���h�A�e�}�G�K%N�σ��x⤍�(5�;���}?��rXP�|K��lȂ�e�W��R�&���Yf3c�N��&@(��A�KM��i�@5�u҅:aS[9M?`�*LC�_Ow�Z9����������$��2B\��c���a���%����� c����x'������y8�f���1LHE��y:{v��|`S�2,s��%���� e*e��OS��?�6'C�E͒��T<��.jo��hy/2+1��6�ٛ<5cф�=1d��K������Sֵ2�J8��6�^?^ 2X?p��.b��0��y�fOl���d-o��G5&�F�<ß���ԯ|hCWr�f2Aks ��L���?y� iCt��]u��2\�4�z��I���S�NN�豝|��WDI�z\|{���7"���:?e����ShFR��A7y>]��$�v��o�08�h��c�]���ͻa�P3N�������[z�*ݠO��>bq�n�|��_�t���X�F�X0j�(�6W�R�� ����C���5���=�LT����e�+���t��p�Ώ��+-��đ�[�2$>=ł����\�Q��Mb\����(�a���wz{ߝ v�uUط/c)J~��*l��ؾ�}�әA��b3!N�@���ٓ<�c�2��l��w��=Փ�9L�`ٛ�=��ñaj2~�p\?e~�<�t8�.j����d*m&������[��8�ӒEU�$�/�Jڡdd�S�L���g�����莒��(�sזA��6>Er�`���d��p]+P��Dy0e� �;�G������m�j��dP��!F=D�\,~!+ iuA�D�_���l�S Ҵ�`]�t��fb�F�H��$i�=���e���?���ԁ[�f��7�c�JO�~�WF.)qF��Z��E����qy��Fĝ��Sh2x����d~`�i?�F�����o��sL2?o�3��r�*T�|$����.Z�z'���sm�p�����o&ROJ�wR��R��[���+�K�dA�t��:�Ll������?��9wӛ�V��1�o��� [�O[�+��_�X��(���PT.�7Zj���bxű�v�\H�3.X����A�P�ْ�Ad�)�rA;9�I��,Ȑ��?Ԉ~r�U���2�I��:� �7�Fp���P��`���B�V�&k��b�& �v��K�߿���3XX�a�u�P�NJ�-`�i�8��������4�?�(�T�$�5H~S�H�;3�|����7k�����~� � +��VG\s�s5�G��a=��{���{�u92�������qNL��(����g��>bj���#���`M�<�E�i�P������n�JW�bI�3�� ��㢭1��[9o�|0���M����v����̠o>���B:��h�h�dg|�o�D�&w4,�Alb�����T���^k�iJ[��@>�Ҭ���8=��-��˴��������m;-�͂��~��wX�o�L�"�¢!�����(��x����(1�0��پ�V�T.�8�T �u�Wrdo�U�����^�Ň� 7��-N������x��9A ��"�V7b�ǣ���'��<[��Xh���*�ۇ�� �=�����2�8���/3_g<!#7 5P���!�����������b=�45�!7��25փ�:d�]��'��<����p�|���fDj����W��B,�}�5֒��LQ��;��k5�k0���E��o����K�u�R��06&mwd�I��W�PsD���H�J�ʅ�3Q�s+��<�N��t�A�Z�Sq�hX�<���jf��_�D��8�|K��;�uU {��M_{�}Pb� (Bw��C�q+�F��_�� @K�8�m���؍6�|�U�RT���e)Bպu�P��y<���)��2� �yd������a���h*��os�Wj}���V �_e�O���,l� �`���aUG1�ua�QnX���W�c�a5G�lr�o�jk��c���Ҿm��WU��)F]�8��ե�Q~��z���s�m��C��$�wc�����Я����Rjj���SH�y���.7�uŬ5X�>MJ:?��KE��c��z:��X�D�h\:�軤U�S'&K����`f�3���}��/��k�3H/��q�q ؚ��S���z�d!�\�C<V����w0-����G!�)&�5LG�w5.���C^�+�X��Y��ƣ���*�� �����,��~�őd��f�ӿ/}V��?/,e���p)\�e�t�غxG�>�a;/s��+�+�&gpb6�m(@�����Λ^�����r�L־[�Ѻ>�z#�|�'_)P��,���n9'�xB�DNj�*��@��3�^,07 $���� �?Z )ùx|��3D��eط�OM�<z�|eҊ�@�����C ���O�@���4���>t���f{O��q�]k�=�spp�x�L��9�V����#�%�Qow��1��,�<�X^�;�ظ~�@iV �\� �z��0>kӮ�F�:$�VZ8���yȁ�y�W?^ �;XiC�A�Ø�$�c��������I�?+-���>�����Hwdȉ��F���B�$�(@5V�)���K̷�Ԥ�� �}���S���e���9�P����|�4I��F(c�����cx��a0Gcl�^v��O�<b��}�(d����*������#��\�D��<����;��N����Q��R��lñ����͇y?kOEӫ!e�c�n|C��#�G.~�������r�� ���5Q��8,�������w�Yy^g��)���hr�e����v�x�A�0���d-���ㄶ#�9��e���H��XA�`����,��PB�[c:X�W g��#�T�~��d�8�կ��|WOK"�Yч���)� ��*`��(�՛Kv�A�~T�x��,y���a�@��N��8"���W%y���Du�����rk�������Ƃ![�Q@+�q�gSV�����8�c�۲D�LQ�V�M�W��r��+7X�������<��i�Gn]��
Behavioral task
behavioral1
Sample
f8acd95e7cdbb5c3ba84d2a24bcac98636e2b7bd6bef2d9c1ffa615a9dc9201a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f8acd95e7cdbb5c3ba84d2a24bcac98636e2b7bd6bef2d9c1ffa615a9dc9201a.exe
Resource
win10v2004-20230703-en
General
-
Target
f8acd95e7cdbb5c3ba84d2a24bcac98636e2b7bd6bef2d9c1ffa615a9dc9201a
-
Size
8.4MB
-
MD5
0c7aaaf1eb4b7115742bf5f8d58b334b
-
SHA1
0b81d2e6d56319cb96ee97a94d67a522150f9cae
-
SHA256
f8acd95e7cdbb5c3ba84d2a24bcac98636e2b7bd6bef2d9c1ffa615a9dc9201a
-
SHA512
bc2047de483788f5029ae2b6cab075009d9186177bfe098f5c7da4b66682f485a2a8fa675120481d76e077df0d6b01516b7299317da5c5db662de444d4aeb890
-
SSDEEP
98304:itHihNrPllSb0yHik+t4MMzGL8wLT3GEN+ws7VdxxJtrm9bMlvP7M7dfm:+orDHbQi4WT33zspZy94a7df
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8acd95e7cdbb5c3ba84d2a24bcac98636e2b7bd6bef2d9c1ffa615a9dc9201a
Files
-
f8acd95e7cdbb5c3ba84d2a24bcac98636e2b7bd6bef2d9c1ffa615a9dc9201a.exe windows x64
789474cf4cf38d03914dcb5e33ad8868
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetUserKey
ws2_32
WSACleanup
ntdll
RtlInitUnicodeString
crypt32
CertCloseStore
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 570KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ