3�/��g-P�OuW�$m�D=����n��?23=f m��B�2���ێP��}���N�)tp��7�1#~���njq^��Y"X���p�G��ϣ���������n����� 3�{h6�Z��g����p���t���b7���2��,����{%r�ݧ���K��Y6��W������ґ��ύ�>��pY�[�<��48� ��� _ӻ�m�ԥr�0S]��#;�@���Y��e $)x�^�~sp $��qV�`���Z��IC��ʭ����h����v]�ZJv|��SϬp�9�8u �RLf]UM��oG �����In���D LR���^�k�S(~��O����PCQs'S�N>�D �C�G8s=!<���K�Gv�����j�с?�Y_�$#����l������2�S����ͣr� C�S�z�+�^�B�yN�؊�|��|�=�3��w��SG���A�=�����2EWױ^~[D��������J���4�g�L9�"/�El��Ы2Y�<�e�\(�ʩ�l[8=�>L�p����E7� _��Z�:�n;a�,pm��7_�3�Q�hY�Ȗwc^����p�m��vKA��\r������<���e<V�G�EX�p�~ht���Fs;�7}�d[��q�@3����eDta bߐ����A�4�V�u+�A!�r�~��������P��߈�T�VN��9b�R>f�ž��;�����:�94�~w�� vg����]ch�O���@ܠ<T�0%��~�K׀C�Tˤ��&?g�O�4���7"��t`;=�UwG��e"C�����ssr̴�G|���w�Ԍ����F������QU��R7���SM�,ԟv��}e�#R\\���i�tLדQ���V=<L�6��C4���2�f�T�$�L���%D,�����"fd��Aq)p,z/f4��Rp5Gx^�;�ϫ�B�;n�� �qh�>�+4�?>VGl��� �6Z�j>TO y�d�0�E�� ����"�M-��fTrS��&��|�y�� �[���^D���*�&bl�Q�p')��\J��\�mc��Ή^6ٓ�dӧ��젍�2�w���fB{���i�{Ԇ���Q��N2|�B�_f\��أ�����K����1߳B�oi%aX-�i�H�鯈A�`�f�l�T���w\��יJ���S���@�0�[Ș���������,�;�I�k,�)��a���)��FeK�� H�vY4��Dщ��]�T��$3s�͇� ֵ�T�u,�8�}���PZ�g`D��}��.����f76��RK�����K�Һ�T���`K ��F{|��T��)�C��77��\�6�n<Pr-0rʷ�4͌�z���Q�O��;�ΔM��Td�d@G(��)5W�p�ih��p[+C�����2��zo0�|kɱ�.�h�U_~���Ԩ2Rm�j����'��>��}��^���mw���d�9��a3x��������ϊf�#���+�3}(x��e]G�0Ȗ1�#���5��P}���e�N������#�q�EV�.�뎂M��<5o���M:l�nר*�[��%�݇I2Z7����-��#6J��{�闄t~�^�B��ݑlp4�_�/9;%u���m�u��d��>��$�N!����n�w�ְ��*y�ض0��ƅ�SO[#5 t���]��rƩ���0���ߡ{��k��-:G�e��9�����ni-�R�j��4*��<�R��z �?�A�/�)D�3��L��og�[G�+�LZ-�<��[��W}�����������3�������<:�-�/Z�jĠrʕm��Yc�����/�6:�F���GA�|>}�ZYY�u�/��1;�-�M�'%���/���o�Pv� R������۾oAT��l�5w3yt��k�꿐/a,ͫ���Mi������������s!$4?>�yb��߸Q��wIXV ���GH4���P���o`2��\nN�<�2����@�I7k�0X`��f���NWx"�V�x����I�?�_q���[$����F]s:� ��%�Pޢ�_2(o��82A,=��X��s���,�נ9_h,9�� *@n��!�'��'�{�eYY�-o���k���)$�w�a��:�/6��3Aݷ[�sm^�3�����7y�-���X��_�m$�t��VI��,�R����J����?}�69����?m�ƒ�[��e������ѻ|���ٻY����:8[G��0�����/�����F�Kf�6 �w.��*K���G�ؼ����,t�"yҥY� E���x�x��go��V��b4��JH`�$�ucmS���*��O��z�՛<c��,<:� � �8 D7�z��~Ϲ�0�Mb�`���X�n�8����{�MbYp�����f�~W���:�q�����?e�S���<,�o4����?,��xL���x�j�O�$e��W�Y���&B>Q��31|}�ou#�8�b�;���UM)�,.�����d�R��Q�x�Y�T;Ν'+���<k\�v��ceX5����`���X��"~y�G3������6-��Q?c3ӰC#���r ���(���Z���� W�V��g�b*{ae."�A 6�/z�0��8��}��q��i]$e�� '���tڝj�D��v�B��ڵ~��;��s�B#�E�"���+����{Qg���~7Y��m��Jl�A�@;�������[���x�M�"s`��,:��T9��)Z���G���o�I>��Kxa�������!��=�r����I����<(�>Ӓ=˔��Y�H�$�<M��㛔����)0��M�5���?��8�S�g2��V^�����`�����;� ��5�:M�`E�QO�-)!�B��}H�^���DII[n�*�^���&�S���(���R��z�[K�?KWh%�z$R?y��'@�_s�ԲT�/}]xm).4-�8}%u�>����K�؆�g9��L1%���r��a�*�LZ� ��6z�Ψyf��9�����B�K�.z�+�[���
Behavioral task
behavioral1
Sample
0b23acb261f83b2dc1fcafcd187c91e8897a7867f71cec23d4bdc21f7611b350.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0b23acb261f83b2dc1fcafcd187c91e8897a7867f71cec23d4bdc21f7611b350.exe
Resource
win10v2004-20230703-en
General
-
Target
0b23acb261f83b2dc1fcafcd187c91e8897a7867f71cec23d4bdc21f7611b350
-
Size
8.4MB
-
MD5
b7f9e60b136b7eab5d6a8d3ad5379d7f
-
SHA1
9a55732e7e729c4a93c6cbf01b49e8870ad790bd
-
SHA256
0b23acb261f83b2dc1fcafcd187c91e8897a7867f71cec23d4bdc21f7611b350
-
SHA512
17770837ae932068cde260cb395dae1439b59ebe30a70f02a5fa643a52022962929d90c458fe131fa73323779d41c31b09decc105db9b0854b25a5ee36adcaa4
-
SSDEEP
196608:ivrgl8AsnJVIC5DLXYedXqDHxpaUKzk/zuFWMiaJSgezI:iOmJ/nXYedXqz6tzk/zus9aJSH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b23acb261f83b2dc1fcafcd187c91e8897a7867f71cec23d4bdc21f7611b350
Files
-
0b23acb261f83b2dc1fcafcd187c91e8897a7867f71cec23d4bdc21f7611b350.exe windows x64
0cf722d200a7d5dbb3a4083dce48ffc9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalUnlock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetUserKey
ws2_32
WSACleanup
ntdll
RtlInitUnicodeString
crypt32
CertCloseStore
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 569KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ