����u\E:��/L#w��%�A���p��]�F,>s�|S�s�)��q7q�"�4d[��z��NV��P!���m�G2=��=&�}�[�Xc.%d���ޘ� ��ꗂ2����喫������Tm s��}Bk�TX�#K�vƘ�J������SZ 5�J�-k�T��,)տ���xXU�zE���-���(�/�AR�=}*Q�!�j(z�u�B�_E���P���vU�j@�(RG���.�Eb�nn�����]�C�U���rS���1�%�q���T�n�Q��O���?�AF&���;��S����r���va�k4�2�q�a�f�ԩۂ�M��܈��f6s�d�a�RQoU�%�w���>� O`�����h����z� ���RS��1�v���b�z *;���,��e��ih��O��Ɵ��BfG��J��"�6��=���,�[���ʈ^�̳WyWh��~h+�+���hl�p���!k'p�U�a�ͤr{MA��-���{���@�0K�۫\���[�ԍ����6�Q1����Y�IV���H9)fH�7Sςt�h����6��gm[��������4A�%����Ȳő��;��~�~K�sC�qa�=3"�J��X|d����ی/b$[C|hawJ���NC��d���75_Ν��x"e�~��O5/��WH��gD����� ����#/�2�3#)0й$1<{_�������Q��Fu�-rY�֟�cg���.��6���&܂���ѻ��IddjK�j@��~�DQ���,�J�����#H�Kڳ�gu�Z�I�6����/ ��69yG���Y�z�-��-ʑ<�U �d�!�S /�%��� �����8���C9T�&�����ph_�Jk;�W�@�� t�i�O��*����DX��/��e:5 �)����zͷW�XD�j� +�,߾L�xS6%u��D���[:�l�,{0X�U�3(g�-Gzu��k���r�/�-5���- .�fT�?�G�_�ɆmD1���2�ĎK����7ڤGʅ��2��g�O���l���ϝ+uo�����dS,TK��'��~�I���S� &tꩯ�4�rJGe��J��FW��F��1� #u�D�÷��7S��#���_.�j����</� &VGzc�C�'���[y�I5�TDElrρ��J�|C?�>4�|�s V_����$�H����6Cp��e>)I,.y`��~x�==�б�q���N�R㜄I5w?��:ZIO9o�� <k�CD��R�E6a�����֣�������Jj��f}���*���M�� ��uP��$�sMZ"���\ �Cn�F���xZ��5v;&�nax�Q��3�En�<]<�O|�"�� M�!"��a��ӫ���<�Sa��$�E:�� �Z��z�2�X��������5�鸈��R�L�>�!6�g'n6F|��?����$cp�M��]tRmb�.��� }�y�$��F����1�)�PU��i�T��]��c�@<�m�$����*�g��,���Q|/"ct��AîW+`�\_�}����TuM�V#Idvu�y�X�cV\�/d�6�'_6slǦ.e5K��;8#N�~,E�pA���9Ro!m���C�R)7��]퍒ݽ��w��d�~� ���&�K`�������jc7�}������g42 Un�' >=��9����t5��%#K��(1j"�sS��AzC� ����A)��ǘ*�)$4�z�{���{����&]�g/��,ir�o�A���/��~@aO;V;�w�(��}���d�I�� ���IRڞ�W�O�em����.�9eh�C. �:+_�NS3����*Z�^��u^�D��f26��x ���n�Dp��S:���7L�َ���?�ڲ�l�R���r�<�@gP�����1�j���p!�g��h��!-�b��_~��^�X79c���Y�����ns���H�����zl���D�:s�I)u'*�y-FHA�c�=��hF�4��:��LS�3�ؠe��i|S�9r��.O�j�Y�r��c�@�x�D^aq����<_�)�C��*�<V�*s�7z5���b�I��������M��>n�q� ,#uK؉�߮ ���� �!��H�ۢj6��Q?u,��3ӷ�0Hާ�4�i� �����j���j�;)���XGb"�H�WK��A�3ᢂ�:�HN�k#K�g7,��c�2��s��G��|�Щ�A/�Iu��d���Zn��RTIԚ^���p��������RF�X1A#�2���a��~U���=A1����oC�1O�_�n���q���뱁#�d5C|���)����`7R_!^�X�SIcK'�6(Pi����WM;P@��!�_�3�/�`�#��Z!o�� m�p�$�K��a����, ����ȍ}�����JIh��Ϋ����a�RT&�C��R��� ;j5���J�ā���p�+����챹?��Sn� Y��/�j1��A|#ͣ>��z5���x[��3G�*E��$�J�.�^� i��:�!ޞ2�Ǵ��)n.jw-هǵ�[��m�������_���?Uϋr�e��%������e�;7�P�ђij�����7�_����?� �1���l���.�3�:f�>���g��")<0e�7a�Vy��E:b��������vD� `�9e/V��B��=����H� wyxe��+�RN�t(����<[�ϸ��,��+WQ*���G=M�:�h"�fr��T4/\�Y������x��mH��r���W8q���\8��� �����j<��������;�}�������)��"M��ۡ��Um���`RS��䳏\��ߙe2�_���.���a� #K����ڪ�Ay֍wt�����r�M�J�h��Ig���X� ���<�K��[�5�n��6�l���,�X*��>�� -���e�Lo���hRq�`Z�wY������&Ιإa���I�ı*�8�E�<?In��f� �����^34q�稭$�{+|.�N�O/�&\��?XD6Y�u�>��O`L m�����^P�ճ3�^
Behavioral task
behavioral1
Sample
bafc057298278351750d6fd0a35b76553e9cbbe752f2466721f768b787810535.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bafc057298278351750d6fd0a35b76553e9cbbe752f2466721f768b787810535.exe
Resource
win10v2004-20230915-en
General
-
Target
bafc057298278351750d6fd0a35b76553e9cbbe752f2466721f768b787810535
-
Size
8.5MB
-
MD5
494cf75adafe6b87c990f32431648219
-
SHA1
e908aabe28b8d92437ede891165e28ca5bfc21b8
-
SHA256
bafc057298278351750d6fd0a35b76553e9cbbe752f2466721f768b787810535
-
SHA512
f046efcaafa2192af74ddb03bd89cc4180c159ffed2fc7fac7b8cf0a5cbfefd91247a365d23a695a1b188b1a6e06364da961a265405251d5d0bdd0f4d7cabe6b
-
SSDEEP
196608:qhbbTsBgPkeYJTyPZd5BPFi0dCBHP/6bDqHAA6e0TK/:q1sgPkeOyhdyybDqgLe0T
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bafc057298278351750d6fd0a35b76553e9cbbe752f2466721f768b787810535
Files
-
bafc057298278351750d6fd0a35b76553e9cbbe752f2466721f768b787810535.exe windows:6 windows x64
0cf722d200a7d5dbb3a4083dce48ffc9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalUnlock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetUserKey
ws2_32
WSACleanup
ntdll
RtlInitUnicodeString
crypt32
CertCloseStore
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 569KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ