��������qM)��u�ӿ1��� ���]~�\��)�W����>���vs���`����ӿ���v���������BK�i�F>z���l��*M�y�_܁���!1�U��%��Ԑ�ZŎ��-^�]V�Pީ��u=et3/?�~�l���>��L������fWث�no���à��v�����ϴ���8�Q����ߒ�$��w}���Ę^^=�Y�^�ǥ��t�I��K��vׁ0'�֮���l`����U�Cq�{��%6:AfH'}b���`>��b�~� w�'�bfDm�q�Y@j\�z����挵��7���*��֜���}�qΘ�mo@c0z���F�컗�f!��B�����Ng������ܱ�x2x����3የ����SK=K��I'f����t�϶-fOk�_��}�%�~�(2�lȫޝ72�s�1��y�C����N���_qA�'�A��$Z�݃�O_���%a4r�^h`�#����c�� ��}C��˯���34� (:���9����G'�/�Ķ���L>�=g^����}�Έ��X���+�]V�],ܶq���{��묭��RU%���:w��� 5pNc�f��@��s����^��F;���N�!��~�G?m���lNꅔl�BbS������)[��Y��)�9��5��(Lίi��1i= �ǣ��h��9 �J�i�yC�.��֡��5��p�������-����1�#J�7��X3�B{���❹v��bq����)����,���G�sK�}��O]��`6��fb��V�!�/� �H�i�����M���RԽ�ل�M���_B�e��I��Ic�Ŷ������#.l���!����G�6��L�O^���Uba�C�C���s��O���`�a��B����@�sz��4����h�<�?Ғ�7rF�Ƞ?m�����j�A`�U�ȑ�)��S?ѧ��zM����d4[x��ۚ���3#/�`Q�`�1.y��Y��2����;6����l����=�O�1���Q����jh9����`n_��Q�jc)!b�kp�@)?`1J!�^��8���ۓ��?ݔ���Z>�����K�Z�L����}�������h�gD����11l%���Ӓwm���|���ute�C�h���{y�Q��)���6)w����J�Z�J��^��R� �9X�>�Y��DB����2���1�@�s�hGX-���O|ĺO;����Tt^�8�A�ւ��rjj�yc���KS���?` '�ܗ냂�#�֣�yAz�1gqp�/�p�]3gc2)M^,Vk�J��R�N��:� �cӎ�T\ZXqnSAPJ�(1Tdg�QW/�"�9ؙ��L�oI��D�� �G�!���Y��]�)����q^��zq<;� <6�����+��3�� ��Jlff��!C��4�p5�9������v��A�"�������pR�zKtFF�5�͎h�$���۔r��N�����{�b���8�{VC�p�=�;��$���+�N���xHb;3[0�f|���0�dV$��9�K���C&V�����_R1Z�t�\�+�W � ��4v;a~a�S�^���K���&���-�V�S�Y�q���Aj�\�ٔ��<��|�EJ���.�����h���v��M�����]b�[2�C�F|�ַ� �G+Z��9捥��� ��\>�����aWq4۹E<�Y�rp�C.vm����}��Y%��ށ�bC� ��WjA=\p5?���OR�j9�`�P�鹑�}�X���d��=h��Q�'�j:�2�9��TY8�r �N3>�x�[)|oC�q@�눦cґ��;�_��eÈ��=Xޓ N�l����N�%���z�X��cق��)L�U�燫r�p���9���,��B�UYГ���龌;#-ùW��b���uIJ�a���~`P"nɮ�s4t���91�#��XӈO�� 4g������w;��g7`�Du`���}7�][,͕JV{�� l���K��zH�+҉lŮ�/��ny�S�u��<��s�U���I�8hhk�|�|���}���s���d�|k�¼�q�����BT� �$�s"K�h[�V�0��D)Ve�=���V�@�q;���m�[���N߁\xN��~n�'��+�g�bU!ƍJ� �b�{�q�z=����ڃ���Co�[��(@�� ��u��5�L�+���=��?���veE����k,�S`�jo����>�+�\���NN�����`��ܫC>[�#���F�"�2�x�am�:�f2���wo��6h����&����R�K�>��'�KxK�ɝ���C;=��ܒ�������,e������A����m�`�� q�G�~��U��i�k�h'��kA�]Djo��M����hj��w�q9�D?�.ki��v��uo��%������2�ݥ��C�\}�u��Y��gN��ׇV|��F����<�~�4� �l������o���kG�����S����s�^��8W�؟�����2?¢C�`��1 ��d��X)qm��}V!�J=��0���-��������sJ�� w�����s �e&���^�믙xY�i��jC����ݢbJ�o��`��F�A�i<Nu�:��L��[���M����I �U���p�������^̓�T��n'�KЙ�v��"m��3�� Ga�)̯���,08 ���K#����=Hx�S�e��itA������ˇ���q͐�N�>K�X�wǂR����ͦZN �_a�>f��c+9 ���m�u�����N'[�?�q�\�}p��L���^�3��}�����GwW��[ ����1w����?���q^�jmFrr���"]��"+E���[�'㎣��������BtK�&��e��Vn�6�*|�?|�]�Q��ˉ��<�- H��_L&s�pk'�X�_��"?j�#�������8���.���s�7��_|�d=̢_�w65�&,Oэ� "s �L�U\FKC�)�,��DK3ƫ`�} ;
Behavioral task
behavioral1
Sample
8478c04dc9e8f44c1e467665fc52502db2920997f8c64d1550f9ab12bc360b18.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8478c04dc9e8f44c1e467665fc52502db2920997f8c64d1550f9ab12bc360b18.exe
Resource
win10v2004-20230703-en
General
-
Target
8478c04dc9e8f44c1e467665fc52502db2920997f8c64d1550f9ab12bc360b18
-
Size
5.7MB
-
MD5
5888f78942a8187f82cc3e38fb00b49e
-
SHA1
c417af49e86b041bbc1fb8a19a49eb3885fb1e8e
-
SHA256
8478c04dc9e8f44c1e467665fc52502db2920997f8c64d1550f9ab12bc360b18
-
SHA512
f8ae02da05f74db05d5e85b24df417705f81dd48ced8a193097e4688a7bcc796b107726ac12d182f0dd8b3a610d395a361e78648c6e3354ad4e8faf363f24c9e
-
SSDEEP
98304:uxpkQjQ7Rg8/oNZlFSNmopEr08qJna18CU6ftvDBa4srjsXR1xAiNC:uhTfM3qAq8CUD4m07B
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8478c04dc9e8f44c1e467665fc52502db2920997f8c64d1550f9ab12bc360b18
Files
-
8478c04dc9e8f44c1e467665fc52502db2920997f8c64d1550f9ab12bc360b18.exe windows x64
26096d57ebb6854be4ae22c14fae2c23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
api-ms-win-core-datetime-l1-1-0
GetDateFormatA
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 396KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 492KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ