@�33�t�~r��@$�&f� �M�y�����^��MZ��):l,wֶ��%;R_g����M *amk-a�Q�h�����@�Z��tdR5}�*�s�k��0(����)s-�ub�E�a|.�)���N@5�fKUU��e�?���TcCY��4)s��,}��EbrݣSkP�u�aJn3,)7��頇l�o�5���G��&4��� B�Z �5�4�ui��<j�L��&�oI���v�a)z_g6���%vj��<f5�b�L��v�ol�*u����;o��UM�f)���M ��YI!����S�w�!��6B�1�M`04j��"+�%��15U�`�� Ӓ�Ĉ�S�J���2��ʦ����Ѯ�>��������X�]^����<�p�����Ӭ�������8n�.��\��oO�%�pH[Ll?�&w�jY~$��4q@̓�]d����X�=�`&�/�k�x���G���d��=' ��d���N�@ɳX�@�U2�/�V�P���l�����j�j��T����!)���v�4��k]C��mw���3П��+B�*����O�S5ߕ�4+}q3��fњ �q1��J��712�#[������^��l%�N���n���+lۉ߲�b�wѮ����0�����,�L��)�EWQ��k#�i�^�.- >�\�ck�Uu2�]UU���C��u���a��Nň��!7-�Ge�%�/�M���?���(}��[p��}��TTI����1#��������6��U�F��r�9�����v��ƮeC�����zH��6����s�']=���b�w���p[�p�E��?Č�ns|[�_��P�W�-Q� _�ָ�~��2B�5�͎i۟�Ͼ~�4C�k\l_��t�Pk�s�/x�P�^�����&�ec���*g��4ʜc��>0���=P1����{�r�Y�~�q(��x��r,�9i�4��?L���\k8a�\�k���.4���L5oj��S��j!���*��N rP��AV@F���N1�s��g�5t��}�./�g�Z�B�|�+r�s.�S2��B&�e:��g�C�zG�IZ����|�w����+ݶlxBuV��� f`����K^[�G>�c�MR����{�ޖ�we���� �=�����E��9����N�ʼn@�VeS��&�H�� z�>�zGm�,�٨cP����[�@�Z�V�M��5!X�e�"E��;��@���,;+���@{1���'ta�r��ׯ����U�Q��r�� 5u�������?���<Yp��Ȁ�� /�;f���-}_X ��fu��'���\d�B����>������Y�{ �Ѕ�-n���mZU8/�X��<�AxI�F@��ge/���{� K�%Wͤ��+Wb�35��o4�l$�'%@�5~Z[,����!5��V}�a�>���zMtdԞ�����v�B���Ĭ�x�Dd�:Ɓ��DcP�KL��g�� +dsw�����3�j◷$&v���(��Is-R�V{�q���s�� e�|��B����f.����b�`Z�P���0~��g��6��_:>N���B6'5F ��O�̈́�'��}��������T=�N�r������r2�} �֊IQ<��s��o#����o�~��d��89���ip�N`� �bR���N��֫±�m_ʯ��)�F�� �^r���Y��½P$�e]�GI��P�W���izd��n�0�P+����+�Y폵m�Ȑ4�V�xaN{"ό93�)7���O�(����J�Ac��� G���˻������AO���� W=�������yq7�T;:�m����4"�{h���E�#����ҡ�=DPy�m( ��O(��q�SRC��Az��5� ]l��̷���9��H)�yQ�����F��^ ҮgO�z%ִ��Gn:K�+����#R�<¬�z�jr$��d�4�wR��Β���}tTY��rq:$��{f)O�˰@�YS� �PT�R9��l�ê�?:���ɛ��_Lhj�)8C���K�K(�������hog���e�,��HS��'m��:&���S�`�����1��o�䨵.��[�s�w�6��Z�03G�lv���cD}�wE)ZPƆ}��G� I�����σ�[�O���ձ,�ȞF��!�4rБ�����g~�E& �I|G�y��k�̅�Vwz�D�\�"�[���]���)r� �0�b���J2�M�)�A6��/��h�]r������ 0��~��#`|dw�22�X��v�� u߫��g�K�k��x�E.�3%�4��*����q�!�nj���7�N��_'��;�ݹ��m���[��}�n15a���F�!�%��������0y����0G���^�TTS->I_pLe"S�J���@���и������x����@���@��_�_��^z(�#�I@TUֿ���͔؉O�.��J�qIѦ��b�G������������T ]z�*�h�(^����e��G ��҇�6�Q�}1i�* q���ٔ���u�&��z1w���dYV�l8�O%l��lo>����ɰ �od�v[�ϞǏ��"��.N=��u�.N�dܫT��(�F|�\Zl��'���q_Z�i6�]@H� #�I�X �=���z�i�yQ� &��B�&j�f�"gsH�=L�`��\�v�P)N�D��&mB�E���C����;�������I9��mo�^H��'� h#f����,���(���=~�9dh��5��L#>Qk^M=DO������z�6����F�Ik05��WS���_����'l�H�s���+w�\逐��7Ǣޭ�aw��E���h�,��7'�,��O��Fx�j�2UF{6덺�nj�����X�n��&4�U=��a�G�&lk�tË17��!�9���Q!F41����3���oƓ�E�"���`���56��}�������6N��U3��J�j�@��+?��LGgfA�ᠯ�tG��G��֔V��ڒ��6�cO�T�r��-/&�K�҇" ;*aPb��҈f��Tb�
Behavioral task
behavioral1
Sample
765b2b1b2f293bd126f402d44855007d965d9996ac4c733c16ce269c91fc7d9e.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
765b2b1b2f293bd126f402d44855007d965d9996ac4c733c16ce269c91fc7d9e.exe
Resource
win10v2004-20230703-en
General
-
Target
765b2b1b2f293bd126f402d44855007d965d9996ac4c733c16ce269c91fc7d9e
-
Size
4.8MB
-
MD5
98281102eb86cefcb14da30882e42b6a
-
SHA1
e0c9deeeced41c328f5f029dbc93b70e2ae993ee
-
SHA256
765b2b1b2f293bd126f402d44855007d965d9996ac4c733c16ce269c91fc7d9e
-
SHA512
ec57c9e23017d723354a0ff0238a8bfd2852b5fd909a4865cfda4bce2a04ef71f6f1d59c3120e4ed9ab94a500ce04e2ceeb52c073d260a6a527a7ef637fac99c
-
SSDEEP
98304:gXTRdUYk9OI4Hdy44vYKUP2zMfBdaE9VzosUpqYWh8vIE:gXTREsbHdQrU+zysEvUpaoZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 765b2b1b2f293bd126f402d44855007d965d9996ac4c733c16ce269c91fc7d9e
Files
-
765b2b1b2f293bd126f402d44855007d965d9996ac4c733c16ce269c91fc7d9e.exe windows x64
cda9e6d1c4dda71efef19ab50fc0a418
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupPrivilegeValueA
shell32
ShellExecuteExA
msvcp120
?_Winerror_map@std@@YAPEBDH@Z
wininet
HttpOpenRequestA
msvcr120
_CxxThrowException
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ