���J�rl>�=����ǚS�7�=�Yk�q$`ll^�O��U�RיW5�PD�"��yK��`ط� ¢���Wo���ߥ����N��݃�a������V��7@g; -���Q-����u��]��#Kr6��m���'�`jw � �Ot�y�NBU�cQx����]Ɯ�yS[����N�0��2j�:��^4HK5<��Qzܰ�SP��Eƣ����Mg�e|�/k��=b ��8�Fy��A���U��A�,��HP���CW��b�E����մdf�p_�Lu�t++�>vb Y��&&����YM���?mX�����RV�*�A<�ưm=C����.GL{��/!ߋy��i��N�m (L�U1����Y�$�O�kO?MJ2%�K�R>�(��0Xu� ��y�l1K�%~h㿩�]����1d�� ����:!/��ڪ7��.��j�Za�5��5�r��Gv%l΄���/p�7�F���S��N~%(n@k��_!D��ոd.`j������3��,C{#m!��W���y��.������w�������bgL��?�?�y�`=v8p%f����i�|�=�ǥ{JX�CS�<t�,+�:'i¶EC��z��f�����/@<�w��X>+@�w����H�g�$�����է\҇z�5�'�F>-.�HQ'���9k� 2���տD��|��@`ż0D�.Kc����}R_`����$} I��#�[Z���❩����l���"�������G��rnKy�$�[<uPG�{>�*-<r�p����,MƩV9�����Gl���wXz��)�����.]#-��+Ȯ㟴J{���p,��~s���(I�-�y߸�'44��Z�)>��7����Y��R�Q9�hB�����kC����Sz��ItiSJ-��,F���b딕����/��}�չlήq�0XN�9�6p� (J̘Ҋ�#���������x.i~�|��]�ִJ�+�#��g��-��w������6;E����c��ᆌbt��i.z>�Ug����e���^x���'q���&��{gj�u���p���(3xd�y���Mۻ،��_-s`����fr9W���bTQfi�wCl��-P�{��T�%U=Fn+|)�p�����Pbʫk�\G:|�e���[�RYV�D.�y��c[���-r���I�( O6�����'����܇���'������uу,^��R�d���Uq�����Cr-.��9�Qy|T�%��>�D���TA�Y8j��������҉�,��*{��� �S�4�?a}����7 ��G�D�4���J��+V���` ��^�yў�< ��Y�n7��Z�Sf������������)����Ř8 1��>���mG���8%��y-?'�C�cND���R��dd�L���3iK��n��CS5+#�DR�� �@"��#m�zڷϥ�M%-�n�}v���цU���$��>���n��n�=�\f-�GRM���5��kk����3��M�;�u�0�3(��A[���j{Z�-7������审d�ɝ��R�5���z囃���toF����s����!��������ʴ� �SO�E��o�mZ������D�[XLï�[�.�P?�o/�/�ŝS5�/�����}����`,�Rjd��鯭;�>u�W�>M�����"�y`��}'��`�l�ܜ��K:�>��Ph}�W��Tб��'���z"o�.hΞI��QX0�=�}���{�c�/f�5d����C+�7~6�W;nt�H�"29߂k�e^Q�hg����{�SzX#vi���p�t>��j�Ʌ�N�t�����m<S��'lۺG��P�.>�`���8����$mX��'~^��e\����x�f.b��G�t���Wgq����q��h�u�~���돀� ����j����:K�<�O89�#b���-�>�\�t�}'���f����E&%�.gYP�"k��/Y������u�����V�e���'B���%Z)����N{��gr7]~�R(��k��it�.�&0i�r��ڵ���W"�@*y)��vKU����F����n��}E2��~�YQ��;)����z���%Qd��=�,��n�E-3�]����Ae��\�*�U"�#&�K���,b���0ѩ��9�:���@��-c�܋��ɡ�1ڝ�!���EI�U+F�*\��aQh/ 5Cs r�C��[�R�j�Q���QT!l��u6K�������SSz�=[L<���>Gm� 6�ԓ�.�+8������,����� �-�u���;IP#�J����$�ş[Ѯ�7��G��95ym�q�X������T��`T�~��e�7�c8��0�_(+�?������3�d���Yz|YP�҂��sS�)EW�����YZ�+6��h'�w &H9f՟!8�.d����d��;>"(�ų �?W* �)��N�w5'���I�sX�J�����DJI����6�dM�wOn��ƅ��#�F!v�+,{Π݀���^J]�*L�٬�OJ���b���0r/�߅�3�"��vp�o���*�C885vvzH� |���m�I)��?����J��v�Li�Y�d�J|-Z��&���رp2��f4�p�U����+[+��͐ƴs,����8A!�/w�咔3luk�s�������'ݯ�L�p0��z:�v�ll�!G� �=[o�=���F]��]�ح�$���T>���w@���)��)���SW�hb�oݝc*T��H��GW�� q��͏���dWK�ӡ�$��=.�n"�٦Fŝ9��Jug��gxY��ѶK��N�>;�D^�Y-� ��GpL.x�D��=x$�S���-�sL[��C>����n�Xa�"U��*x��ë!&�����p����Vlש]#e��W%�0P��m��k)#��d�����B�#��w���T4�>���Rp+�+���N��M��Փ?���I���b@y�``���l��*���ڴm��?���T9�%��c��kT�]�B�ЄL�&�7wLB���a���<)fڸ�
Behavioral task
behavioral1
Sample
3eb03d5a17ede47e3f3f1da7b1848818e2984dfed5c1c202d5665a91d3e7695d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3eb03d5a17ede47e3f3f1da7b1848818e2984dfed5c1c202d5665a91d3e7695d.exe
Resource
win10v2004-20230915-en
General
-
Target
3eb03d5a17ede47e3f3f1da7b1848818e2984dfed5c1c202d5665a91d3e7695d
-
Size
6.8MB
-
MD5
3507eb72662ec3ede0f95ead045e1ae1
-
SHA1
b4dac621421149fd87f841a560fef1ecd2960648
-
SHA256
3eb03d5a17ede47e3f3f1da7b1848818e2984dfed5c1c202d5665a91d3e7695d
-
SHA512
fe4465aa9e457e02bc3739f6044a412921fd1525b0cee2604a506cf2df72f0bc2f8ebc0687dfe4f4ce25345f0fe444c02fdfd4ecd340b3bb5dc8a6212c3f9536
-
SSDEEP
196608:yc4NLqu1lMWZNzYzkl4ZY+KBxeUN9RjYYSG:yNqu/MWLGk2eDjI9G
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3eb03d5a17ede47e3f3f1da7b1848818e2984dfed5c1c202d5665a91d3e7695d
Files
-
3eb03d5a17ede47e3f3f1da7b1848818e2984dfed5c1c202d5665a91d3e7695d.exe windows:5 windows x86
bb7e9dfe717dc7032dd32abf8efb2309
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?shared_null@QListData@@2UData@1@B
libeay32
ord491
qt5widgets
?metaObject@QScrollArea@@UBEPBUQMetaObject@@XZ
qt5gui
??1QFont@@QAE@XZ
qt5sql
?close@QSqlDatabase@@QAEXXZ
kernel32
Process32FirstW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseCapture
advapi32
RegCloseKey
hidapi
hid_enumerate
msvcr120
_initterm
msvcp120
?_Xlength_error@std@@YAXPBD@Z
shell32
CommandLineToArgvW
Exports
Exports
Sections
.text Size: - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ