�?�D N�ӝ�ձTǒ�� �<�& .�- �B��-xO.��#�p�\�V�?�^��ߺ�n�X�W,� YL�95����\m K�6Ǧ/��A++Dy����/��$T?;�F�T��u:����hG������1�L��x$��T!Ghɒ�^�3A4���"3��H������j��`�v-*�.!pZ �f� /�{�z�TIy+�������]��L:~;�����ވ�;�٪F���<�컎q'ؾ����lc��Z�d=����1�J�!�2�RN��� ����s��qדz C�[��s�Y��D���`���>o���zL��K�(��ðj�e:��.�����8�[�a����s`�Z|��CuW�8\�)���*�X�4���_��BщSfR�XA2WBrc��9��g#��"ʔe+��X8�XsUu`���Gb�]|�pn��/� 9I�4�|Y�¸/�sE_���IGĩL�՟Yu���ה�� tt�/`�:#�;aw!�t��<��K��L��`'ql�h���w�_?}��b?!��J���h���݂e�l`�`��ε:�5Wj�8�������!���&�^���J�´#_������[�2���q*m��K bՓ#1SJ�!v�%-�igmq�O��!#��;�tT�%_�Cx䃤�F��eLj� ��o< ��To���m�+�?����5�v��uE9/�:vt� S>��j�zzr6cna)��\�f� �'Y�^��Ix(�0�GOɂu�|�˩Ɯ�Iw� �7��y���P B��bj�X`�$ ��a��c�P��ZG�Z�� �N#x]r`�j+�'D��mw���`�����➜eu�έ)��@N�����1!�Q��7^�����E��`�>�"���3 Y����~�)k�����݇�T������Ul����L��,��-��\z+��FP�cL]+c+Ĝ"������'�����AҎ���ڗ�q�ԼR�T'� ���M� �*=G�)�#�e�z�E�ʭU� �� h&���!ūE��;�֠c���N��� ���b���*h ֗�a�U��n�l���Ҏ7^&��g�O�?�����G� �������k�p`�o�v�VC�I�3ly*�2ҋఎ!q>���y�7�6���t��s���CPA�t������o�3���Y�s����9d�b{�M�D2�i�2�����n���/�hr���*��I.��ę�P����lA�5������V��`ϥ�#a��7Ll\@���Uh��Վ�>D�;�ȇ��jM��E"����>h���I9����s��'6��(��S�&J^v%�T&C��i�yȇ7�,?�Q"wY�uDOYK��7c�� �b!BD�I1�����g���ڵ=�h7���W��شsW8���U�u�e슩h�a�"��Qf����zh�,�?R��t��J�y�� ���cRm9A��I�Z��xң�M1�35��g��G<4E�9'a}z�Ȋ�Z(� /�մK��J=h�ܺ|1��[w2v��r��\��^z���\�=%�v�J�7�`Ȁ"Q�l�ωΙˋ���@����L0sw���zgSy}�=~.Q��� S�B�'�`�ѵj#E������Ɖ9�����,�^f�Qc�����Z��Ƌ8d�t�PY��4{�Ew��1z>9�R�n� �͒�n���̯�C�����'=�yxX��^DY,��Q� N0��0�%�z��V�������O��%���c�ǁ����P�Y�"��D��M� ���;2~Et�9"S�z�O���0����n?�#ctӜj�[^�2����85���^ZoYUO�U�W�Dfc'����)��h ��|����=A���-AT�,]��x��*?��܂����t`��h&�d��@@+-��l Q[!�*C��uC����?���_+%`N�o풍Lr�%�Q��BG�/�S�|�]���퍠�V��Gg{������ ��=]���0e�_�� ����� 58�J(<WNب#^d�'I=6iٌ��L4�z��?h��x{�����? H�W]���$X�6� `ٯ�:B�%{o,a 0��ׄ��=����k���B��r�(�b[��(夏��.�%$]�om�i��[�sm߰Qy�N6��aO����z�ΉA�x�ύ~:̖�t#]O2��h-�Ni�x��w}��h�x8��j���2�L��u�) w�!W���ݐiz��ܮ�Wx�e�@�������8_NC�+ n���߉7A�W�F��բʩ5�b�P�^�z@�������`��o���M4Ƅ�>���d��9#��ӆŖ�[e�I�C����M�.��LOe���e�gI���0������?���_�Mh��T�������O�z#��8tn�?��[=�сa!m� d�Q�����*Xq�KLN�(-�4�kҗ܆)~�3Y�{Ǹ�ٰfY����_0`.+��l����UYN�U���"�=~��"! �ɔrF���.IvS^����S%�^��S�����m�(�@H��߅ ���uA���%&�&H�G��>��S�"�n���� ��؈������7g�t�R�}~�bx\�j���Oy��ɻ�K.�[&�4��\��$��T���86S'\p&�L������;GYjpJ��R�����^�S �q��gP�H����c�x�=u�� G:��/�Vq/��!�������ެet2��%�]Tm�FG���Y틝��n�Fh3�� �v��ueˇ7��<�#qp�'�}m!�����Q4Uj���%Q�����)�|yQK���^(l�~���RR"���i���"�:�5/���0S�0���g��8� r�� �O���%{@��#��-,b�����iT�rS�BZ�N�ag�D��3]�훃$r!�K9�þWo��n����6�����>E!oU�3W�R�6�)�1�@1�A�K�Ϯ�5i:?���?5�kNa�/e�h��E������EF�$aj�`xp��b�����މ�� ���,)z*0��*�H��dc��
Behavioral task
behavioral1
Sample
dc7c542175416933cb89558a94d0e34cdc795ba3d030197bafbe2b072fcd8d9d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dc7c542175416933cb89558a94d0e34cdc795ba3d030197bafbe2b072fcd8d9d.exe
Resource
win10v2004-20230915-en
General
-
Target
dc7c542175416933cb89558a94d0e34cdc795ba3d030197bafbe2b072fcd8d9d
-
Size
10.0MB
-
MD5
d9c6f7e8b7a70471cef69c4ae3f2f164
-
SHA1
46ee41d7654be7f20c6d93658ed816f1b65b2859
-
SHA256
dc7c542175416933cb89558a94d0e34cdc795ba3d030197bafbe2b072fcd8d9d
-
SHA512
36bbd9fde49e5e7e6056978e244a3a61ec495fcd0b6ce82f09282cefaa1e555689dc4ad9924a1aca3c6288aea1669a460bf3241d9e1066e96a472c38153bbac4
-
SSDEEP
196608:zL9KgiI1O4THH3EUAf6TWQvTDCR/ESfdrQUYKyQjKNub:zLogiIU4THH3EYWQvTDK/EkLtKNU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc7c542175416933cb89558a94d0e34cdc795ba3d030197bafbe2b072fcd8d9d
Files
-
dc7c542175416933cb89558a94d0e34cdc795ba3d030197bafbe2b072fcd8d9d.exe windows:6 windows x86
a85e5dd63b2cd6edfe767bdbcf0ef509
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetVersionExA
GetVersion
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageW
CharUpperBuffW
gdi32
SetViewportExtEx
msimg32
TransparentBlt
winspool.drv
OpenPrinterW
advapi32
RegSetValueExW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHGetFileInfoW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
uxtheme
GetThemePartSize
ole32
CreateILockBytesOnHGlobal
oleaut32
VariantInit
oledlg
OleUIBusyW
urlmon
URLDownloadToFileW
gdiplus
GdipCreateBitmapFromStream
psapi
GetProcessMemoryInfo
wininet
DeleteUrlCacheEntryW
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
winmm
PlaySoundW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 585KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.9MB - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ