�!�J�0~��ԤFy�����8�``��e`)x���~���>�Pӂ���[l�T@P��)�>&���_b-s��}a�";HQƤ��,^�弭��ry�G�vl���}���dbڧ�غ۽�>���_t�����X)[����b*b���+N�b��z���s���je7l<f&E?��N�M��5��X���i ��8��j}D��c��kO�M�L��5�H�A[�h*�'�U�3d����8Z�}\�T��=U�r�� J2��X�/#T�t���2R�QŐͰ&�G�*�L>�I�=���y|��z�;FN�?<L�� �z��Gb��W#~��S���5�x�7�/W��Ses�|��:�{go�Ÿ6.deGº�}��RU��;0 9��:p�R�[�ZZ)xt��qxb�����ʏ�pm ������(iK�xJk�]�֟Q�]�3FO���3��dP�Xp�D��x p~P���*-��a�O�c��g�J�Λ�LG��>�~��o��i���1��m�D �.�\�{�s�y���cL1y�fd9��F}�h ����ǁ)d�V9���Z-����� ���y�dk�����Iyܸ��y]��j�ɶ�����-��L7J!��IK�}�uA�Ĺ��_�l,�+!BX�Qի� Seȸ�گo�^"�>�����}�Z?1��8ە�1o#�6�����q�Z{}L�7p��I��3E�8>���5�`#����\>(�.�|�O�����D����UIYÎҥ)�VV܄�EX� ����1�#7�m'����FM�X�O����?�U�|��I��,�м�fx�b�K�w�Xv�����fC�I�k�GO��û�ҡ'g�/nr-�3�����9T��7O����*�����p�����L�(���kا�� L���E,d~�k��釁�����ց��_����s�Zj���x:�8dο�QN�m�둞si.&zނ�"36�;%�E��h06j����I�9!s��a�\s�]���7��!l�s{/��ԓץE*�̑��]-�q+}A�M��R��k�ζF���0z�������������.��h�c`Λͅe)�&=�KC�zb�}c�T�:�e�n*��Xٍ�����;e)ܯ7{T� ��(�sZ��\`$TTБu����8Wi:�:�1(%PV�4B�[�։p#�1�hݪQ�߁ ��̖]g��Ћ�y����!aq���߶i�Uj�o|D�<Ic]����_;�%�6���f{�E��$6�c)�Z)t���-#�o(`��w��|�l�N�KF���vA�MQVG��h,)V#�̽�����y¥_�%3fz��ǧ��C�Fp�Ҝ�3�F��e���lp?�Y�@ET�t����%'Z�.����� �1J� �(#��0R�9yJ��Ao��ޒB�^8�9~hS�M!�����l�IjC�'L��Z!��ȗ�,J̖B�P�2S��W�,(#���_���"���4�"=h�؍��.� �ޡ��z�=8"���0H����R2��J�E��9�vn��*�z����h�b�Z`�^�G�O��v6�{<g�K�U�<��x�;6+�5�|@�,�<�b"�ʭ�"���&�1�-��}or�?�ȭv��QN�i���)�{f���0u����Wæ�?@a�� �\�{qI|�9=���Q4�ϡk�A�*jz�1xn��#��P��j�h�� 6b<�>�n����M*+-P�mL��s����@�<�q(S�*�!Q2|���|4�(������b��R �B�0� ,h��$y�����V+R<�De�3�M1�IF!v.1u%���P����/J�@��`� �3�g�����S�xM����ϣTZ�g�N�R���u����_���ze9'^2��{|������`)���]���붊4Z�Р���T��-��$�;z��t���<j��;�P�H���k^1;�Ѽf�n֓�:�!�M�YГ��3�B�� � �E�q�Th��]�wKKJ�p'�m�U�D�<�N5e�e.�+�Ҏ��p���5;;�+5��7�n��� 5`�Jd1c F�B��D�tQ��p9��.��3ꃥI���Ƨ�����!�BѓH�f$ �lO5�r�#1X�[������[��_d���~o`������'P��4~��"��0e��^�o�bڭ��8�暡�<GOΛ�ݭ��U��DI����Q}RN�|n�Ɇ|�N�p���@�H�lEqwv ��O�~|�U�u�yjP,��Zu��9�����Y�6��oSQF�1�ȳ/�K2��Yє�8���׃��k9T!*(����+�o��V΄7F�)�<��A�?��L�c�JUZHl�4� ˻/q�|K�@���羪,\��BX;�c�8M�\��1�jGM�<�9m(92-��x/���+Μ 5(MomA;��<���E�#�^���Ws�<��m{'�H�8��'a���Yު\I� �,`��i<e�Kn��p6���a�.SŁ� �T�������-vA��Ȗ9�����R�p�l���~8ߕ����a0w�}[G�28qO�1`.P�%�m���6�Y{���Y_�p�� `;S����g�Y�.��<�m��?��nt�_t��z���_![���gpU~B)1�e]h�D���[�5�eu�SP9���|}� O ���8�H�9U���������t H��r��TK�G;�2���F�@�C4���g����,bȹ�(�h�r�8� [��|����(�X���?���h�X�ٕ�7���TR��9xu3�A�ܷeL����u^��)���j��otݭ��B`��V�>~J�L�/Oq�m�$� �Rpd�Gª�!9���.�w|X�*�#�Pf����-Z�v�IX�p��2����J��SC����6]�l��H�f��9��Zk��DgK�EQA��A��]�.���Ԯ��;K�����B���(�������nei�;�%���:q���\%�iQ�:RN��>q�*Q(�s�NcXb���Z綟��%|[X�#@�c �͌��կ�z��NqЧ$��C�!��@��U�<A�M:�Bw#�\�ʽ�Ah͚�,����(;
Behavioral task
behavioral1
Sample
abca234acd94ce8555eb6430a5e066d7cff92183abb6ec90637ae1f981a6a532.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
abca234acd94ce8555eb6430a5e066d7cff92183abb6ec90637ae1f981a6a532.exe
Resource
win10v2004-20230915-en
General
-
Target
abca234acd94ce8555eb6430a5e066d7cff92183abb6ec90637ae1f981a6a532
-
Size
5.1MB
-
MD5
8dfadc13894be8e34e6af447e046772b
-
SHA1
ac6670cf202b0cbe328c91fc2c584917198e74c6
-
SHA256
abca234acd94ce8555eb6430a5e066d7cff92183abb6ec90637ae1f981a6a532
-
SHA512
6a1a140db0c2fe7b605ac5aea656cf55745522a5c2a591d88f7b294a2524730b222352bf1be6abdc407ec5dad0e60f302681a8fd24b235e651aa6983628dcecd
-
SSDEEP
98304:ifwUkakY+rYk8zE0E3WasB51vNcL9DDps4tsI8AZyAT:M1orY/AWa655NcL9PptZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abca234acd94ce8555eb6430a5e066d7cff92183abb6ec90637ae1f981a6a532
Files
-
abca234acd94ce8555eb6430a5e066d7cff92183abb6ec90637ae1f981a6a532.exe windows x64
29ad719007176f7334efa3385a9d146d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
lstrcpynA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
advapi32
RegCloseKey
shell32
SHGetPathFromIDListA
ws2_32
gethostbyname
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-convert-l1-1-0
_strtoui64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 761KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ