�U�4��� �Ò|/&�{������]��Yw��MZq�)O��ev0��u2�KY~�lx���F� �Mg?uHZ����,�O� ��F�A,8��Z�:ƍ;�=p�Q�I)(����H��uH���=��N���)�Cd5��?�y<��ӓkP�_��6��Uo���v�E�z�����+������J*�`z��h��Fy39˫�����^t����EH�v�i?e/;�`r.6r��������)����ia{�`K5$���� ���ߧ�t1�씩�c(g�@0���WV�Y2���-3UT��촕IgkbS�5���Z��]��U�s{��{*�$U�;�?��Я�q�\p��{NUV�lu��[`w8:�W�T�t�(��_����Z�YU��9_x��I��������f��� ���k�뎄��.����/N7�sG�R�L:�4��6�`���N~�?=�=Bz+��MX���y���bm��2�4 Po)P����&����2�Ȝw�,�Le�x݆z��.�X T�s <���ǟ��$'�Ah� !<�/�uY�/.���{�y᪥f��+q n�w�!DX� ſ����(�s_r��T5�q� ��1�����Pb!8�*���ת���_�(1��ۚ�M����6׆T_���>�>n�b�s�� u?���ȩ�Xrg�|S����6l+$��e��.�u�A�j���F��a�)�e��Z=oo��ي���d�9h���n0Ct�K��UӃ�8l=��G�?�9�OhY��|����4���9��5��(X�`RI��w-����[�1f��/<�% x��]���,r�Vd��}����tx�v�?b�}s���H�ڷN�'}�A ��7�־�{hV߸D�����$�9��W��dG�;��d�hc�z��j]�IMz��e����j���@�e��ѫ�R���<�H��S��\}_���Jp�)j��H&1�%}��>}t�h�9����8ľ`B��O��(KN`���ٛ�����+Gu�?n ,)����\��\!��X4��:N|yV���L����>����à���������~��n�7K+iC���_���|���%g�$bȏfPF�2*R�C[�E�����!�Z8&��@���p��}�Mݮ�A���Aw��å�L`缇`0��HWz,w��u��d��5U��Z�|;�wd�:��*���*%�O w�k>�w��b�D��n-D� ��*)�����J��w��iLS�dB��:�8I��pzY%!��5Iu*U��LM������� Mk^�x�2�/��CD��C�����(����؍����ay��`.RU��^:�=�?Y����:&/ˈ��lxmS�/B4À�����Cmg���3f��'��@z��%8wYk�V�P���>P>� l�l�v��0���<-u�s��i��]�&��Ǵ1���7�**����J�jlX-4���g0[�h�\�C9�JlCn�i;xQ�?}~������� �����N�ə|i|�"�ȣ��OoZᴅ�&�Jo��VcPf�$H����֍$5��$�燡��������_��Y<�_��kd�����:ؖ6��P���磽��v&����Z�!7���45�j|s�B/#Ѫ'<�b��xvGyƂq��\���@͔�������x�n�-���?6���/6� ����kl������������ϔ�I�Ȇ�:��N�d��xjT�c����:� �������O��9�2Z���Ka��h�T���0� ���]�)V�<|.�l?j�Y���Rb��~�ΙF�ӈ,�o'�h!ON4?����@��s�&����h���_ꍴ�>$Χ���4�V,<�O����5MM����((�oWmc���-�-�{[h�6��^+��1VA<s�ս(��%��^5r��u�>�� }�U����M�~Y�\��H��pIW�e�����$�᱔�cao��Ɨ��S9 �O�"�!ۍ@��4+v��_����G�et����̱��a�Hw���0�epZAQ��Zf0y����$��W��2Sf�G�B=O8�����4����o��c�T�>��f�!��<3��nKV����V@�;��q�)�p���b(%>B�5���:�������R��z�*����z�ZS7;�N_�4�����4(}?��WA��:�K�q_�:���ʘ��_�\(�I�/ӂ��-�j�F��XQ�����^[����9=KL�n4^ĝh�+�l�^��#%9V#2E.���lr���lHV��$_d,�$�P�9����f��~,�s�,� J���_g�W�l���Z����r���3>�(�1�Q���ޮ������#�+��@����G6�7[2�;��u�4�b�.���>��.�����4� �3�"(��ydǐ}?r�c�W���� �@�,�ѯ���c![m�v �࠷7}�ٟ8�Ǒ���r=��|��lE��=o�c>�^"��0q-c������8^�F �1������6$G��{z�q�Mw��ls�6�-6t���:ڧ/#��4���"qȡ&�o��)�N��Ǹ3�':w�y�xhf�,�����}��:f� �n����~>t��XX�v����f}��G���ř*��k����W�7�=;��|ſPaxւ��,�C����b�"r��?nd�(���3�2렕+Sz��+ˏ�^½Ѽ;4��2���4DȢ��͑9��$���?�GJ��~CH� ��+���4�+KdDMίߛ��o�a�� 6#��5�]�| _� �Y�G���'���u�������$.DIsS9����X� ��Qnm�f���K���Y�/*~�@�=4���I@Q�5�>g�\��O�cG���BX����M-��� ��.��7�WSRp$��O��m��J?l%��o�q=��|˵.6�!z�c�:�m� ���ql�����nŦ_� �@��L�V�+���5��ư����'�m��cW��p�2���G�A �M@�͂�v�zu�'�L�3%���.�iS"94g ɀn����(���{�)>X�K�/����
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp
-
Size
6.0MB
-
MD5
bb01b1c545a1f35e388d414989a9d0ff
-
SHA1
5a96b23399d41bb2663ba21e8e7853a89a6a2f8f
-
SHA256
df26ed3f9c02be0d8aaf525d65f98f52a3f91c8449e5e345a3be0fcd8af31be2
-
SHA512
33b2794bc7514f059320ce4243414b1034b13deef543a341a4b74b5db191031bd521c73db8e904aa60a49f8f5db6a3a204d4128e850fb8a4e597a69aaad6df0c
-
SSDEEP
98304:mFvGmLtE0bYlZl3EVzt2jQch2WVXZ6yW6dtDABWo+1mKLEh1ofg/raI+aeh4BrwS:m20ctUzr4hFslg9AEo0Eicra7aeh41Zx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows x64
6ff193b25324df0752b5c3094181f651
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
opencv_world480
??0Mat@cv@@QEAA@HHH@Z
kernel32
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteObject
advapi32
CryptCreateHash
imm32
ImmSetCandidateWindow
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
ntdll
RtlVirtualUnwind
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFindCertificateInStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-stdio-l1-1-0
fputs
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
bcrypt
BCryptGenRandom
ws2_32
WSAWaitForMultipleEvents
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 813KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ