:ƕ������d�%��;�W�B��0��t��!}�'\�P�)8�3Dp������q8f��kqS� ´�xǾ�V0�F�8�zt�S�T���r�{iU���E-|tw%ץ���8�t�v;K<5��-i��{.���ׄ���@^V3����v��;TrdEt�g����Jw�s֍,�����}m�ҧ���ԛ�/����:]9�99y�n��]���8��5����d�G����l/�մ�nM�g"���Ay���Jі= ����;c��������/� ������J(��x��.6�:�J���KB[��=S���ւ[!���?P%�fD��@�� �M�#��x?5�!�2ҝi�"��5\T��ߞ� �Dk,*��|�?�65�@�\��O�����궉�\3�M�~��8�&5�eѴ��wJ���'�l�+lZ�Cea:ư�66��Zy>���Y�)XtH1fޱ��ɏ��:=$���`��/'�ݖ��ǡ���R����_��3�x�����pK�|7VA�`6���"����C�/u�e誩*'���չ��}��������M ��R��Qw���{*��b����S��40��^�"���vK�q��Ql���[n��3e�ݓ2A���T�$�&��B�PVZ�P�B�>��jY�0����ia��)�Ws��3�r=0ɮ��e$��TΜ�����^��]����'��P�BAt;@Ꝛ�.瓽QR�E�.� Bh4�g�6\�8�B'O�r��c?��(�ɲ��5��"�����̿0���+@1g�Z�pȁ�W��~-h3�5���L�x�C����yeWre���:���\l8�r��qd:�7p�v�{Br|ʢ�>)0��/��@��v���z%��̄��%��z�Sw�F�����!X��k�z���b�!R��o�:���m�� %}z�T�_8^|RQ��r�3a���������sQX|���-���T1kSdr���2�'�{il���ʊ�wˑ�//G �8*^=���+p�_o���N��57��5� {�N�7oє�qn��:��AM �� ����:U)��Q�5 >O���C 3")��UF^d�w���y�N��'��p�;zBd&�%��`�`N�*����C�Q� |Y��̢P��������Si��t+'��Y���.���K&���%I���Fl:�X��̙� �ѷk���9�����p������^כ�'!a2�k7��� ��P4��h�&f�u+~<�In,`����0��O�x��Ifz+���ҁ ��rU5R���T|������[S9����(����?欢��S����4��[�ΚE���,wj�u(���S/�GP� OG�/s#��gn�������B0k\��by�!����� :�~DS� ��bh�o��1��<�B9=�-����EDf���>��T���K~w�1BΖ���d�C�*?w�-i�ۨ��E��Xqo1�{�]�����J����v(�G�guH4��0�T�*:T�VDb�u���im}1��=p�d���,��bO����~��/�� *�(��/*i�e�'I������k�O�!��}�9%͠���SB�$^A+ �����Y�\Ąօ?�PT�!#���r����ZuöM�n��@�������n˕U�A����;�GJ�����_�n��mXƓr�����,b<���.��f�D]��p�7�3�+��5f�^�h���<�fj ���7���Z96r���W3Q� � t`}k[ڳf�=�O6l�8U��&ev�ݡ�x4`�%U]��˪��Aƙ�~��vhON�����W꼶��:p�'���E~�ϡ��ri��px��/c��@ך L�`Y�({�Cj#w�Xhfɡ{�]#�_č���_4t�����o˜���{r�q�N=͡�@��_�W��W�A@�S-����5��He�����â�d#LOjޜ��/&��%�k�ʿī}��l�g闊:iR`��=���J��H���,R[ w}��� yBl� l��L���A�S��ss����kM(Yv�s*�n����k��~&B^�3CeV�����ӎ& �*�4d^���,n}~R��W F���-����H_A��h2ze����#����L���J}���mӋ�)P�ߥS��/,��e���,r���A�*BQ��m�n�9'���SjhO3S����Lؘ�Nt��J�0r���}�ݤ4�8�y�4Onv�}: ����TOa�$q��z� 6�m�Ѯ�t�����p�����U+$�eT�SH�Wir����7P���� ��ME�li��H��*��H�O[m=�B�@��`��1=���^n���-3��5�����^C5�T��DzE�[��H��&��T��Jw��L��Gl ��]�L�֯���|X���vGFԦ��)��û�c��p387��GE��;+�����A�)�菿�:�[�wΊA�A ��_FyA�4�U i�6q�X���pm�#tX�>O����tϻC?r�t��>p�d�4s �|Cj�8�Īj�Υ�G��퀫���ˑim����{����Y�D�H+��$����D�[SK�p؆�|K�V���u������%��j�ϼ{�L�Ml�������4��DgЌ�<*�6kv{K &��M��[���eg���? !i�n���;��.�˞�<%�mv���'��P��ct��c�7r^�����]��t�$&fG!<N�kA��GZ�.5G�d�/���> *1Lq>��t۹�������)%�^d�МU�e ;��J�?��Qu}۫P��Ag��Z&?��!����Rd��s_=O2:�ZO�=)���j\/+�~Y)� �e����M��Q��?���W�T%��c�śF�bU�O��e�,��9��p�IT��V*����;}�l�s�H����4��v�Tt� ���/�f >B������K�?��0.BkL�}�z�'��@��e\M��J�`��E��:�E@�F��CߪN끔�T������Y���l�=�Շ����j��p���0~w&�uG�I�UF�Y��Ƴ\,X
Behavioral task
behavioral1
Sample
6e341294b8a9436e3b9f4dca3021377cbd9d16bf1852733002badc5033d29239.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6e341294b8a9436e3b9f4dca3021377cbd9d16bf1852733002badc5033d29239.exe
Resource
win10v2004-20230703-en
General
-
Target
6e341294b8a9436e3b9f4dca3021377cbd9d16bf1852733002badc5033d29239
-
Size
6.2MB
-
MD5
5d9d5213f5ee43be60102949a734da4e
-
SHA1
bd6facdd0e44c9c9e2aa2960b2cd0f79d9991420
-
SHA256
6e341294b8a9436e3b9f4dca3021377cbd9d16bf1852733002badc5033d29239
-
SHA512
760ad54326535d646c2f76fc74259e4bd718bbb092867f06a6da0e85dff1d61489a89daaf44da30bd9604ac9ca6e55d502656ba6c2a28db70c994625267281df
-
SSDEEP
196608:hWe8Tai2mOhkfC37rJWHONQ+xMYKN+tV4I14i:72ai2jhkarJWH88nN+x4i
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e341294b8a9436e3b9f4dca3021377cbd9d16bf1852733002badc5033d29239
Files
-
6e341294b8a9436e3b9f4dca3021377cbd9d16bf1852733002badc5033d29239.exe windows x86
065803adbdcd9c2750a55cb42644f7fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EndPaint
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CreateProcessAsUserW
shell32
ShellExecuteExW
ole32
CoCreateGuid
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
libcurl
curl_slist_free_all
softwarelog
DestroyExportObj
wininet
InternetSetOptionW
winmm
timeGetTime
libeay32
ord484
libcrypto-1_1
OPENSSL_init_crypto
version
VerQueryValueW
iphlpapi
GetAdaptersInfo
winhttp
WinHttpGetIEProxyConfigForCurrentUser
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-utility-l1-1-0
rand
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ