�<�װ_��o� j����Iug�0W �ͣBz������G8�JH,�e;���p�<�u��RO���6, ��C<o ��Q�t �Ð�<!� j����1����}$��Т�&ԏ�wI>�C�c0b�m/{۴(�̏,G�"�`r�`��ړt��/ �O3h>.L'0���Q@5?)�R ��u��e0�ҫ�+�e�����evFxa�ip�H�H�(�`���7���É���e&!$����T�^٤��b�K�*}��^�ޚwJ��p���Hm�d�9"�:�|h�$��{��2��W��C��/��P��A���Ƽ`H3o��b�1��R�b1��C'��s`�ɵ�/��)[�3�H���������ע�R8�;�9��?��ֻ�N��@*�pyd���}�5y�F�Tn� B�ާXj1���@M~� ��Ȟ:#�2ٛ������lQ����+>IP�3n��d����?M���������}yX���f-�5b��h�7L���%Y~�� � ץM�c�i����X��ߨĶP�[� �n���K ���E������7d-���� #��sc�|6���v�q]b���N|Y��%E� ��x��V���1�7���{Tv�[H��6�.\���Ҹ4��|7+�v�O���곫��#����G����ݡ%~s|W�N�!vk�Ϊ�~!;D�n��M��ZG�ꡥ��qq5�����I��G?�l8�Z� ���M��R����5ٗ�~�wNQWd���gG��e䬎��9����D��s�DJ\��s3V�����<�͢b�����lV��stw�7�P[��2��n{���~�-��gB�ٕA�5[��ҒSkR�lL�ce ��x�!�D��g��������}�PF1�͕��*`�eb8�l?V��̇�̔�R�g�yv�9����s�:]�h ��f� �h�w(�����["��szx]�)�::�UV(��Ʈ��P��g�a���M�P~�4�� k����̌& �x��s"��+0�/fN�<�{שū���ag\ .���_���E�+�� ��8/AL��V7��,Α�Fl59e�� ���>�ʯ ���T`���?�1��!�Y:-�s_�%�E�����L���0� �����4���Q������q���1�6ICiyɅ�hɼ�EǖN�˲ �\��?��PF!��o�.υ���t� �X���&��7�{e>Cp�S���2W��8S��gl���9���q�`#P�����瓱�Qr�f�D�i�"��$���Ф�2X�9ɓ��ME:�����ŏʖ���E�i��=�k�N�D�!�djժy1���R���$|,�dzE�:��()������!�]�B��#B:��]�Pɝ�&�i��>��|Y�����<'1T�����b�疐��&�S3D��\�׃��%+;RdV"�,�[p���c1�k;uĩ��c��7�E�Ƚ��T�p�*�%O�E���_����h�:�ؚ��JUww�i��N ������T���*�Kv9��r��j/�Ƞ��[-ԙ���,�ڌ��� �*n��E���ٌ���Ć+P�L�`���&Ӡ�Os�Xo3Q��H٭LHg�bt��ߗ(<�^���B'�G[���:���t.�c�� q�x�@qr�~�/��T�ा�K��[�T�"_G܌1�w]Yt�F{�1�|YaSi�훽ɵD��X�wI��T���/��B,����\���9��0kJ��?�M}��[����a.�o���q9���w�Ml�S�}��7r��&/�>��s��(���H�I��r�R+3�n�؛+4곻>^]��d��Z�����U��(�����R.*��͒��舼�:�=C{�D��ijȎ��,��Ai��Lt��� V��2��w_�cY����$4�d{V���Қ� �;'P%(�]�7��%�^2�T���*/��f0m�?��\��1���T]1�����o�9W�'����wɁ{q݆���4�Ѝ�8=ID\�2%�F7�7Y�����:Q)v=�,6zb�?�)��{M����BB���:D�`)e���v�!�+��>T#��d�|�����߲����ke��0�%�g����̃�O�������� *��eh����NQ�} ����� ���#�t�乗�L��!5by�"> �4C��/b$*��T��p!�8�U�^>/�� �] ,EZ��˸�����i�9��n��m����(�� �;`�q��Ǥ�:�u@n]�� ��5^�@�l����`�R�����o�����V�*���R%��P��t��ca�);Ǔ����e�����b+Z��3 �[>�F�f������N�deB �mH+قso����7�K+�em�l����f��D�$�� L��q������2�L�!J&�O���#H�F����Y=+ �����}!Wiu[�I��p]�j���ߦ�ŀ �ęw>�2�9��Y�y�[t6R��V�2?[�+����t4�~�x�����f�˼T�e�㔅dƩ��{���0M]зr <i�m5�4 �,���8������T�Z~���N��I"~�eg��֎;m�D���!}z � ��|ƓBhC�r0B��ޕQ �yJ���W(��C(�N.�)Jf���f�E��R�A(���{} =�`��� 2w�����9n4������E�j�l�'� k6�����A�D��q�����b��a��t#!���?��B�M*DCFt���D"�@�W�TP _�_.sT���_����|�I���d��ʾKQT�}z���g�W��R�P|B�C�4�WT��\+�j�BSy�E)��ܰ ��Rb��V��e��N�{7�3��j#��$�bЭ�Pe���������|a�/R���k�.��=������3��8���l*�2-A�Y>s|3]��xrT�ޜ��g<!\���Vv���Alp����/ ��f���E�>��xcT6G� 0���33{�=XP]U�d}��+*�F{��d�z���N0w���B�Ό�����BV�ڡ�м�T=�A�.k16
Behavioral task
behavioral1
Sample
556b87e28f3b1affe001909e9eeb33e4c2c08423ea557fab6d1bf3f39411d9d9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
556b87e28f3b1affe001909e9eeb33e4c2c08423ea557fab6d1bf3f39411d9d9.exe
Resource
win10v2004-20230915-en
General
-
Target
556b87e28f3b1affe001909e9eeb33e4c2c08423ea557fab6d1bf3f39411d9d9
-
Size
13.5MB
-
MD5
c662691e6907d61e87efe3687f4249d4
-
SHA1
948e9d26fe84138f67b38c926ee23fee3a180646
-
SHA256
556b87e28f3b1affe001909e9eeb33e4c2c08423ea557fab6d1bf3f39411d9d9
-
SHA512
2f9ae7c27e9ad0056102593d2e073c07bf9cc38165acc382b1dc72871f7233a64779d0953038217ff3ce509cb5426700d8a2b8ee668618a5a745aee760beeabd
-
SSDEEP
393216:ThgOKZ/fLOwJpxuPFrZS0dRJBYju3UNJbT1YkC1F:TXKZ/fLOwbuwgbBj3UB54
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 556b87e28f3b1affe001909e9eeb33e4c2c08423ea557fab6d1bf3f39411d9d9
Files
-
556b87e28f3b1affe001909e9eeb33e4c2c08423ea557fab6d1bf3f39411d9d9.exe windows:6 windows x64
25bed3fd44412a4a174a58caa62c8499
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mfc140u
kernel32
GetModuleHandleA
ResetEvent
GetTickCount
VirtualFreeEx
GetPrivateProfileIntW
TerminateProcess
CreateThread
VirtualFree
VirtualAlloc
SetFilePointer
WritePrivateProfileStringW
GetModuleHandleW
DefineDosDeviceW
LoadLibraryW
GetDriveTypeW
VerSetConditionMask
VerifyVersionInfoW
DeleteFileW
WaitForSingleObject
GetExitCodeThread
CreateRemoteThread
GetCurrentProcessId
ReadProcessMemory
GetFileSize
LocalFree
VirtualAllocEx
GetProcAddress
VirtualProtectEx
CloseHandle
Process32FirstW
Process32NextW
GetFileAttributesW
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameA
CreateFileA
InitializeCriticalSection
GetLocalTime
SetLocalTime
CreateDirectoryW
GetCommandLineW
CreateMutexW
CreateMutexA
OpenMutexA
LockResource
LoadResource
FindResourceW
CreateToolhelp32Snapshot
CreateProcessW
OpenMutexW
GetComputerNameA
OpenProcess
CreateFileW
GetModuleFileNameW
DeviceIoControl
GetCurrentProcess
WriteProcessMemory
ReadFile
CopyFileW
GetPrivateProfileStringW
DeleteCriticalSection
OutputDebugStringW
GetLastError
EnterCriticalSection
LeaveCriticalSection
Sleep
GetShortPathNameW
InitializeCriticalSectionEx
SetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
FlsSetValue
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetActiveWindow
GetActiveWindow
SetWindowTextA
IsWindowEnabled
GetDesktopWindow
GetWindowTextA
GetWindowThreadProcessId
MessageBoxW
SendMessageW
IsWindow
RegisterWindowMessageA
FindWindowW
SendMessageA
wsprintfW
EnableWindow
GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
FreeSid
OpenProcessToken
AllocateAndInitializeSid
EqualSid
OpenServiceW
StartServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
OpenServiceA
ChangeServiceConfigA
OpenSCManagerA
CreateServiceA
shell32
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderLocation
comctl32
InitCommonControlsEx
shlwapi
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
oleaut32
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
wintrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
crypt32
CertGetNameStringW
setupapi
SetupDiGetClassDevsW
CM_Get_Device_IDW
SetupDiEnumDeviceInfo
iphlpapi
GetAdaptersInfo
vcruntime140
memcmp
_CxxThrowException
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
memcpy
__std_terminate
memmove
wcsstr
strstr
wcsrchr
__std_exception_destroy
__std_exception_copy
memchr
memset
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
exit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_beginthreadex
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsnwprintf_s
__p__commode
__stdio_common_vsscanf
__stdio_common_vsprintf
fflush
_wfopen_s
fclose
__stdio_common_vfwprintf
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vswprintf
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath
_wmkdir
_waccess
_wsplitpath_s
api-ms-win-crt-string-l1-1-0
wcscat_s
strncpy_s
wcscpy_s
strcpy_s
_wcsicmp
api-ms-win-crt-convert-l1-1-0
_wtoi
_wtof
_wtoi64
wcstol
_itow
atof
api-ms-win-crt-time-l1-1-0
_localtime64
_localtime64_s
_ftime64
_time64
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sqrtf
ceil
floor
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 472KB - Virtual size: 472KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE