�7Ҹ�j��c�Oq Y�Y0�1�["�� x���B�ެ�N(����J��f1��� l|��4~��ɊS���QM�S��'�������E9�b4��e:㫊�[��>�A"k���B����`$�ʕ �L��VoTv�L h��ĵa�����{nd���� ��.�%0O Cʛ��U��O��c�ӧH+$H&��O�.G�Aϸ�.9=����(�-��ڶ�)��#�r�'m 3����<$���x@�39,��qǘ{\F��~E�_ N2:�'��Q3���(-��0��_W~��Vh�r"������]���77c��R��l1O�v<����Ȏkddj�pH�)5Z[�#��=����j�������k{���M�i�f�͋�ۜ"���_B2�����/bM+����Ř�> ��ia.��v1��J�)�qq��֑ �J���ߤ;��������������"O�C��@���O�����7Br�E��gFՈ��BRx��nB����ơ&�; �f��\wS7e��J<Hכ_�6\�s#hn2נSݱVdJ��%�� ���� �ۻ_�F�s9�����N;������ph�3 �9o�\���r(Уe�-�7*Y-�D�ʵL���PuB�>����(�Q����D�����_:@�4�Qߒ�����n�=��0�R�E�"2��0շ��t��9��P�z 7BTy�>��z�ÑdQ: [�}�ܞz��]M� (�~�6B5��z�x��=�0���e�X+c&��Mm�$��_�!���HV�L�i���ۖ��=��_�&�9�L� R�2M�5�#���nj>w�����Y�rܶ���4�x�4�-o ᴀк��p����j��'J�cs ;����e�*�FE������ʏ�p讴������t��S��-?_:�E�柶 �F���_� �f6^_v��+��3�,dh8n���qS���-��G`g�2z\�z��B^ z�+D���*P���'K�ף�ӉEv ��[VY��̉#d4�θea�(�;���J���A ��)be��ͼ �X7@G`�gͰd͎�V4� �Q��N����d�t�>�����Zl�W"�D���?n~�tBaD�1ڦ".0�n���afw|�I�umųB�VѾ��i�� Ρ�]� z���!��'MV���Z���k��X�Md��-���j�b���Y4'N�n�;�j�ΣQ�9����M����v��L��Wͻ�{�EaZ�}ʟQ�:�Z���¢�r�*��8��Z��#����/غ�����篂gZ9�j�hVho���jX�R��D�H�$y5ۨ���E�1_�{F�pL�����i,v���B� �S��4���-Ef�mk).藀}TŤkG��xw���ALu:���wc'�~}ؕ���"���h�F��3�#3s��䕓���wDK��\��]}�F���4�[(�Ls(3} \��@=ey6�7�q:كM:�DFQLc���% �i�CC���5m%Ly[���Y�iIuFp w��Xv�]���s�� k�.��}�B@87� ���B�H��Q������T����L>�o�(-�����4fjC,pP��D�uq���c t]Fwq܄0⿉M�j��F)0]�b\;B�Q�`�,�"�jFA�ߪ}�|��Xy?]�n����L��7G����o����Z���L �u��f���=M��(#��-�Xp��M�ɯ7�y�9b����~7��0 H��6Ӎ��w��N��,���u�t���â�TAX�X⻤=��a�ܹ�*G$AU��j���/M��G�MȎ��+N�h�K�ㅽ�+����S��U�ǚ�f�A.���o�%I�m�YR��`�J��4l3� i�l�oū�7�B8}�V�Y���P`&W�s&4��T$ԙv01љÅq}��H�c�#E,F���K���bP�`���O� ���2�x�|_�C��MآK�a��Mξ��i���(�*FQ���e ۬�>A�U��8��Ԗ�Ѵ+ ���6�;�:/q�4X�)\Y� Q:��**�������5�8���٪��R]�kHg`����DЍʫ��ݝ���,�)#�������29[)��U��@�~�I�ؗse�h��9��m+��uC�O���+�¦g��B#���$�����5qr�E���r��&�iĪ���Y��@���!�v�F�Q�R�F�7�2�����o>��H�4��q�5�d�%7���/���3���In�J��hg�;- WY��"��[��E#���p���gr6�5�8��0�M��!ճ�P�����*�� >,go�+�v ޕe��E���o��~:�q~�yiؕ�EQJ���2�R��!�+�#����U��/)si�S1���\��|��_۾�Q� �|�xV)�@:��&�_���qj�)]�&�9��C<�/�^:Ntr�t#މ}����.�:��D/����-�Jq�W��SE�����f����]��!�\�.�-������Lx]�ւDT�4������� g�ɏ 3nV��xCZ�7�59 ���.8�چ�w×Q���C��M�2��N<�h�Pk�R��?���Na��*���IC[U�q0�g�D����b{H�;,�Ak.�!)��|������%�'�=��42��@m�ȑ�y�M�����,Bv <;W��馋���W�n��6��Y%b)�SfQh�[��7O��8δ���f\V����QS�� �Z`ث��r�Y��H�hB�E"�M4ੋ���A(/5'�K�RƮ?�RDf12꼓3����w�p�}���+߱�е�LH9E. .zЯlWi�I���4��`�{E�P��4�jWK�t��z瘕�6;_�psDW��z�x��Ι*�O]�f��L�|lV��k�����6Ĝ���ێ��_��B�!�c�y�S��� �qX��T���dm�vA��rr�{1^�W*?�������٨��(���[� @���;^<�ln����pw����%��7��͜�N}Z/�����Y���
Behavioral task
behavioral1
Sample
07a17983d502676621e42d22c8f7deae09ac205f8bc0ba2dc2545f97e7816ae0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
07a17983d502676621e42d22c8f7deae09ac205f8bc0ba2dc2545f97e7816ae0.exe
Resource
win10v2004-20230915-en
General
-
Target
07a17983d502676621e42d22c8f7deae09ac205f8bc0ba2dc2545f97e7816ae0
-
Size
8.4MB
-
MD5
1a740b0c7e73d7e35929c770dd2429f6
-
SHA1
a812153027bd107b71121add13bc5b13214d1cb3
-
SHA256
07a17983d502676621e42d22c8f7deae09ac205f8bc0ba2dc2545f97e7816ae0
-
SHA512
dbe1daca3a3a499236a110cecb4d99ac8ab63b359c6f0976b0859264a550be23d4a647fc61f759dfadb4221c3e44d48cf75af4ab7b0aa6ea8020fc91c18cd3dc
-
SSDEEP
196608:KOjkwqgd3zKE1vRJqddG58GT9n6NK48D7h5TJDdUH8yo:UmOEnJEL+4NK4Y7h5dicy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07a17983d502676621e42d22c8f7deae09ac205f8bc0ba2dc2545f97e7816ae0
Files
-
07a17983d502676621e42d22c8f7deae09ac205f8bc0ba2dc2545f97e7816ae0.exe windows:6 windows x64
0cf722d200a7d5dbb3a4083dce48ffc9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalUnlock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetUserKey
ws2_32
WSACleanup
ntdll
RtlInitUnicodeString
crypt32
CertCloseStore
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 569KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ