fp���t�^& ���ߨ����x���I ������AX�d�u�m��.t9�명��� }�S�a�s�D`H��<B���'x�-��@j*S�N���u �O���6&�\�BNUA0�oj<w�ү9DUV �*������/BʬDŽĔ�M��RR�d�ȁ�MA�`S5s��.��� 4OkQ}�{;{���H�\g��d��[p|$�Q ��'_�Έ�j���Ҿ��K���ۉ)Ʃ��p�����|� zED������㸽�t��>Ӕ�!��҃�y������(Ñ������˩�A�X�;XwKS����۸_A�~��ݯ}�Wg�~��I�/��t�ޓ�3����r?����Tp���ph_>�G����f�Պ7c�qs��0 � ߈�O�kVdغ�G];>ۺ��$ {���'��`�b۱�}�*��!����mD�PD���Pa���._�9������� m�"�h%y�F<L�F2�u��^c�\TT%c�dҝ�l>�78 2�,v������ j:ݖ'� Ι#�:��6!x�X\N�W娮�����H�<��Μ��C#}ZY�z��O5������Ɔ;����h4����tx 䗏��|�e�c����a2�"|r��0�����/�rj�j�,x��L!�6��y�:J7����S���� P��>�v Y�����轮��4�S,�j�N28����� 5�p<�1LB�!�~��n��5rdWD�x�\�I���b���p�4_�1*A�w��TS��� >\�GS�Ѧ���Q�����ʈbljJ���$^�� �����7���lH�H{�fv�֖�mc���LX����.���ǎr�~YaD$>��%݅c�.?k`�Do*f��*��~�����d8$u%6AP��?�Y�?$X��7�M�~5S�Ctzk��s�d@Ԁ�����A�L�}��I@`.MN��z�F��K Q�=����~TQ)��]� �+�V}�*p ���������%�S�VL�� �1�2�إ�B[W�Τʪxc���m���D� ��kht���M*^3x�ylE⼬fː�qi�8y�[y��-�rJ�".�4v���F����܂�KH���n�#�����H��j�៊e���"Sy�_ه2�<$T*�2,ֹ*j�bL^�_,���L��@��)T@p"�������($#�l%��}����}T^ҷ��=�"K~Q_�if!��C��i��8x�#Y��<ި�dUS��$��0*�>L�3⡸ v�̫i����$ �Z9�<OpT�`�������tbG��|�q`��^�;+��)�P�ƕ�_q�09^�$ܹ��2S|�06���J�?Z������� ��9|�v�}�k��#�ɛ���mcȿ%�{a�e���N�`N;C�^���2zV?�"'�&��:��F)�fW$��T���iL�ԉ�'�����@��SSh��r�X��kL���酔��Zb隀�ht^�p���|��n!�6��ī�T��������(��KHs�35&[�Yg`PQ�����S�;)�@wV�R�d�m���A�ٰգ�w�5[��p�vB�!���p�/�~�f��y���"��8-��3[#���:�5��C-�Y�=��M�������te���z����\��a�O���@��Ƥ�*ʿ �L% ��dQnA��-\亟����c6#�=O����%��~?��𐐶�uؐ��$-\����Wg������|_C�i���BCֱ%U/knEՍz��q/�*k����!X�a2(�W0M*70�����a�dݔ��Sf�p�1�pv���G�C�S�F��k�E3��%���F��be������Y{�WR9�����Q�͵qa��c#�B*�.�/�Y���21&pY�_�O尭3�ΩB�ϴv��TL0D���,��AK�������X�� ���.WnR��d{�=�+�/��Р0��=�[]c�������v�-_N���z��ݔ�¶�a�R��u�8\R�=x�m�7p��9��I�$/jzo����bPU�Ă�ԗ��ݣ˽]�ܬ$,(� �E���:����-y l�����^� x|���5�\�� �>���Mb9����j�'��@�7�9��̀?܀�쬻~��[JVw�@��V�#���&oS�����v������{���-v$��f۹��Q��]���F��j�Oc��8ա[�B)j5��F�o�-^�������]�i�i�����vLd�z�E���{}q�W@�����B)|+��C���5��gQI2pO[�����tIg�D���ނ�y�q�J.�ȿ�ս���iҫ�����qxP�a�x-� l�W#����&��0�X����z�H}2]�i��Q�*��8�9��x>q��#,@�(���C>�|�c��:��V�`2�!9%-<����i�}�����gh���i:��. $4�"�*���û�H��N=Q��ڰ3N�.D��LD�?�)� %=H� �����[k���֎����D�b�Y���M&�����}�*�P%�;8�G��@�=�_��G?*U645f C��}�']�_��Ǘ��g����zq�h� � K�t��C��@H���e:���3����o�y���"h*��r��a�@��fy^����NA�١Ba�~��SE�j��tr�Y]�:���]���eZo�e�Aj�*|��}k���2�#�&�a��8��o�2��.P�K%�����y �����6y����yH*R���P�da�' ��A2%d�h0��h ���;��WNx�A��`�R��!��}��ҲA��,B��'���j��p��H1~�=h�ϡ�a��B|=�^�wTI���|�����n�����&�X3u��NF�J�ܩ���(v���È��FM\}��rB�|��ȩy݂w"6� �����ƅ�ɏ*��M�/��!.[��oe�C�|�dl�������9*H|ֺ��_M �,����ӥ�I�i"sƋ�r�L==Ά fo>D����4YP���B%�d���⠾�H��r���,��Gy��<�?�\lv䚶��ā2�E��d�������%����
General
-
Target
software_free.exe
-
Size
760.8MB
-
MD5
576dd55f1e458c5b8520aa61db7e318e
-
SHA1
3d81516c3197448f60365df1d0fea112134dc04f
-
SHA256
ad5677e089be651f79ddf6aa9f8697fa2f0c1ae23321215d0e094cdf1addc9a8
-
SHA512
22e4ec06205136e2295b2c82961fc9a7b9301cbf6d7d1684547b290443cd32b9015e739a739511311cdbe72f720b7dc9017bf20043666e3d3af2c5f4fe65b201
-
SSDEEP
98304:jYpuLnmMYaVnegppaMSZwbUkPG4flhm8jOlaxs4CL82KyaN/thx9bLwRqUbe:0uLnmBSTaMSmgku4flh9iODrB9bnF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource software_free.exe
Files
-
software_free.exe.exe windows x64
5893e69089e19900fac24ac96df96468
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memset
wtsapi32
WTSSendMessageW
kernel32
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[0] Size: 754.4MB - Virtual size: 754.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ