���%t�y�O��r)�!(���y ��]t�3ʠ�^���_ڿ��ݛ*���F��θMHw�"i��Ԡ�Ƌ��~����$��k��Ka7��H�`�Dc�E.eə��GG�*�-������YB��m���M��{qw��k��zRH0 /���kbߢ�$�9����J�K�.y�Q�bKi�w�Yt�Ϛ��ʶy*� BT8�?xx�ԣao���'fk��X��7��¿�rB�W� ������w����`�a��Ӌ8�?PA9�z�s2�(��Ȩvϣ�<е?<sٟ�#�)vY���D�x�:|��kUg�_8&�_���u�֠j�9�U���Y�4n��Z+�� �!���77P<��1v�����h�ؒ�-����D�� �/ �x�m=1oo��_��M�29'[f���%��5IM����cu��65]�%J-5Mw�(W��_ 8 �s���旅�¬��E#k���?�M�2�Z��y����l�l�P�(�^����L8�iAėO� 0K���jSX���E����z�@�7�3�>�{"; 9&CQx��<�T����u-�߮������7�����m�l��Ds ��>�����3���\�ܬ����JH����7rkᅿ�Ȃ�<�e�s�L͢O����dqCKɡ���V��z= �i�3C��U�~�}�'��$����2׀/j��cf�ȓJ# �ޣ����}ƈ6�_�� ����v�+n���"A�\(W�ǻ�y8�ݮ-*��8E�6QA��K�þ}��Dx~�q^Z\f-q�`���>Y�@̹��>3���~�"��ΐ�K�,%�$.�@�_l�o��V�!��W�k�������ڷ��ј�7����V��ƹS7;�]�>D.�R�m�G�� ��T4O,��&[�c����v����_�CA�^hn6���Sم�/�Ka�N�%��j���i��͟����i6���^����������Y��K jl��+��|�p�_E:���i+V���+ʯ�D<������п^wQNn�)�8W���1�9{�eXP�Z���[<h���|5��Q?��� L�I+O�1���SrA-�01[�z"���8��"��k�����F����k���:ž��KW<j �G��&C����� ���5Aa(8�0F�Pk/�����Z���%dLBc9�!h&������i$����^U��:�T��9P�T_G�)�֘c<��I��V�I5�kT�*��_��0:=���ϑ��n��:��?�A��5�-;D Ϝ�a[�� ��m&f�<w������2�L���twp!��Z�T[��T�u[p��3f��\�� �Ip�E~�G"|td����t�H�o&fc��7�����s�[�����d�z��"����a���П^)�*���\]�Z�6�����)��{�E� 7��������ю��$����ʘ�;����d\�����i� cw2&���7�D�������8�[I�X$,(�S�õIk�B�(���]��=�W% ��W���K�Cˣ�3�J{����Wa��@�i-�3��q�E�U�Mc���{�:�;�)��9Ӈ&�!�A���0&��U�� � �:�r�cf���'>�JS�k�d��wo�x���� �d~]}�Ը��s�N� -�J<����(������l��v����'~��R��σ�n�(�%E���ʳז��h��q�Rr`[�8@m7Ғ��ʋ\�$��umu�W���ܓ���ϰ �C~��9M[�����y=�MA����Pr��]~��� ����=�Q�������-������P(i��K���J�U�_�HVy�`� �Y�Ҭ`#A,�� w�A$ ���y1�u�2�p��N�������9��1韂�e��p��C� ���)�R���:/ɘ���v9 폙wBm�z9SU�� Y�'S�b�<�Z��n�pM"Z(����&��[��BҚ�qq�E��V�"dB���艱�Q� Z�6�)\��, w�fw�*��Jd���_�P�K"�#�� �7�]�����u��6�IR>")1y<�f}�ka�F3q��n`h��O�T���M�կ\u�|��Zs�u�u��z_K��j����SL�y6MQ�pF�ܨ�n�b�68j�w����7o�﨑�;h+���#��Ѹ��q�1������W���÷�b���l���0>U'b���4� P�������UQ�F� ��)�(.0��M�'��kM⌺��G�eo$߾�4�ŲS��_�geu��$��~��Ă}�0��J��fp6�Lj�](�_q����2�d\�~��->S� ��U��W��(KyU@�y�wÓZ�EAcN��@˓� ��+.>���'�M�`Cd��̺��M������Si�;�7 �ׅhF�K:�f������|a���BN�_[��h�y� S�6�Z�$�SI+:��g�9�íP�m���;�bIg�4s�cp�g�e �r�PjO��=��n\�9Y6*7z8F��(,��U�������3���{ہ~�]�_�E��9��'s��C����_BPp$�����6R��!ݚ�Y9�b����`K�@9��Q��&sS�AɚO�x�9��zP�"�*���"�8����ɋo0�xB��*ia�4C��~0{Q W�9�����T}��°�w�s��鋏D@)�3���$�@�#>��]�l���ti-��6ꛕ�o^;�!��nu���7���m}t���� �!��� v�!�(K�G%�mG�XS|J--��w�2W�鿶%�nL��o(����m4g���o� �Q ��)� dw�=>�#���;* �:���&=�{ٲx��E�=c00MbG5>m�q�ܘ���"N���w*�1R�E�M�������֔�������A�3�rP��a�ܕdm���x�ԦG�����@�l�~�d�%��,SN��(><)�m����ȥZ��] >���"�P��/]S��u���v�RUƕ3)��Ӈ!�z��(t��3��\M�1:�Ιz�>FHgX?4O�����9<��L�*Q����jq���K)9���[�+S�X�s�'QT����M�G̒X���pV
Behavioral task
behavioral1
Sample
d758be14c3a107f9803e584826f0b9596a5da495dd0daafefa5bff6ec3f4d49d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d758be14c3a107f9803e584826f0b9596a5da495dd0daafefa5bff6ec3f4d49d.exe
Resource
win10v2004-20230703-en
General
-
Target
d758be14c3a107f9803e584826f0b9596a5da495dd0daafefa5bff6ec3f4d49d
-
Size
8.4MB
-
MD5
a61b44536c973495028cdd61111729ea
-
SHA1
9d508332cafaa60e424aca84fc0ff34ba32c2a41
-
SHA256
d758be14c3a107f9803e584826f0b9596a5da495dd0daafefa5bff6ec3f4d49d
-
SHA512
b8fa6ab96704fd8f1bfcd5e8157a5e76b3858b26d7de4a7650850e278fea8fe8b0407d5cb39c3f77be82f1e4edc83d9a597a22a388beb0f89bc80e2757859fc4
-
SSDEEP
196608:FtoxIApO8371EjZQoEtLmk4ha2vuWLy6zO0J/i+z6:7IzEjZQ15QFzO00u6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d758be14c3a107f9803e584826f0b9596a5da495dd0daafefa5bff6ec3f4d49d
Files
-
d758be14c3a107f9803e584826f0b9596a5da495dd0daafefa5bff6ec3f4d49d.exe windows x64
0cf722d200a7d5dbb3a4083dce48ffc9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalUnlock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetUserKey
ws2_32
WSACleanup
ntdll
RtlInitUnicodeString
crypt32
CertCloseStore
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 569KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ