?摦��̃�����!������Q����M�y3�<��?&ʛF)嚿� |�P���� ���"�� ����]��k����X�{��W9�Um��;����$�6�������m��);��~�H�=� ��]_Y��ZM�ɖ���*��0���D��O�� ���Y8�Z�v ��|2�6k�K�]��bYNU�ezgJ�o����h��C���j���/��k�2��WZ�U�&�m" K��mh�c��g������o��&@S�!·|D;�K��($B'"*�".ֻ��������L*����8������`��s���Q�w�a�#���ڊ�q9��.Jsy�t_�ɶ�C��H������{zך=�v�e,B�-K}W�Ml��[�$c-"�-^ '���lN��>�!L�h�W���@nq�>��[Ƀ}�a� mZz8�{X�Z1;�r�Gó�[�Y��D�25US��ր��7s��,�46���O�E ��>H�{�M�js=:֥o�'����(]̥i�6�s1ݦ�������aNGx6Y'h�I˷ u�Ͳ��s�]�|�5Ê�Ǒ�N:X�!�]����i�*�/!Op��Ne�*��K &+"��r��bH萧y�Ǫ��\��W���F�����"�@��X���2څ-���0��q |�ҔiWT�c����\`x����ܦ� �1n�'�N�o�9}�+ˈ�n��yR��U����ۂ^��� ���Y�VK��jM�#1 %��<\���<�'�@c0���&>�ϛ[&�4����~w��?�ZgERU��w�$�4�S����Xlv]a xP_F�|Z�k��5�s��.7ڵ���P�S�J��n�a�m�:ts�+%�6� =����U�g������zʾwGFBD~聆Kv�fʮ���c-,i`$�����z�ޛ�� �#���S�������d��6���2��@p�j�E�0���G�3� <��'��w��Л>�1e�+ѡv.�aR����J�f�Y`�)� ں��uD��� A���y�ˈ�8kjS5��4̾����\t9C� Џ{�r���!LZ���/#��& *� ����Ѝ:�}�V�c`�R��dw��]x-P��R�.p(^�eۨoHW� �C�4�(u������n-5>"�qH:�u��֏(��:��_�N�'8�퉰��Q�y�2�l��'�аSNTC<6��-�ԛ4L,����$Ϋ§�; i@��86q�8��-�+<���O��L f�lro��9��h�[g��@_����`ŪC�x�r.$#u�N�E�� !M��p�����K�}�����x~�7���^)����;H�nC�|\��0�-�Re��S�f3�7��۳<���*��?q@��u9�9��2�g���$H!�.��RP�e��2����ղ����į R!�<�"�o$n"�}H�1�69�e�?_���"�(j \u���B�m�AC�E��.�JO�Oϩ���^i����Pm���"�:�I���1�QL��<i���� ����1���͝pe�[� ���&kB����6�j�Ɨ�t�$�cn�7+�>��,ܷ�"�� ����}m&D����rܩ�ț(6B��3ڲ*�W�ᝲ��p����E��糌c5��?-r�q6֬����P�w"�4[�sB57�CP;G�͟YS@���8����PACs�1��5<+G����i��fMB���w���J�D(���\���[V��}�Y��}�8)T\�Y��>i��G�/��\<S�t�3�,4sD&�����yM�ڪ���|Sx�������YS?{�`#l�z�|��o�/�d��8��AX�7F{*��&<r��ChtMI�.R�o�M��͢ԯu2gqX[���"���G������ޗ�o�W��b��Y(/4�/��s��˽��M>]� ��F�!���OH����<N0q��_ʄj$�y���-�� �BSlFm�0Ƹ������̡�=�f��g5>�K�7��m�m�]C����r��m�Ӳ�q��>�<���s�A^ƣ l���jG�@�����?��? ՜"��� ��i+"���g�ʾg�N�^��ϓ����Wo^0�3�6���d���� +-L�L�2��]�A��F~N�] &�V��L���U� ՛�� ��ց=:�I�s]n~&V��0]�b�\�vB�NĚ��2���ޤ>��$9���gN�&ü��N�e1Ұ�E�M��ޱ�3O\�����s*L��/��#��}[�a�n��L�9����a^�����vc/U��,vq(q��EB����7����q�7`R��s�05f���������\���i�֝LN"O��V��9$ �!FV�^t�������K�B�rp���j�Y�:�J=��Pj��gI�?˧����4O�v��%�=n䰘,�M�=�������SkX����#��e�3W���8� �6E��y��'}&�h��{�g_�@��z|6�90�Zk�;�̾�b^$p��M=v��[�z1�ʗ��i;�����~�s�mե�6� 5�|���͊P�#�4[�]�47��ي��s�5�q����Ǥ&{�5x!����K8�5�^���4T���߈_���4j� ѹ ��VP����� �Ҁ:D��$I� ��zX�ra�i 5�)�<��k�t�tY�IV��5ĥ�ӈY�=���{6w�D��4�*����?zS+��cR<���-���h�\�����ڻ���J�9�K�4q�7u��R�ԃW�4Vi#N����[�����H�H�@iY�9n7ʛT��/c�7�;�������W=?���e�0�"X3�$��4<a��da���XfCE*�I<����'1���2su�<aV^���!~k��XXc1�W��������K~�ӻ;����*~�h��N �Ü.�,dT��2���sO�(1Ѐ5���1!�U�~�*&g��ؼ�4] ��>��Cy����hLU���r�Gp�:�4�3�t�N�O�>>��/7��� �b�����{�Q�wN� ��~�%�E|��q��6Ox���j�pm:
Behavioral task
behavioral1
Sample
ca50fd0342f587d4f5bec18b585a84c9cc24a066e8522221d2dfba29c7502323.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ca50fd0342f587d4f5bec18b585a84c9cc24a066e8522221d2dfba29c7502323.exe
Resource
win10v2004-20230915-en
General
-
Target
ca50fd0342f587d4f5bec18b585a84c9cc24a066e8522221d2dfba29c7502323
-
Size
10.5MB
-
MD5
ed2a7d6c528de33b4b9a209069fe457d
-
SHA1
09ecc48fe409dc49a162919b813ad9c2e048ffbf
-
SHA256
ca50fd0342f587d4f5bec18b585a84c9cc24a066e8522221d2dfba29c7502323
-
SHA512
223f01a810b2eb4fd8ae29360c23b0ea3fe52492e0703c0649f9630d757b68cbf52b1071fe4322d8724a4dce0390e9dc42c30ace45746ceb1d08ee22cbdfb476
-
SSDEEP
196608:rfIlfVkeZzxGSCu2h3uOsE5aFOCQu2EZJ5KBr7Xz8vl9iZAx8eoTGUPsqz9HwljV:jY5Zzb2MO15sOJuXP5Oq/IAxvoyv+Qlh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ca50fd0342f587d4f5bec18b585a84c9cc24a066e8522221d2dfba29c7502323
Files
-
ca50fd0342f587d4f5bec18b585a84c9cc24a066e8522221d2dfba29c7502323.exe windows x86
aa6b67797964d93cd70d98a1c14b3ce9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileW
WriteFile
TerminateProcess
K32GetModuleFileNameExW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
DisconnectNamedPipe
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
GetPrivateProfileStringW
Sleep
Process32NextW
FileTimeToSystemTime
Process32FirstW
CloseHandle
CopyFileW
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
FlushFileBuffers
InitializeCriticalSectionEx
DeleteCriticalSection
GetExitCodeProcess
OutputDebugStringA
lstrlenA
CreateThread
GetTickCount
ReadFile
CreateNamedPipeW
ConnectNamedPipe
CreateDirectoryW
DeleteFileW
RemoveDirectoryW
InitializeProcThreadAttributeList
GetEnvironmentVariableW
FindFirstFileW
FreeResource
UpdateProcThreadAttribute
LockResource
GlobalFree
GetNativeSystemInfo
GetSystemInfo
LoadLibraryW
DeleteProcThreadAttributeList
GetProcAddress
GlobalMemoryStatusEx
GetModuleHandleW
lstrcmpiW
GetLastError
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocalTime
SizeofResource
GetModuleFileNameW
GetVersionExW
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
user32
EndPaint
wsprintfW
DestroyWindow
CreateWindowExW
DefWindowProcW
RegisterClassExW
ShowWindow
DispatchMessageW
GetSystemMetrics
BeginPaint
UpdateWindow
DialogBoxParamW
PostQuitMessage
LoadCursorW
LoadIconW
LoadAcceleratorsW
TranslateMessage
TranslateAcceleratorW
GetMessageW
EndDialog
GetLastInputInfo
GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
advapi32
CreateProcessAsUserW
shell32
ShellExecuteExW
ole32
CoCreateGuid
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
libcurl
curl_slist_free_all
curl_easy_cleanup
curl_easy_perform
curl_easy_getinfo
curl_global_init
curl_global_cleanup
curl_easy_init
curl_slist_append
curl_easy_setopt
curl_easy_strerror
softwarelog
DestroyExportObj
CreateExportObj
wininet
InternetSetOptionW
InternetCloseHandle
InternetReadFile
InternetOpenA
HttpQueryInfoW
InternetOpenUrlA
winmm
timeGetTime
libeay32
ord484
ord283
ord492
ord233
ord227
ord67
ord279
ord2081
ord493
ord497
ord2291
ord66
ord239
ord1882
libcrypto-1_1
OPENSSL_init_crypto
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
iphlpapi
GetAdaptersInfo
winhttp
WinHttpGetIEProxyConfigForCurrentUser
vcruntime140
memcpy
memchr
_purecall
memmove
_except_handler4_common
memset
_CxxThrowException
strstr
wcsstr
strchr
__CxxFrameHandler3
__std_exception_copy
__std_terminate
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
_fseeki64
__stdio_common_vsscanf
fsetpos
ungetc
setvbuf
fgetpos
fwrite
fgetws
_set_fmode
fgetc
__stdio_common_vsprintf
fread
fputc
__p__commode
__stdio_common_vfprintf
fflush
__acrt_iob_func
_wfopen
fclose
fputws
__stdio_common_vswprintf
fseek
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_controlfp_s
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
_beginthreadex
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
exit
_cexit
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
api-ms-win-crt-math-l1-1-0
__setusermatherr
modf
_except1
_dtest
api-ms-win-crt-heap-l1-1-0
free
calloc
_callnewh
malloc
_set_new_mode
api-ms-win-crt-string-l1-1-0
tolower
strtok_s
strncpy
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath
_unlock_file
_lock_file
_wstat64
_waccess_s
api-ms-win-crt-convert-l1-1-0
wcstol
atoi
strtoll
strtol
api-ms-win-crt-time-l1-1-0
_mktime64
_time64
api-ms-win-crt-utility-l1-1-0
rand
srand
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 220KB - Virtual size: 220KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE