��H=D�q�A�ٷ�E �����:c]���#�,��i� uu"G�w/.]I�J�e�����*bl6Ve:�[���R�,�L�pf���Ug�@� ���m�F�����A*�o�?e+\��AkE"��QtTx��Dk�d����*����b��g��Yn�����vCY~���Dj9̏�V�����$#��#%?�aYĭ�LhjI���:����x=�L+�ݕ�g�@7.��0�n�����H��X��lɸKS0Jv��*��ו�<�r�:�������NL<���%��N6�7��0l�4�S�,�����*ė�Ƿ���e�Q��72���sBtu�hq�F�UsAj0�Ԟᖫ����Z�Ɍ���("�q�ba��Qc��J��$�ĝ�IG�2���?\|��c}~�j� ���HoM�fGt�q����K���=��{��J� ^d�D�λ���\܉�W�/V[����u� ��H��`�%��.VA��9 �GU�'��li�xïL*�fC�4�MH�������Fz���Wr�6�K��x���%�B��ѿs�¥��;��gi�V�P�cE}�et������ڍ@�"@GC�Z0?m��t��8���l�^n��KN���(�0�?��]h-�C�c����6k@ށ`�in��(��$؋��~�AfOWG����~�X.tծ�+��͝� ��"Ȳ�-_��~}R[�`R���@�^��(��L���U$p�Y����z�P=������m�,�1}��{rݐ2Z���9������z�P\#T �ZJ�Iʤ1ܵ�[i��3�y4��!�t�j_ g+>���e}�Bu?����4jn[#�Ec��%ZH{&��7�OG�/prr�01{�d�o��+���$Ό����l v�����HlnViPx�b��N�k;�������J��vc� ��\Lqu��;��^�i�z��K�9�{n'�i�����fy�@��҂��IȃC���A��c"O��� M�p�ˎ҄Bn�K�#���6�e�m��_�z��mT��ح�Vu���2X��EL������i�B��:�^�I^������:�B�#~����I�3^���G��ξ��A����>|��B���]�%�s�GX\:?p��g�@����_���Ӄ�����qCp�r{I/����M�R9�ڿ��pP���Eۍdnoj��n:cN��_1�<Od���cA5��/E��ƛ�!�K�����{k�^L���9߿����x���}��$>��f�"��wZ�︨ �;���&��f�H�L=�Wݡ7�9�J�(9��V���[�B�+ή2�١�R�%�Ĝ��ȯ�C T�y��ގ��)TE]O��N�F� �+ʜ�&��S���!��z�0pݕY��;:��b��; o���H�>��6l º%���������3'��tr+��>��nY������3nG�������k1(�nX�-�� �Nfg��(Jљ��$"u�9����o��1� v2���|�~'��:��&�v���&q� sC>q���3j���Y@�������B���!�'�̠i>�5��Im^3���u爯�h�k��W0�+��������M��^�X�L�=g!�Z�N�q�װ ��5�0�c`՚�8}�;Y#���XNOY�k@��9��\վCjApBr��0�����H������;>�&:Ε�N:�LS̋C�4����gX��JG��!js�>1�n����7��>oJ.�,�KghLy����З8��Rr�EH��������������@��뚜�Gf�g�Uvn�'��ԓ<#Db��p0����U����~��O ������F� #�|Øg�JY��*"�.gj�YS�ì����p��?��tV��'XJ����P.s�Piv~tڳ�� 0���s} ��{ثa5��z� C]h�|���1a��M�.B�s��X��8B��;2 �w�}��ڊ> ��������?��x/�L�X��䃍J����ۜ)#�~�@�)f�ʜ� SB<3�S���I���ӫ�s�Y�p����S�y�?&�� ��wكFq� ��= �f&G���6�u�OXQ-�>Ōz �MV�3:����m ���3#�@�]2�>�Yow�����">m�=�"��!k��q�}@R���g��~"i��3Y�&n�M,�t�6�����Ȁ��bh.����q����U�%���O�VtX�>���6m3y�M�B{J�����Ni���V���n�R�d�a'�����M����q 2%����G�z����qM���3Ɛȹ݂�����0 �) �5er�.q�ޠ�"[��VJpDn�{ĔG!p�6�u�,G��ж�;`��Ԣ6ժ�1ru1F������������U?����ݑ;]X.����7L���Z;�eםREχ�@(���Y[�����/K��/��uS�YT�������,����\�>�O�����M�5_< ��>N`��Q�;K��T�9�9QY =齿c������;�/�pr9�c(�:]����.n�.��)7��w���^+PLۄk&�0$��!9_3A�-�S�C����0'�+PLZ��1�J��G�㖿��U{����˛���}��b"!�r�~�L�@�~��Me$��w��k��)��F}��j���|����$��X�!�Gh)}�j�͡c�0צb�k���lr?�/a��*O�f�Jl��q��o/�du T�ʳC��5�"�T�Rm�WP3O�(6�=��W8�w�����m�,@3Pӱ������+c�t���%s_����ٶ~��C�y&��|���$�����X�O��7��'�r8$�A^ �=p���c�;��Vђ��*�߯�����l�[��l��T�L� fw��Q4����D14������Xhp/��g.b�k��p s.�g��p��r��?\�UFD��?Do�F�3V�_&:d��;�/+K<������1���S��p"U�6/����{���'���ݘ��ߌ�����x��X��^�ֿ��Ӎe�Û�EeC�ﻢ���zL����K��љyb������c��%
Behavioral task
behavioral1
Sample
be572d4c602803e7b3ec5b75cec56653f70ee0aec16a7c606069020882d41070.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
be572d4c602803e7b3ec5b75cec56653f70ee0aec16a7c606069020882d41070.exe
Resource
win10v2004-20230915-en
General
-
Target
be572d4c602803e7b3ec5b75cec56653f70ee0aec16a7c606069020882d41070
-
Size
8.4MB
-
MD5
549207117b47873a22840189b95b2bcf
-
SHA1
56ef5fb3e70628d6b638ba7ee9c70f660a097456
-
SHA256
be572d4c602803e7b3ec5b75cec56653f70ee0aec16a7c606069020882d41070
-
SHA512
0db871a8a370c8e91ad9b4c56312d91edc126870113c238ee0a5f62d10cff2b2526b89f07bca271afdb4b35838932c870c537d4f4cea081534bf4f970b36a493
-
SSDEEP
196608:14n1+n3XZ2oQSaABSUO8U9zSwIupz5K+9f0xoNcXZjQ7+X:1qIYe5uyupzEp20e+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be572d4c602803e7b3ec5b75cec56653f70ee0aec16a7c606069020882d41070
Files
-
be572d4c602803e7b3ec5b75cec56653f70ee0aec16a7c606069020882d41070.exe windows:5 windows x86
8df08c4b71a679c69869c0bf9edcb772
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
GetCommandLineA
GetProcAddress
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
GetVersion
GetVersionExA
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
360perfcall
ord0
vmprotect_ext32
DllUnregisterServer
DllRegisterServer
DllCanUnloadNow
DllGetClassObject
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
Exports
Exports
Sections
.data Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zaas Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zaas Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE