��Ԁ�T��=�.٥���b8�v��S���H4����l0��7���"T?�f�1���C��W=|����. �,��BݕO��à:��h�9�*Kz�M�q��a��PT'����w�s�<��U�� ^KWț �1��[�$�ޭ�j�v+�c�䲒�Am�:Y�����yC�J�ڿ��,o�&�¡�\��0�� 6ku���z{��w�X���a*� �J�M��W���/7���+)���7 8�.���+��& j��;-䊃)��/e9c��N?<�"B&V��1���-Z�d��ݗ����Nk�]�`�f��02�����=9�J)~�C�*-�]�<�R9�h��������}>w�S@��紩a�����듉��Xfs��Cх����O0Prmޏ3?�|X�T����jh[ʶ���� �@r���W�;���4�����-���vh{�L��l�pF�+&m�@e����@�~�X�V����N��8�ӯ`~�?et���#�h�����'[`���A����� �U(@�q��#x�5,_��nhṞCӍ���'Ca�%/lK.���2��D��l��½���'0SBGir!)�B汬ar�֠���R�� q:9�����g���Z붤L/0J�L p���o�C���È��B���Q�G��m��/n��Twe�]QW=�� ��R�L��Q�D��LJ�o�{�ݭlkt��3�. :�� �Kq5�oV��U��$�a�t�fJ�[U *N����xG�Vjᇽ���"K��f��Bj�� ʐM3���\��9 1/Y�o.�sM��G�noc�����څb�eDd/dxx���\��3�;`�Z��3p<լ}6f��"�T����'�7����t�UN.-��uc�V'藺�3R�b����I�Sx�`�=>>��ڻ��&�׀��IQE��������[�T��UC�Q'u5_�ı9 �u���a�����d���jT)-(( �xY�E�V;�-Y�����T=��Cp�Y��}ʖBڪ�a�~�U��^S/�+��>���T)F�q����@t ¾��1��L����2���`��U����/�u �WFf�*J>��꼮�����~4�,�!�s0����Έ�"����$�A�ob3FI��-^�J�K��j���*�t'3�iV��+z�<sS��j挽0���2UQ����dلM%���84uĵA\��j��@f�������eUU���]L)��o�X��1.�`y� w��\�������V��Bbr�c+t!��oB�f�A���Vb��{�ۧLN�z�8o:�u�9��+�0+��^.0B���Q[g�)�B��m� !�!J��eE�7=����m��� �drsKdg�fuZ��3o\�/eEm#� Q��aWL���;�r(*6G�Pt���Sn& j��m��0������7�Y��w&�,��QCi ���B�2>P`e����{�!i-�لyØ!�� -��yȱ��ns5���ۿ��yŲΒ �t�'5��p8�N�U2�ٜc^�z2����� �Aȁ ��Nih9\�_-�@!�r͇�:�lkn���qp77O�gq��&���e�X�� ����x����-�,�]�4��5���Jd+��_m4�H����!�e`0>Y��S�LX�e����� ���.�Ә���̢��ojHʚTLց��-��zI�~�d��A��EL����#@��S�uh�� �ڛ�τ�&} � ���h{���pez&o } 2ch����=�d������������]>u4�ç���V��;L��XYy��m#}ɫ}��|�/�OhX�ca$��!q�ǝ���D�� �`w�~M�ĭ�>�u�`w-?�21�Ë�ȒQ@+����Ғ����hn��N���& �"�9N�5|�C}�n�%]p ��������w�g�8�"��Au����"��d�WxnI`@�}��~![N�?0�g>�Eq�J,,!Q�﹅`�v9N��G˜�Qh��RG{�@���+���`���E@�KhL���p��[��H���vV�q^�iD,g ��0 8�¥����ߧ�7����E��cbRu�&�"OZ�-g\�M��'�������g$ж��R�=�s�?�5 �lDn���W��Ym�x�o�P��2=3�)�*�B��aNd���O�O��5��;�1q�Y���LƩ�g�E|h�X+�Y !�<%��$~c�|�W �*|.�+�ȥؗDŜdWa�{��R4��1��S��c��l���jnV8�v>,vr�����g|����eP�@�o����(>V�̀T�h�c�"��ʎ�4��/�|�`ۨxT`�vl.d�с}�H�D]$�Vw��o�.T�߶IV>h��F�14�Z����H�Ն�����P����A��l�G�T���b��ϕ�V�|�J%t4G2e���X?�ؔ����a�ebĺΐ���Z�Hw�0s�N�D��~���Փ�� l���#G�-�s���Ԡ7"Mheѳa<�b�+2|����)�|��=Ղ���'�E�O��*}��wԏ�Eܟ?^(1!�%���~�<Mݢ�ն����������ӫ�9aP$��g��]�q�{uVO�L�c��(��J(�:w��R.�6w�������S���S�v���?UA�#�=��xv.a��¶�^������J�Vb��~PU>4����iy�՛�V�ݐ=w��E�͋9C�_[�"���a�)�ƉF����P�C�9+�R�2J�o�,���w&�>�n;�[�f�{cI#�V٘�n<� �\���)�i�f����X^;Pq 5Sb�5��BR{�xpD���mg���!���Q�N��`k�^X������°ow�f���k]�Ҏ��J��ݜ�B�� �=*;F��4[�*�?3�g�j?�����^�"��O\\�[���� >j!��l��D��}�L�$�0do����N��SOVH�?|O~�ף�x�L &|�qI������aE��4dsjJz�D��O�tTHA���3�tFLJN5�c�� �|�P��Kkތ�9�$�n#&G����8���p�D
Behavioral task
behavioral1
Sample
baa50b95b85d2c45538ccc808c90589d48461a61d97a39a3a798d01879e0348d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
baa50b95b85d2c45538ccc808c90589d48461a61d97a39a3a798d01879e0348d.exe
Resource
win10v2004-20230703-en
General
-
Target
baa50b95b85d2c45538ccc808c90589d48461a61d97a39a3a798d01879e0348d
-
Size
8.4MB
-
MD5
71665f74e50f842fa0840a988397544b
-
SHA1
f2815772b03dce962a17b55371f634c907b96d77
-
SHA256
baa50b95b85d2c45538ccc808c90589d48461a61d97a39a3a798d01879e0348d
-
SHA512
5d0a7819a143ea5215429a5bc6cf210034a1b8f595fc2308c61ec4140060c72fecfbc0d1059208af3cade597132dfdaa723e10f1bfb988f5eabc80a298da6f26
-
SSDEEP
196608:P2xvjwSW0zS0DlwnsOU47irWiMgZrKN3UqXatlVGN7A:i7wdU1DVD4oPxreXF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource baa50b95b85d2c45538ccc808c90589d48461a61d97a39a3a798d01879e0348d
Files
-
baa50b95b85d2c45538ccc808c90589d48461a61d97a39a3a798d01879e0348d.exe windows x64
789474cf4cf38d03914dcb5e33ad8868
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetUserKey
ws2_32
WSACleanup
ntdll
RtlInitUnicodeString
crypt32
CertCloseStore
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 570KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ