�kL���dI�7>�Hg�M!��+,��s��P@: ��_�7��7�煄���S�5�&��� �-�u�y�����j�x���(eD�����~j��;��>{��09�D��U��OWLP/N�È���S�˫\%#�Mh������P��ǫ�絇���.��h+�<8�� ���.p�}�H��+�� ��o�m�o^��|{�H�Ĥ��u��n�����u� ��0K߭�l�c.T�W��f�u2@zAg��=�Og_fǷ��&�� 8u������:@pV�Ⱥ�SVeL��Ao����:��c���I��t `�ķX��_��g"�^!�?RM>U�:�ڠ����l7wa>�Pm��"tEI&!T��7�.�櫓q���� \�[�t����`x�T��͙��f��Kɖ:4����6�6���MM�|�_w���'�V�au֙�!�*Q��g�Y�Ҋ�,C�&��q�%��ԁ�Y(i*�N(�t�/����"}q2�G���N5"�0�~�'�Y����
Behavioral task
behavioral1
Sample
3782a3345821bd061bc78fe65791d2c2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3782a3345821bd061bc78fe65791d2c2.exe
Resource
win10v2004-20230220-en
General
-
Target
3782a3345821bd061bc78fe65791d2c2.bin
-
Size
5.2MB
-
MD5
3782a3345821bd061bc78fe65791d2c2
-
SHA1
02a4b4369c9c67a640847ded4bad6a42877b2da9
-
SHA256
e953b06661ce7c37b95f0aa6c19e2b9d4e5488f7873b0eacdef15afca4238217
-
SHA512
d156dbde66aa7808b70947c1c8fb04b14be84b460f43d301e9b93fbdedf6d6aeb408cec0dd27a41b87975b4f22206a57e57b433ed3907e0ff4aba47a0a4c20ef
-
SSDEEP
98304:HJIjw8x38yNHLl13C9auRjxfvcMZtSrybJWwLFIvYeu4KBXVM+6L:HJIjxxVl13aNZvciIWOvEBFMf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3782a3345821bd061bc78fe65791d2c2.bin
Files
-
3782a3345821bd061bc78fe65791d2c2.bin.exe windows x64
123e093fa094033126b81c39709db1a6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
BlockInput
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CopySid
shell32
ShellExecuteA
msvcp140
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertGetCertificateChain
ws2_32
getsockname
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strncmp
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ