�+dI ���Y�L�S�f�3Q���>ćd#\��1�'=�Q1���ͩk9ˬ���Pu�콑�a;[t��朁E0�fՊI�����3���O[м�K������LNI�IG�;蝜�p��E����i�2v��L�>$�<a�}��s�?��4dw��x�e&���ލ�W����̔\���T��)�ٙ���,��<��O�!m�A�����B������q}`l�g!���H{Ũ�Wq��۠�C��\G4���%��>��BK��1�V�H6Q7� ]�A1u�x���I�5 ��[���<Q��o ��ʖ�$6d����/;,��v����;�1,���UoUE=(p&�5J�2P[ `�{]Ƙ��!����aWV���� �A�w�ٛ���5q��_G��-MsG3�xv�f�+��,kO���Z-��:�Hy��)K��t��l�d�_ut��-�ӂ.B��8v��:��d����*dհ��DM#� +?�r���B@5&K��=&k|�w�h��K}˰`W������<vE�eW��r�.1���-G8�,6��ےx��c�c�utZu&���?�p���7{�7��;��\j��A�e��̲U�s�/EdJP˿���P~c��s� ���P��yy���ӈ\=��sB�W�KW�4���l�L�<�;"{�>,��y�}��M7\���,��t�����t����B���O�C���s;q�E:|�c/�L��W��X�6��ɧ�vhh��t}Mz�N���Y�y|�ylnV� �L��@��6���S.U��T#Ƭ�;9�� �Kʢ;:���gmRy�)���/�����k�idQ����@��n����Wn'D�%y����rh�w?�~9�~��bFx�1(��#��I�^E;y>�� ���5�`�8C�_F{q����^�����"�U�ӹ�(j1�� ���]afH����m���by���(� �U��Z)�xak�l;�h���jġ�7���yh�/ �su|9�Ë���(�-:��_���ؖ3����M٘��h�Es���{25�k)�6��t�W��eu��*��DB��9K�|S�� �]c��x�r5=�g���*����HTZ�<8⏡�eN)T�I&�R��.Pz#���蹂=�2���!R(2�27Ç�!P7��r���CQO��ܪL=V:�VX ������͆<;j|9�P5�zD�g����Ӓ�%㇆c��#�\2a��N�Pb��#���4�8n5hi�Kl��} �u�3?�MH��/����Û��}�poe�{�!͙c^}e��$�F��LVM�w�S�1��g�>�!E�*?��Ks��*�b���9���E�\�8- Ԥ���<�_�-��zp|=�1%�7.��(E�Zd[宴y��6U@O��P�'�QJ�Ѫ�� `e;��2�g ��������$�e�쳩�����/ �w]g�fP᳟)���z���4��'K}͎Ǩ#m�T�ɖ��k3y�~tՖ^x�g4��P ����:`qj&K7y�Ldx$/Z��a������1O�ձ�N�,��.��z�����}�/ʼ����c�Rj��7��������,�~��#*گ �%6ޒ�T'+n�cǴn��Dr_��Y�1��c��U,L~n�ķX�I�-Kg��0�N7+s̈́8i�7b]N �: ��f�����������5\��\r:ĠV_h�Mf��MgN(��OK-Y��G�z'@@���4 ���/{H~�7��@�y~��S�)$�0�ޛi�5��)�H�ŮI�D u�5�ad�K��Y�Q �A(OV���K\� �* P�4��7�ױ�g��ZF]��i�̯t��ΨsOpxO��A�����|b +�'�T��]��:[������p'pS��لboM���]������Fei-Ү��g��*>��A�mG��n����tL\b}c���2�#q<�a��K�16A9��W�K���پ���G �Үi�x�� �6z��[��Ԙ�ު��ţM�yf��ΤӷkIQ�����m���E�E9���l�G�O�Er���X�P��>nw��"JZ顣3�.�C��l@�kjZ�ks]�pE�[��,�zu�<bWk��_xA>�]�q���л���M��ܶ��kſ�=ċ�;)!�I}�k��Ɋ��?���!M����}l��HɵxQ��Ax�����<�����/��{���f��Dyk?�����!a�j�W�pPT�����a?|dz��KF�(����.��p���Zw�i�M�� ��}�W�����������I��zV\������a����YN�uD� ��xe���9ּ���u|�f$� �Y��X֖0{;�ڨόO�T뺣�o�YykϚ���$�OT��`;5��mi��6���Z�s~-Y}�� ɖA�Q&�����ƿh��� ��d*�$���,T�G� ̦˳�b��+U=�\���Ԓ��H�^7���ʀ3���?��m���@L�o7��am0������ƹK�I�������2V;�Z6��t�E/�|�ȹ{��ư��.Q��&ʎO.A ��&GfZ�{��e�4F�܃����4�`�����`����<22����āj���\|�6��.�䟌ٟ���cro->xh0�F�);�/�Ȁ��l�@Σ�q�A�g�8�g�ȝ(��u�� �ͪ_7��֝a~7y&PdJ�L�V�w��T��U�����7.R��p2!���^����~�!��_���(4��%���Z[M,zw�����K��O�G��E��:��x:����_��� xR �Pߞ��^ާ��b�*�S�;F,:�Xg?(�� ���C�eQ�g��%����~2�xN��L�,^�fqfk�W����8�p x��JW�!�˦����c�>���MW#�)�v���U���.]�1�N\s�}��8T�J5�Yyâ̪�8�!Q�@.�ɨ��佃8��%l�(����K�-J�)B!�)�1Dj�6Ҏ��М����M�I� �)�1מ�ў����{<wҚscIV��N�'�>Y��|�v^��b�H�� �`5cS�*7\;�%���24)���x�>6���r*����E&���$M�u��=���� �4ٿ�Sz���o�
Behavioral task
behavioral1
Sample
d676373a869927099789caf24888a2e2fb55f45bc9ef819f8464694855e379da.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d676373a869927099789caf24888a2e2fb55f45bc9ef819f8464694855e379da.exe
Resource
win10v2004-20230915-en
General
-
Target
d676373a869927099789caf24888a2e2fb55f45bc9ef819f8464694855e379da
-
Size
11.0MB
-
MD5
0cad5328cb301ee3d46db8e58c4dd481
-
SHA1
23f98167d23fcb2b1186e0e73a4c4f8fa46e2039
-
SHA256
d676373a869927099789caf24888a2e2fb55f45bc9ef819f8464694855e379da
-
SHA512
e2cdd461f99b6f45c426f2766286b240f68e5530707bdc4e9ccb76bddcf17cd4d61de0316422a9a3fb98aa3024b507b887d6b1c9128823bb5de3cc1c9a4efc18
-
SSDEEP
196608:VByefKq5/9n6+iHoxdr+yxdlQqaNJ2xcnHeIvgApXiLvz/jsXa6iqhmI5qlY2pRt:VdZ5VVL5xXQDn2inHeIDevz/AaixB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d676373a869927099789caf24888a2e2fb55f45bc9ef819f8464694855e379da
Files
-
d676373a869927099789caf24888a2e2fb55f45bc9ef819f8464694855e379da.exe windows:6 windows x86
f9697c69904afbb5f8e21bc5f11e2793
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDlgCtrlID
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExtSelectClipRgn
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
RegisterDragDrop
msimg32
AlphaBlend
comctl32
_TrackMouseEvent
shlwapi
PathIsDirectoryA
uxtheme
GetCurrentThemeName
oledlg
ord8
urlmon
URLDownloadToFileA
winmm
PlaySoundA
wininet
InternetCloseHandle
ws2_32
select
gdiplus
GdipDisposeImage
oleacc
LresultFromObject
imm32
ImmReleaseContext
winspool.drv
DocumentPropertiesA
oleaut32
VarBstrFromDate
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 625KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.0MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ