����ދ+�S�Z����v;K鞡��d���`)������d[h=��aok)����sKFk�5Y�� z���?����c�E&�)�0D$ޤ����:��:���i�L��/�x�8�.7.�23�dk�m�M�<f������s4+ں���D���sqd;��_F�z�� �����G-�S|����%DP������������zz0ĕ���X�+�G���}�����(��z�D�j�SXLd�A��f��T�t�������k��%����D��w�9�a��`R�v���6[�\l�\��!9���B3f��?��=���&:W����OyL���)��l�5��^�Q�R:��Z+������;�C��&{ Y�9ZO�R���^,8-�2��s��1\%�۷��'!m-�F�j��a�� ����� !��w<~d���S���� �N���{�Liۥ��!�̼o��������sz��R��@T`�l��<(!a�IR^�-K����;��s��*��-�AKgF���QR����e�`i�L�j����"��t`�hwX��T��1��Im����ƞl���7��-̺ח�[W�O�W�@��ɳtkމFC��������c��aUϠ$(b (����Hc[��?����HҒD�&��N�l��z#��Ҵ5������f�=�F��D��^� �'>��f��wE��sXd���z���ҿ��C0�:L�%��ԑ��:�T��Eoi�;�\XL�s�{Y�oy������.�3p,�C�'5� (�0���A`��ڢ�d�� �Q$5�_2Q���g��BInjF�<��M�Bl� H�Tc[�$���9� TԭQ����6_:����8�!�� ^��=�o���VF�EH�d�������C�[���3M$�L���E�mU��wBz����h���a�!3��}C��~�Ep��"�&Ú�M�����i����)r�cz�J�Φ�/�� }�TFI��&�b�k�] �J���� �㍤7|aikPV����>��X��Ȭ��#L��@0t��>���?������Q�+S�����ݝ�k5��s}L�Sȹ���.��-֗��T�ŵw��ǀ>�ĩͫ�fQ�2#<�w ��R�,�eZ�a��;��.���ȋ�s�n�����t����8wP�% 2����"��Ҝ}��Dz��X(��f�9�.�O_�]Ysi�3�=��:N��?rg���W�y\_H�Ki�ñ�� TD���8�[&�x<b� _�#�>��?윂�ll��)���|;Cp������]���a|��t�L�DC-$�l��� ��~��ty�)�����'�%֎Wf1ZC�e��שzL����j��I#�g��67���|{GɆy�Yg��S�"�X%u�T'�0X�)7�Ѡ^��&(��zK�Z=�;�9CL�t|ԝ�!+�'i�GH�,c�{5�{ R����l�T����cCp�W�Q�=�c�������� �Յ��6��U<���kx\ߖ;x�o@�/8݀�K�6f������H(�k���)���$o�B�(���+R�-�8T�k]6zw��?S��W��R�3��n�lj�'{���9#O��9�r���p��C�`JN)�_T�?�a�p��ʎ�z�����Vfj� N�a�I%���/���%��%@�!�����̊h�3 7������.�׃Nj�NZ���N�}�����l*{�<�V�t/n�� �e���d`� ��=-Xh�Q����$��5ֆ��[(�(^��e,��D���X�!3/$$��~% Nm�`3Y���B�lt\=U�˶2��H�Ʉ���.���f�������c�Y��%t�Y����1grە�B�N24�5���lj.В��K�*gk+�DU[V��mc�r�0��f]���iŚ^��`.H�X�5a���|n���{���Gb�.�,Te����$��jbL���M,��E��<7Q���%������ 3d;:��&h��� Q/�>�V�w�*�T���1�0:�NV"-�o�{/c�b8����(여yL��W�G��WE7�P��Hg�f��@�L��x�2tN���&���Xl"��*�=���e��BK�hx��ph��� �b��>�Q]���'vt�>����ɀRA0:�DG\�w|��W4ӆg.^���d��4�D��<������F��¥t�2+!�T��./��8���t4Y�-��36�V46t�6nL�t�k��lTL��P���rx����A��Y��0���0M��&��x>�扺X ��/E!��<@��`DV�6s�ͻ*���������:�i�1�n{�)���b���{�W�hO��c'c"���jEjRs��s��8�� �#֤Sɯ��fW�.3��Һ��YՄ��'EZ.d�iV�Iu�n���HV�t�H���>{V\_L˼�qK�����8���Cs������Ȧ>'͜k����&:�tA�Z�����O6��0t ��ƶ�W�ր�R�� ?� ��w��5i���x�Ŷš$})6�U�N�,��u���u�I=��&�y�AˏTd#�/K�Z�@�o�����'4r�B[����Oe:FI,Qf��8`n�L��F:��Tr��e)!H���;����V�ý)nH9��Wj�e��f?��FY�z��<�m�w���OЎ�ɽ� �\.��tH&D���whZ:1�.'��,���e� �(x���{8�~�65�D��K�*T���W����v�0]����|)T�����q'])K���W_��U��-�K�xH��$���o�ws�����N�����dgyB3�蔑&��4sZ� ���|�� ��a`��z�"��p�"|Z��-�:rF@��}նU��)����ݑr\*��?x�Ta����ō3�\-���$��.*9��{��6a_`�S`�8�Ә�'_�{K@��n����#�� �����HD������a��oP����Q'b�ؠ�FnGFmxN�dzO���L�Uz|C_��ν�;f�a&��az��B��d�AՇ�ƿ ��Ϗ�D�b'��f'B��[����CE���R��c!ЧH=��]$0���p��%��Y�2&���S����(����P�
Behavioral task
behavioral1
Sample
Installerz2-x32_64bit.exe
Resource
win7-20230712-en
General
-
Target
Installerz2-x32_64bit.exe
-
Size
688.8MB
-
MD5
1110f5ea884f4636d1353e71f03ae104
-
SHA1
4c1ef9f575f92e73a5ad75ef00c5a54735500236
-
SHA256
e1931bca3d0158979f4a75a2e0bdd112a4f8ce41c07620c4f69624e0e9a8eeaf
-
SHA512
2c04ff88f0a20944e6f2ea37e353b85aa0ad8e15e99b193e0c226cc416211c7dde90bb2a229e958cb52a1647237a593cb7dfb3193afddf764b91f534c9793aa6
-
SSDEEP
98304:W8ovceurtXu2cLjjsb0p7u4ALY0mHiRqskLg0f+/yoIngwGK8ghmJ7xYUzm:W5yXUL/lBu4ALY0oFGjNaGnz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Installerz2-x32_64bit.exe
Files
-
Installerz2-x32_64bit.exe.exe windows x86
56228b98080e96b27f7a28def1f1498d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strcat
kernel32
VirtualFree
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[0] Size: 683.8MB - Virtual size: 683.8MB
.vmp2 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp3 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ