��.�=�~�02���}jw���h+�4wE������3�D|�qm��1�{[�����X�]IÞ���P��F<�I�=Ճ��g�<��\����?����قE�������\-;Z�y�^��)g��!�!��9Y*V�Tsޯy�� ������3\MC?��[�rI�%;�)��2=�h5�ļ�"e��T���6�q&C78h\{����-B<.~v!�bO��0L��ߦ�0DB�'���dq~��o�bY��k>R@���U�Xr!� x��F��2�-��o��Ԣ�߾L!�6!Z��N���!T�����"y���<� 61��g ������6 ��D�,�t�:�S}�)��a�Sq,���ծ7�V���ť���>T�RPg�3��d�ݽ͙qp������B����48f�zQ�YWI�&��2<N�C��.S�K�<��y�g������O%���{��ϙ"� {������,����F,�B��P3�5�$�/���ۊ���8_��zs��< 1 ���̃rב��i��'�|;�u���zpD���e�z����D�X�H͑�ak�=��&XOW~}��&,� O��2Y��9� GQ|1�@,�'�����\��Wl�,<7H��^�: ��2���|̑p����tH�"U�)g�!}����/��?)/��� b+��˒L�ģj��3�Y^�C�$ډ������?PK��FS0��� �)��.x�:�-2\�1/�1���o�O7kڻ�+�W��%����!�P�$Ą�6�6=7[4++R�.`F��ɻ=wya�o� 2�R&[.�Q�T�y��S�6G�c��H�[\^�3R�Nq�s������죣5�,*�(@[�����ٲ3�Nmj+��~Ym��B��2��o�.Ѧ����Ɇ�\�3i�TR��摒쌭���J����6O�ψDK���{�k^V�^J[=�-q�9'�d�<w�Wd&���esc�a�/|H��}(v.%���40�ML�&��X�2~!Q����o?S���=fl��-蛊�i�|\�*W�W~D�C�G�D&Z���Z��Ky�o ����f?���U�w�?H��o)��H|YL=�q���#�'��>}�/����q�r���9k:��}L�[�p\�k��u��*��N����o��ڎBD����!��4�?�����nq�F� T�?�͢R4�����HV��w��<ѽ��~�M���n�{�k `��5.�i�3G������Q��y;�.�D���o�Ԏ�݅aq����7��<}�E]+�^0��'�m��*���2�qm/ �����y�S'gq�(ClU2J�UB�� �3��mj? ��#���ݓVP�j�a�I4��\�{��㕟�5���Hw{�b�����Z�k�B F{u���(�-���|�.A��Oe�CZ��L�?f�DW ��.�Nv����F����E�[�F���p=0_A���B �2�h�6.}>>K��^'?t CG����~Xh,n���&�G���Sl-|v��nqЅ����c��,!VY�w�B�`���G�]��I��!�Jۊ�xK�H��G�c�:�꽔:�����٭w8��pb!i���Q����K�=��t]�eL����A���=�i�D�9A_���G��T�Wr�6E^�}W��Ə�o�k܄�x�@`��2������!Bg����+T�����yr���:2��������46 �$t�������w*S�w���O���P�*�a��}�s����"=O��5Xn�ki�g�d��۷�������/Zy���>��7e��7/��3M��*gߎ�3ͼ�r���E���E�%sU�����-Ť����_��;�ex��gN5��w�5{�'�2��̭�8�k5��%(�4�:gc�%j��s�&��co^��cm�˕:s�,j��,�Gl��45�_£T3�k$�Lߢa���������\6Q:|xB<��)�w�Ln����u��#A�����|�������P&����Ut�}s�)���1�8��dH~��F� ��-e�����&Jk� J� ��rtÉ<sEW�o;���YI6؛쪘�7�o<Ҵ���g���|�M�Y|Bba���9.�o�R�}�HaN��8R�{D���l[L@F������:2�`�<� <c��˄m`�;�R�F��/oBοc��F\漉�p�[e�2������qB]=nd'`��_ۣj�߃�E�<e�;���nw�2#K�K���A5�8��L�|��;� x��p�?>*�K}��"[W,ө��!>mڣ�����w�um��)-s��i�2\F,�����yy�n�kPS�Do�M�f�M�e �Sd8]�9�":����eg�?��t�%끶S�.|�0{����Sc�I� ��&)8( [~��g9�ϰ�fb�E�~��2,�&���M8����ۈ�B��(�����D���ӻ�J-IU7��ڳM}�����qzS��x��[�E������� �dW��S��U����#��sX0�C^�Cȫ}[7�s#��9q(�����q����P�!h ���;N���� ��hC$���'P�ȶy�JG��CK����"� ��c׀ \S0R!֤���Olέ�UM��.I�(5��<�̬Y\/�c�o"�30vU�Z��vza����a�=����ʃ���@��0M��L�+[Z���[I�d�&Vd��H�j�M�/�][�A#pn�D�H/����'��J{���#�q��쟾'�7-�u��PXz�@�u$��'����BU2|B���])-SA&?����:���I/��,��-��&"�J����e��ۖ��#������3^랔���Xw\�F�cݾ+��tZ��X��ycj�~���b-T��YD�p)hI��>�ǧ8[d�Z�p9`qMe�?-�"�(�UUOͪ��YY���2���F���*��K�$���8A��iX�=�*��S�4ռ���Ai�{Wu�d����rՈO.��o�������G ���pB�"K�+B��B�ށ�C�W�jv=�&��7/��'� O�Q�
General
-
Target
InstallzDownload.exe
-
Size
749.6MB
-
MD5
78a032830d2b3a3bad5122a77416e772
-
SHA1
4db96ce79146abad285e7165a1df6752fc276601
-
SHA256
271dcde8d19abbc29be0c68bbd9e5e024577e3a93ad5eb9fbafe5115405c2305
-
SHA512
be83adcbd1352547e247bec9c2740e4bd67d3242c9026083767f74798555dceb243e21335aa1eb2f284503b1b1b5eda8a6f44aafab857fa794cdee615b860b3b
-
SSDEEP
98304:NZHUjlCmu+6A2mMFcwJqBWtXfEhiEJvFlVsq9+gahQYf8Fsjkq9noOCPpk2qcP:NZHUjlCBnl9wW3EJvFlVsz9xnC7p3
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource InstallzDownload.exe
Files
-
InstallzDownload.exe.exe windows x64
5893e69089e19900fac24ac96df96468
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memset
wtsapi32
WTSSendMessageW
kernel32
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[0] Size: 742.9MB - Virtual size: 742.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 362KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ