��P8��ۄ��پ��b�(q?�7�a �� �i�)���A|�X����o����Ӣ�X{U�7��y +�R�TFǥ�&�t` 8�����X� �K@��*�T+`�[`%����X,3{$���$hk��=�E��|��<j��&:��j������B��tO�N6c%����Y���@�JQ?��X9h����"'(K�^��W��HC��U��,�s,���K{"[~V�>��I FX��E�q�k�K��zO���n��/���h:E��g>g�(�X]b5�����!{�V���'���9*u��w��x�9�H��\_�v�����ǫ2�ORf3��(��[����/6�ז �`KjPN�RXA��d���)a�2�WW0�^G�����9�)��8xX�%�7@2��j�<!�,�-�� �����{bJ�韕���� 9$0A��>Lp�.�`������32<��F��h��o�*R{�'��� ���!*8���lp &�u�AK<L1������4�y�_� ���u��5f���:��p����C�؝7!&`\*O����d�x��V��a�������e.�vP@�D¡��WA���, ��q� �]��* ��H�s��UE^^���-�=�w&�E�d���˞�������UJH]�"2���߶�F9Q'0�}wd�s"=��,�#9.�:���)�m��mYϼ�Jw3;ḓ2�۲S��/�/�Ȝ���G�\�u��$���烸B*�O,&[i����*�7.Y�W&ܿ�K��%Ã� ;cJ�KY���{���� �Y\���Qr;���#�T���jYu�c���.]�u��6���'�� ��,�[�����|�Q�/P���u�|<�)n�O�%ٟp�yI���q�3���k"��E&K�c.��^���ᦌ�������Ճ[�oxN�0p�L&���Y.U���nQ=^�`�����B?��b��w�B�%\�ɑKA�l�3Bi*��U�%~0K��A,� f��s�-�Z�+��`t��C�j�S5��sؓo�)yGZ?8�.��tђ����"ul1�� +F��� �?�\��fBK"o�}�&=#=rڍ�� �z�ʨ�U�p����6��j �*��kޠ�E�NB���lߍ�gMDXkX�c� �*V��+XT4�(5�Zfb��%����9w�������7)�:�P�Ձ'���d�o���@rn�G�Y�E�1`�(+�S��WO<�ͺV�iqf h�k����/��&Kv�m��r�G@�� �@��w̘R��:=*�������s'g����L�!�|���1> 7�D;�j�Н-P��۽u���<��+����UZ��Y�(�����ާ3��I�0,7��=K�nn��6#��m��j�Tt�.<�8�MXx�aA��� ���3�筵f0UQ�/`�ƲS�2?�J�X��x��{O�y�2RgX-D��`�AN�UWA��2s>G��Id�%R�3��G/ʡ�P}�95T���LEJы��̫�ЫC��{�_�)�����͇|f 2t�/6g� ����cXm��qE�d�3�̳�K��5۶�Z��2y+x:���M���9a�m513�� OT�����h��e<}V���?Rxv�*�6�U=�7�I9v(�T1?���C9�X=�e�\P��ݐuq�Xqe��m;҅��9�B���/�D���"��&�<�_�Or5?qJ�k�?����i��jRQ��4 �~5���[�?��9\�2�,���#+� ���;(��L������LS-W�u�����I���t�|Ո8b��q��Ҕ�F�|�.8b?�|?�=���T<�B4oV��}��Qjv û�p����mq%y䏠��""n#�����wd3�Q�ڬ����4�O<��%ŝ��W:�e-T��-7S�~�ǪZ=���YBN��Z�8�M��%��u���Y_P/5���p��xaq{$jh�T�$n�w�����_z�����ݦy�W���G�Y���ٛ�/�J^��O���:4[�[[ �)s�h�ؙ&��^�� ��|�0��q�I/��FQ<�P�o�Mܰ��P�����nve�c�-;E�2�t܃߾� �8Ԁ�n[s�61�-�ι�5!Ҽ,��m;P��������)pĒ�&� G��IJ�������Ցp|u��ͬ�{����J�6B��� ��;8��$�f��{�����9��m��)�9��fp�,�7�� ���Y7γ��wӒ�?v���0��(�����;lRN����r��{�d���hx�.�E���vU� ˖HK��Pa��L�\���'��!ףƃp�[��\l(��]-L��(TP� �y������ζ����L��9R{������w[�:hn%�����(�A'5ȗ�;n�IZn�W���v�ܒ/ M�F �e��~��t\w�g>VwR��d�s0*#�~����c����D~�ezY٘!G��_h���% �$WY�a�)>%��YPs^�6��.R������P�V�ۅ�tz�W�x�j���/ܢr���l]O�v���|id�x��6����\���ky�W��?V毶�˞D�S�V�iڐ�1e���cJC�|O9ɡ�C��9f�V������ ������D}���Ue�)��I頪X�c1��R�@Oq1m�.IJ ������$�V�>�Sl�����gcי�"�=~��c��"|������Ta��Jlk����|EHNj�����o��-�B�_�}6�G����o�o�k�������J�������B��g9p�9�X!�yG���� �X��XJ����ű�jۦKev�b�8�����+����͜�q�z��-�A�r�V�Q����1*o��v�W��H��3*z,Z8.B`P�z��7G�=�!h�xk��;�4l�h�lr ����~Jk&`]T�Di�=u���b{3ЇJ=+a��O{C|W�"�Z�Y���5��-�ߙj<���>�d"�4�g���x��A��g����Ŝ�>Ϝ��92*�?D Y\@�Ւ��[�9�R�O�{6B0h�9A�(�Y�t&���o$�P.������#C�w�M��R}��{��E=�b�
General
-
Target
Free_Softwarez.exe
-
Size
739.7MB
-
MD5
b98ff010cb6acbddb8bd23d9b5492d3d
-
SHA1
bc6b17d5cc4ea8d98abd7d54ad3646a46f87e1a5
-
SHA256
86fbf20ba2b6db5992e85450015feda91912046fe221f4199e26b0d3556fff2e
-
SHA512
1540ad3e21915d4928905cc501198ebac1fdd61aa6ef7c16fd975e37205d5040a935af757d84229fd5de3ce57b356cc547dbaf342346bc30bbe163363e3f08ab
-
SSDEEP
98304:VwHvZ8CQIrcp+ZFKWQQ4W3y8EikLyAyDQtMVwdChuMNMgXMSCdufUFxwBRPTa:VyXvQQZPiTb8QtCwkhugMFdLwBpT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Free_Softwarez.exe
Files
-
Free_Softwarez.exe.exe windows x64
5893e69089e19900fac24ac96df96468
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memset
wtsapi32
WTSSendMessageW
kernel32
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[0] Size: 733.4MB - Virtual size: 733.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ