:?�}����|�E�Q���M�=A5KӅ����/���{v7�B��p������K 3��� ��F��5���cB[�y���w�v� ֺ�8� ���W�̗_#��1K�����un��4ߕ'��H�����˔�GtG}KeZ��lB��� i���a�&�)6��n��@�E���UP?@[lK���<Sq�O�5�8x:0�i�vik\?�8i&VL��m`����� k �'�xF���.��Yۓ`�! >�\�`Mey�į)Glر���5�#�r���g�!6���h~Bͱ��%,�nƫ1��H ����� @ VIƅo��c�j�oFf����)y�o��R�|�2)�s!i�r�mުw�!&�l�)8��:y�l*���-2���z��w��9��Xm�����L����+�" ��������� �1��=Ԧ� Ws Jۀ.��U��%�o��K�wc&��*���f�wd�]�H���|���}eo�$�ڗo0�F"v�ƴy�70����>rg�_�CI��;Q�m�)�^+}9����q��`'��13��,*u�Q��5�����sEn6Ŵ�!�pƫ��_q���'�U�j|s�w�[��0���}��_�z��fc�8;j���we���L�T���o��@���uF���n�|s��u��:�9���2���c7��KA�%�e�� X�X9�C�n�Sc�4`���6�K+Ñ��K���G�C�2���x� �4���g���e|���% ��8�V���v����z��]���e����$(�1;���D�B��`���I����~�, e4����q�&C�vsR�������<�3����vh��T�*�B[X �y]#���:�.3��<������3��2ܭ�M�!�}�Bԝ��xKW����8�Z����Z9��%�|���sz�`���0#=�)-S�F���T04uO�;�2K���&��������.%ǣ{���!x���a��w��Aĝ�3z�w ���) @�h�1��m���t����8���4Zo��������)�Аlwh�$��̪Si�M�㠐�rw0��l�n�罿Rhm�{O���PJZ��J���,�P�!?gx�gFzhB?�_3�q�2��!%#���倮^@0��7RZ p� ����0� �b�!@�&b7*&z�v�����$� �{�ic�o��a{�:<8(AюN��1�B�����N�z�+-���T9M����]l90��Y�e��0�M���7܋5�{�6De�}�Q��uj����ըv����y��b=��N�B�E��(8���P�8:�z��E} �CVg���gk�IH�`o�<昿Wb����Y?@�)`�&��������p7=�@�s���b� ��<C�N+��W��� ���f� :����,;���xj����*�e.��R�5�;q`�4�Dh��R(�)ew���(�*:�\�t���Lqt��%�7��QJ#��+.%;X�Ea"�ٿT�OM��<��1���� NF/q# ��*!���ߙ�Byy&��G=�P���j3lW �P$М�Qx��.3ds�)��=��; ��Q�v���k8��A��F]�d��� �����㢺�l)p!�uǭbl�����7�Q�mv&̱�2���=������z��?j�Q�]5VT���&v��v���;�:���v�m_���]��Oh���-v�%�3�q"��w��ayCH����!�rk�< ⎥q}]o2��LKd�(�-�q�ޖ��q�j=�#�y!�H����$�������5����B��]�1�߿�%) �@���e�d�m0Y�\��l��z&=v(����82�����1�f�=� ގ61g�S����� ����E�e@kF��� ��Erz��鐕�2S�хy�SfB��6�R��<*�x8mƖ}�~@��e#Y��2ʻ��+����U7�����U� ��j���zK�� )��s�7����ݛ%#lL/�Bn�4�wE?�M���_3*�� L�"� W�pnҶї�V�����c�6u�!�����!�Uz�<�\z����m���Ǣ���p��DR1���C�k=b-�r�����S%�ɋ<���[��g�+��z�����E b,��m���+M��P�`�g�Jv}&��4���8�k]�J~��{�ָl �3S 5KslW_�&�0Ǧ2��K��9�+�̲\ʉ��)�:.�(�� ��l��:�r�����p�a����½���VG1�_ ۙ���O�U��Z�f�X�)�H7�B���T��l ��O��Έ���v�NH?l��ϵwۚ��������`|�b�vt�ӚB�Gkbu��F��v�=2ԭ���!�P�?�e"6�64�pƣ U|e��}\".����r��[���l� -h�'�o�t��c����t�ߝi�k�&W=�fJG����X�;��J�2\��@$�O90j��^�}�72���M0����a���zp�ـG�nfV�n��cr�)TS��z�cC�������?�ߑ�L��EFk=��F�L����W�j��S^�o��"��%���J�Th��[N�3h&:�v3�&����<?T͉���a=kҙ�o�1z-#�-�\#��p��X�/���t�w%��$��������E5�6(D�$���+�G֒Y%�ʼ��u�@���;~B豇C�iת����V5���m�XI��W\�n0P���*��a��p+�]Lݎ� ��߲��BGu�c�'���u��d�C�&G)���{��4"i�cF/�[�dŚ�~v�(BTV�yǏ�j=x�u��W��(�����GLq����mϢ��]>[ ��s;���ώ��ᐢ��>���FP�+і�r�{w���|���`fO���k��ߟy=�~�lO�#h�Ժ��S�@i�2Y����A3�[ Ӄ����9q�h�U�T��QF���xI�ץ��Z�UA@��VI�Se��DU��s�;����l�)ཿ2x��neJՀk16$%F�������xR�;S�&ݚe��*M�n�|l���_~{�u~��V�J:K�-����f3��Ɗ����
Behavioral task
behavioral1
Sample
28d80f7d4af8d7b9fa342c309e4634fba3e1a4d05e886232c1d826959a31ecfa.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
28d80f7d4af8d7b9fa342c309e4634fba3e1a4d05e886232c1d826959a31ecfa.exe
Resource
win10v2004-20230915-en
General
-
Target
28d80f7d4af8d7b9fa342c309e4634fba3e1a4d05e886232c1d826959a31ecfa
-
Size
6.8MB
-
MD5
e414801b63b7f4fc9788552ff789edf6
-
SHA1
7ef286b2ae0716549296bccb04b6a67a9bb960b9
-
SHA256
28d80f7d4af8d7b9fa342c309e4634fba3e1a4d05e886232c1d826959a31ecfa
-
SHA512
c0169b6ba8d66eb30f82e02de7e2a302a4d138ee0930f034a6b2d799d98660c2d5bde9ce75c5fc4436f6f938986db36d5d7d338e0f7d43b8fd8b19035a463557
-
SSDEEP
196608:Lss9ozOt7AZm8xVwEFte0SI1Ca7GVQBW:Lss9p817SI1C6B
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28d80f7d4af8d7b9fa342c309e4634fba3e1a4d05e886232c1d826959a31ecfa
Files
-
28d80f7d4af8d7b9fa342c309e4634fba3e1a4d05e886232c1d826959a31ecfa.exe windows:6 windows x86
065803adbdcd9c2750a55cb42644f7fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EndPaint
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CreateProcessAsUserW
shell32
ShellExecuteExW
ole32
CoCreateGuid
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
libcurl
curl_slist_free_all
softwarelog
DestroyExportObj
wininet
InternetSetOptionW
winmm
timeGetTime
libeay32
ord484
libcrypto-1_1
OPENSSL_init_crypto
version
VerQueryValueW
iphlpapi
GetAdaptersInfo
winhttp
WinHttpGetIEProxyConfigForCurrentUser
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-utility-l1-1-0
rand
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE