4z���{�F�R8�.�h�D/��Ƹu�3��1q��[;.�R� �$����~|�@��t�v�M��� <�D��N�_�����-��3�p:������2�ƶ�/h�\n�+��(��M�e���@`~�w�e�P��y���P1�����ȹ��r���L��o;�(W�A�|Îv`��Ed���$-��[� 1�H���\R��p�Pt��f�-�����V�~Qn�%���L48�q�39WI���n�b0n!�O���;v�+�$U/?5���;�����ð��� �`֜�VA5r�M�� O}1�ù�횸 ��c�Q�(�r�!?���{�PPYoE���]DIٰ�k�*�&"�*�>as�n@��ƭ~?b ��N%N>C]Ք�6Vp ��r7/�O�&Ǯ���������*E,Ds_,���l<�_R͛��V���n�>���r-�,j����l��J�pk�Ć��9w��#u��g�f�u4�^���z#�C2�&�[&�2d6Nv����g�v���)�ρB��[Y!�o�)��LU��p#H��4';��;Lɓ�#���yZ��/-����'P�/a�����͂*z��|^$�����؈?����]9&G(��N�cK;�����9��ڏ�;��N,-�4F6�/�~s��� ��� -*�a|��*�E^�"p[g(y����i�j����ɉZ P�W��5�o�UH� ��2��fcPز|µ�TI0�su9u=gB�z��G�I�q�����.0����a�cI���a ��D_������k̨�*���U>��o�|ɂ^�Y|Ѳ��f^ ��n��d�oY���^w�����)8�I\�i���N�����j����:�����G:´�3�Ch����8���I�_7��:�雚�����Ҕ��Tvb�����'�[�L(��;��K*{W�T^-�[�v���؍�������SDZ���(sV��d�5a��7���)ۨ�?��4M������<_��ߌ�n2B� hC��#���p�A����kn2�������'|\�+߸ �<���y1��"Yq���c2(�� g��ѧ��ْ�CE%"&�E��[�`U���~�Hܭe�p��]��s�GX����I��M�X����E7<b��8��v��w�0�v*����b �x��� [�������9�+�nA�z�xm�%��l!��%�"�|ZNt��'���M?�.R�k���+\�D����d�0�30��?�ۻ�G�t��|�F[�7Ά����o�K8wq?>���D���#�!4��`���c� ���d�LٰBUt�8�0����y�`S3=p�@�>c:� q ߾��'�����l����t�ch�B�)2�6�����w�]|e�'�p��64wvؙC���p��(Lj�8���.B��F��Ys �+M��q��cc�:_���T6?�s�JTԂ�<n�u7$<��H������PK�E@Dzf��,Ra�p2� Car�imuݱ��N��R�ͬ �Ĵ�i �u>��Z�c�:wm��-��}a �[PJͲ*�d��,ĢVJ��?��t�t��pwZ��Vt�B-��$cv����?ع~`.*�h�j㧍Pًv(���f=ɿ�� ��)�}H�����ha��Sl����Yy8��Y)z��Yh?��!���H/C4ЋSbB�2 {=w��H �F�:8˒�CA>�Ü8+ �������x�$ذ�ck��>d���q=�s*J�T�������2����Y v�`p�Pj��s��� 8M�J�*�y��LF|>�+���/�k����l~ߘc��ȓ۸�fO���.�/����CgQ�C�j 2`��$�O�� �HuyB�p��f�ɘZ����a��}�h�*Nқ =f'm �H�)�aiv�Q�p#�+���s����@?ة�iĖ�q����&��\ތS��Oae�J��k(��������;*'T���L(H:�p���3�%�B)2�c���� ���Cw�XEi[��+�Y�A%C�����(��_���@�?_����>.�0�l� �p�T�w� Q��<���'Z-E�.ש�x�t=?��fy҃u�nҧ*M-е��A�A`c>���~�&�W��[~��!3m�)Ǔ$���*�Rۍ��<Ҥ�k�3���qy�$�g��uc�::L���<S��5G�f� �ł��9�CQ�X�dRr�(v�Mb�>a����NM�2�z^OަQ��)(�C����(3~�A(=�eZ�C��f2El()m�j��5�Y��$PNgW�OR���}�# V9�� �^G�8RJJ����k%���N�_7�k��y�olڗa��s����x� 3�w�'ݵ����bu��s����vn�hh�=�����8psh�����:�N��Ǒ:K�xc?�5ik�{����N��7I����_$p'!^` ��p(U})����Ѩe4Fn� ޢ��v 3��������*˸ �l�JŖ�n0i��4( ��^X�^�&�ϱ��M�=�����B�C*=�s2��%����|����XZ�:4��X�� '��^�O�d�jG�kyR�o���o̭�3P�S.�7P&����w���Y}�,C�ȳ�$N��o���k��xݬ�E���Z�Ki: �z�� ��|go͏C�!,�e,a�ʴ�ց- �LԮ��{Kf�if �m�2�R-c\���ǻ�R%���w�t6m��!<������/_s�W�}��B8����Sx�������Zy�/��:f��&Ϫ4��T(�}�jނi��W����m�dL���e�[p���6d�BW���ܱ�U�c���Kh���ѣ ��uh���$Q���C�6�����3p��� Q���$� �3_Q:��X@�ل��!�T���쬀�,�f�,5H�]���77�ׂ ɋg��Qt�ٽ�Z~���bzp�������)�ׄE\�R#�g�+a �@���9#���# aq0Ɍph�4�(}��a6�ɐ(��۞y��}c,Ǚc��8r��ȨCfyi mh�s�V!���o�kށ���#
Behavioral task
behavioral1
Sample
748dea6622d2d3e9e032d405cfcb0ff5b09d0adfd68b76658d5b867da2121791.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
748dea6622d2d3e9e032d405cfcb0ff5b09d0adfd68b76658d5b867da2121791.exe
Resource
win10v2004-20230703-en
General
-
Target
748dea6622d2d3e9e032d405cfcb0ff5b09d0adfd68b76658d5b867da2121791
-
Size
5.3MB
-
MD5
d0029e150491c74a5dfa0b730794616b
-
SHA1
d3c56c373044a2f3bb9bbd3cfea89dbb922ee16c
-
SHA256
748dea6622d2d3e9e032d405cfcb0ff5b09d0adfd68b76658d5b867da2121791
-
SHA512
22afbb568a0b3a3a105dd767cc02ce79ffe9c76e5fee2e46d76323faad7c94d5f151a96f946076ac73eacfca64cde33450f38c19065c12f9decb4bf759b5e262
-
SSDEEP
98304:zppkzBd6Z9dNZ+xpxsHCCkJDh4NXRvTLvIDDcgLP7NdyZipoIDUZ:Fp8BkZF4xIhkJFsXRvTjINrbDrQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 748dea6622d2d3e9e032d405cfcb0ff5b09d0adfd68b76658d5b867da2121791
Files
-
748dea6622d2d3e9e032d405cfcb0ff5b09d0adfd68b76658d5b867da2121791.exe windows x64
61312090ef94e8e0b69e49414abadd43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ksoxev64
DllCanUnloadNow
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zaas Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ