} ����������A�uk�K>q���eM pSX��v�<;�$��Z�'EU�fi9�J���c�����"K�Xج@o�P���m�cI�K�T�O��aԹ�E�5�jls�r��5����[��i�I6��v��g9P<&Z+��ϕ���s��e��G�~�Z����N"=C!����d��iF�ޢq�elFqj�C��c����H̒3�Ѐ� ˒�ݎ/���ÒaEms2Ԛ�vA�/B�jD�_��tE2��I�%%�'�9e8����5��Z�]� ������p��2 �X�� r�F�f9,�\��$g]�7Zk��;@��Y�/d����Bn`���}������ [)Q{u�8+�ké��#��g�� c�=�`QmoR�U�+�� N��r���C��}�Q��x|8eQ>�Vwy�)���;�-7�>/��������@|yؽ3�(�K���<���t�ne�'�f~L)�Ѩ��+W�7aO�x���̦� �G��� ���*��� � ��8�T/�hu����;������K[�eV�"��fИx�c-����1�R'fQB��K3.�l�@��� G�1���Lkգ�ל^�f�6&�#L��������Q�����^��3s�/+�D����dQ�IlL�^���a86,Qߙ@1J:��}�V��ͥ���q�v�T�y�L=�"Р%�v(�0��G���} no�����_ԵC�v�쐎�;;� H%�߇H\[�C����u?$)�˫e����^`�,�;�'Ǝ��<�g�`k;rL���|/v�x$i��_-� k����&U���\��5��fijj�̪JIYR��vw��m-����ƨ�4�������j�����@�0��M�[�{,�����������R}��A�R�����]����ߴ��(���W��u�G��Q�C��-^�藏^.��3 $��4��O�x��&��6U����u� K���`lϬ[�\�ǭ�n�>��ڸl���ixM{� ڈ{���_��k��jG�#Y����Z_�v�^Z�N&��EK� 9�d�Su�{��6�D��Dd��u��)^���#('�J&��,FJ�ץ0�I�A�D������/"D}��Wo�/��h�X�븷C▫}�"0�s�Wkti �����М��s�Rד^���X��g�~{o4'�>Z��;�e9r�ÙN�.����k�� �P� �� t��*TsR ���R�-=KYo ��ڱQ�$F� os���1�Sw�����g��5��*�R���,$IF[+�� �+�%�f�"]������q�h���� -͙l�e$`�<�D�Q{��]t:����K^L�~���[��^E$���������@���|�6yD�(���b9EhM�ĺNPu�oO�u��KyK"�,Z��*�<�T�B��]{��{�Vxܦ06y��n�x��Rg{H}�J�����K����n��<�R� ����25ι0U�|,$�oQ�%NKd*��U~8.i���rp[a��`�����ZUo�pZ4{*F��jI�!SZxe<�]ҫ���!.�ѣ�|N̲�r�cw��FƝ&V�9>�|�1)$��'�sB�w�ŀꑏ�gJ��*���V����yj���^���̲i�Z#�ϊ���ה��{���/��0�j��0��^9H}������e*�½�i���)z�O (�Ur�͗%�D����DkWu�ur\L�ȧk&'5=��8$�>A.��C����D�=d0���Av��{��cZ��С��=�a���4RE-5q ���ƪآi�;�<���˰S*� 0��`�|vv���� ��u*I�fU�%�2�˼҂Qh��:b���8���_�)�1� ~B8��c��uo�v"�����p�͐��~bm]�W� �j�"�� ��Э���˽ݳ��0�lfi�ֹ�*$@?=�abB��o?�����A�^��e��!x��""e�^ SC�6���ĥ*��J�R��K")�c��y�4+&��_k 1�5w �+&qƝOCXxpԓ}P��[�O�(�T�� !ԕ�4�+!' ���h{�]��iz��kTS�u@�cv��!�w� 6E�ғ�ځs�S�gr���I(��?0F���#��:�h�A5�w���g���^�Wz< <�(LnIW��Q^@q�t�T�m�����4����;|8�5���!�y#���H�s�jMq��}l⛵9V�� i���G��|���Q��������լ(��hzO�� ��`FW����N�&؍�#����.d)�XX-��wuS����SL�����4Kk8�_ڪ��������Xk�������3N8V�~,��/ݚ��y[�#��f����B�:Ţ@��A�X�DU��]��{������������"�4�Ϛaoҕz�[���]e��א:�?��!<_�bPo� U�r�D�"�e������6�t#�̪6;�y�t[{��i���sj�%� �N������Ϩ��*���ǟ�p�D��E(S��{8�4X�E{��V^K�n�88� =K�Y%SG��'Z�k�;b��O������g ��OƽJ����}ƤC�\#��+��qP��l�OB<�Ry<v0n�f �jq,����Ǜ���в�}U*Fӧ��D�X��� ��gGꊤh��ː���s���/lċ����K;�c�RM�����jA�b��({ �j�!���"���(�2�l� �����5�P�=CHftwz��'���g��������Z�*�"�K�>ŗ��T�2�5�揓�Xٿ���W�b����)��f�5�V?�S����؎�B�߬�S-$����5XCyS����Qx]C��l彩 �T�yP�Jt�#���5��s��B��R/|Ex���x^%Zx�b���n`4��1�h�b��DR��,H��� �J*� m��b $�f�i�61|z�BW_Ҏ��Ms!s�.�6�0������+P��Р�?4+ ��&�`�a�� �g9ͦ�AA�džn�O�9%k�� �-�9�_�D#�Ё˳��L��K���`�M�+�a�#��n�&�
Behavioral task
behavioral1
Sample
137cd93feeae0026564cf4eecc56ea4b350810a7d82cc6d70a15bb6a4a097d9a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
137cd93feeae0026564cf4eecc56ea4b350810a7d82cc6d70a15bb6a4a097d9a.exe
Resource
win10v2004-20230915-en
General
-
Target
137cd93feeae0026564cf4eecc56ea4b350810a7d82cc6d70a15bb6a4a097d9a
-
Size
9.6MB
-
MD5
8ebaa5b36cb079109fe3d59841e3a796
-
SHA1
7fbb24c298c1aed7444b2c14bad3a11fb3319340
-
SHA256
137cd93feeae0026564cf4eecc56ea4b350810a7d82cc6d70a15bb6a4a097d9a
-
SHA512
85107ea50988fbe7c5bceaf9f04ee8ca31771391270f17bceae66fc263bcf3231320aa47257e47ce507fc262a42e8fcbd3b2b8e2b3045546fa4ad8f753e22108
-
SSDEEP
196608:NWkc6ZNJ+GMPFzJU1QJ8xF4mn2gIT9vzG0Kr+0rXRykYTv4:Lc4+V4nxOmnbIT9bc3PYTw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 137cd93feeae0026564cf4eecc56ea4b350810a7d82cc6d70a15bb6a4a097d9a
Files
-
137cd93feeae0026564cf4eecc56ea4b350810a7d82cc6d70a15bb6a4a097d9a.exe windows:6 windows x64
5bbffdb8f582f22734a0f3ce68424ef4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoCreateInstance
oleaut32
SysAllocString
ws2_32
WSAStartup
advapi32
LookupPrivilegeValueA
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ