=�DqeM�"�Űr/���E��C�ȯ��_o�H9���N�P���3�l$�X~4�J���1��,J��o�5�=�<B@dr�y�X�&@@=�� �R]ɇ�~ ��Ijvp�D�s�N1�K�kD�}����:�O9��T"c E�'pB=�v���IS���M�ګ8����U0�ܜӸ��Y[��6�C�t"���>LL-�{���~l��HL���٬K(+O�v3��Ǖ-Z��=���QYj�w�/e��}�@��N�\#no�9�mkǨ�p�[��B7�T}���̣�`j[��57��DZ�<��qsD0��-DY��L.7�3i/�.���'X���)�[���V���.H�����3(��n�^o�9J&h4Qw�a�-��\,���6kb��ކ?J�1F��/D��Y�>��1wюB�V�� O���ў�tJ>�vVh�Q��U���ݛr�`�kPM�x"P�S���Œ��br�����|$� ��w&��ʰ@����1c�I�S-�¤��XѾB2(~mճc�8�©���kRM�Z��.�����^��M,c:)>�L9��ѽ�2\Y��_w&t o���t��'���+�ovUVH�� fp?�M������O�sz1��lq��U�i �9i�@{�.�}e��([����1$���X� �l�1b����&M�yQW��%�4����%����s:̍5*^�6��k;�g��bQ���\hZvρc����9��y Mh�yP����Z9LT��f�� 6�ڤ��uq:�Oׇ��(?DfӗJ�O�B�]4�Zh����%S�n?S�e�@�N!r�jĀ�Q���4}��j�eS7J��{�E��68��SNEJO��� c*\�Q�h� � ��(�7q��uY�)�I� ��|�*]�@��o��{ `�N\���'/Eı�oj�����[��7��*:�eR0��W ����:l:�^�3ozN��Z4�>�~U��mUn��A�$Cx{��r�a>r*�B6�J����Z�*��(���=ܬY�A��H�W`GpZ���_I�7m�ͱ�֟�*�] �l� ~�9hd$$ɧ�3l��&�BC��mA=�N��$L8a���>Hu:&�mZW�������j�s�-�U��\Gi���L�7*YAH��Ւ+9p��ֱlj-��h�g��ٮc~�Δ^���}��>� ���W0�Q"�T`)�2-�k������[��u�*U�%)�7-Q]a[%4���� `��7��@-��Ok��n�Bx��9?�2��5���L��+{IoW�tϽl�.�,�J(�q�-����g�B��q�y7o��s`��s�I���DN'�x!jU�� �m҄�-�)t�cQ�"�p!0z���0�O!��%�n=���l�,�j1�:���V!�-T�Q�������s���K��]B��T�����Y+� ������ ͵�Z�Ns(�N@w����yze��C���9o�����nա� ��D����p���)�z�M�G���d)y��~��>v��n\v"�b�1�ؔ�����-͇��o�.���e>jn�A�cTk�N붼�*q��\��0q�/pmY/ܒ�������t�QS���l)�*mH�*R��+(z-�� 8���l<���]��{U��@��y���W��mY# FDb@��S�M�i1�`7/�q��3������}>,nt6u�aHA��T����Kv��{��)��P��`X���vR�ۉ���������ͳ'����$���@Bɝo��DQ�-:�f����� ����'�� �|I�vФ�l������������+�rP�6�A)���b��*�"3�Rx �D`�K��=�:2����B��<ÍT�B�q�]oe"ߘo�|ҁ���]�HF�r��"=���@G]���(��5�Pi�Q�Â_ �g��I��I���zӸ<��~��1����Tv���p�G��c��ǥT?Z�B;�s��WZN�L�z/���epDM(m�D0�S��\����-�d�^;�"@ ����e�`�u�X+��T�u+�[j�QR��?�S��E&��<om��b�T����'S�_�>V���ā�,Kqi���2�)��K ��܄�b ���+�|��m�`m��q�7X�)�;��e�c���v�b!:�� +�{L�d�]���8��h�����F'�`u�R�ua�cg:D�ۃX��*Fy��~�X��$M���5�X��|����˳��QBTd�zr"[R̷�^�W�m�Xe����[��4�;��~Sa��r�[� #��d����C��Y/F�c!�H�R�2q��6X��/Ѕ�D��W>��d��W��� J�Z�H�����.��� ���`�~�Iy %DG� ��u���� y��Z�)�� ��g\�]����_r�C%pDԽ+Ii�"I&!� ���!�w��-�����E-JF�jm2.c��4�h�����bݴ$Hh����V\ɨx�,t��Q�s����L`����6������S�l���Bo�"���Pl���Z�����W���o�����*�!;\6��Fg�La��ep�)���Ƹv�2�z��wl�O3(C>����LE��Ȥ�S�jCs�Z�tvX[�x�k�XX��b�7�t�{� ����5�!�����Z�E���Mz�s^%Ʀ r��Y#��o1.�;��v�+กG��>ѺtD��i"��K��z��v�����SI6��?͈Lw�"Rm��|N���$�-[|�!���&\�������Q� @#�*�NVg�Q�ݱ�u|�po���4���Bn+���&1��~o��7����q�겜*�A����#�1F`� �A�����*�5訲o������ I�m��թ��nm�L��r'1�pd�˻)8��-h%�g��cW��3tw`���.�Fi�� ��e��s=��ׇ����;L��~bq���o�9��d��z~���`=�m�ؽ'^v'�?��s�x�mg�Bs�� ��#���5)k[�����f���B��p�{1U1L�E��ci�t)؈
Behavioral task
behavioral1
Sample
d261246adad4892c1ddc2957bf5add340e5429f9e2f4c3e14d7eff2164c17933.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d261246adad4892c1ddc2957bf5add340e5429f9e2f4c3e14d7eff2164c17933.exe
Resource
win10v2004-20230703-en
General
-
Target
d261246adad4892c1ddc2957bf5add340e5429f9e2f4c3e14d7eff2164c17933
-
Size
15.5MB
-
MD5
bf63c59514e66835ef036a8349a8292a
-
SHA1
c8af862d51d4c53cd1d3fafca5dec65cf52837a1
-
SHA256
d261246adad4892c1ddc2957bf5add340e5429f9e2f4c3e14d7eff2164c17933
-
SHA512
76c3619c9eaaabfe8118d87e3e763aea6b033e5ff63c8caea4d5f99cd5c17f684b5a3c9114993ae82b83ae34205368430f43fb95f5ca4b223ab833f8a082e093
-
SSDEEP
196608:wbxi6/O6+am9S/v085ctQiiXImSzaN3FqHy8hpPRZHqs5L8H3d7Mhghq7XP5rN:wd/Etz8etSXTSGfq/LH95L8H3d/h0BN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d261246adad4892c1ddc2957bf5add340e5429f9e2f4c3e14d7eff2164c17933
Files
-
d261246adad4892c1ddc2957bf5add340e5429f9e2f4c3e14d7eff2164c17933.exe windows x64
0cf722d200a7d5dbb3a4083dce48ffc9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalUnlock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetUserKey
ws2_32
WSACleanup
ntdll
RtlInitUnicodeString
crypt32
CertCloseStore
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 569KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 13.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 15.4MB - Virtual size: 15.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ