X�-ky�d��Q�I�����T���!�D�/��"*rt��˷��Fc�(�� z�N��p�]���:8��Z�/�Y܌ԛF�5�}趆pXa2���V�%$��m�%�������)�x��l�Dp��L���^b�A��ʑcD��*6Rn�#i�)��N�1Rz���ڇ��쎨N� �g��t��!B~���k��+\J^�26��L�7�3��f�ZP(���m5I��sv�S��n�y�o4�y�K�2��k��[U��J�)u���5�;�����v��+`��Ԟ<�a�?�!�3�3��)�a��}� E��eC�J��-y�P�A��d˶U�/p�<U��!�$;�6�11v�Gx�PY�+)l�P7� ��R������d1��������m����W��4�2�g9{���!B�3�r�hf2��BU��{�5K����|��j!��f5���3 ��k8����q�j�`���浍}���u�3�-r��84���T��3Z�N�c��]1����F�����U����~�%L����yf��i~�� @{_&���̥/���Rb�����~؋�q=���2�U\�dN�8�Ϥm����T�{4g�b:^6K�B�Їu��Uԧ9����/x�#r�t�?��Jk#,ף U y�)�8�㴦�3 `�$���!�_95=�?|�P�!�������}������ 0o(�1v�ꆕ�� ���}���&��%�0��<ϳ':�z�� �F�������?���m�&��נ��Vlu��n���,~� Ԗ�8&{+>�G��DFӁ���Dko�>=FP���⊝��ȝ�s�+�im�PO1w��{ ���C�!"j��X*�Ј�RJ���^{�!�tXˏ���t��釼8\��e�!yR�Q�{2��8��f����6̇4M��I�oTo��a,���l��ۛE6[i�ˌ%>4��3tE(���.G������s��W �?̖��=�J�֊�!+-�Zc ~�l&��i��w\62���b���{��_�vʧǸG1K骜��p��1�vq�T��Q��!��!b���k���� � �z�^@t�LA��p��)Q�x(�m�0/} =/:�M9��U�v�$��s���#�s'֩~��`�7 ����9�J2j�ЭP�G�;/-��I��o��v� �&�]�UݭO�۵�7hVsUrʠ{��" 6�?��A4[�F�Ѽ� G �� X��`�}����!��(��64��3}Q�` � ?j����'C����F���8��IFm�cb���\R+䅛}��[�-�T�F .�p{��\7�˲��X�-,6�i��H�.��VJ�#1�������:��.�U�<<y�9|E]E��Z�K\�Gꢁ��7f<Yv�c"9s����k��z%��"s��u$3�ʋ�_����_^4=�#fo?���C��-@�[]+��Pc�p�j_������3����5zɢm�WM�bdV�T��}�=O.�E�����b�(�������-�G��NH��m�.�zǿ�<:ݰl��3҃}�M̎�&Tq���W���m�Ҥ�L����!�;�bڥCTէ\\��}^0��NOUC���T��6Z�l���1#"q̤5���~(1�G'�� h��C� ,+���!҅���Y��2�jP����q���4�=��l��o��"�#{[���j%&����h�W��oțXE����c�`z��L�g�w#&�q�:�8�K�>G����5��S�(N:V%�mˠ�b<���y����"��Mj᧼�ޝ/x-���7�z����Q}m���-(K����Ѳ9n����`����J�����Q��7���ᐲ9/�/��$[W�H�'��BL �c@)�T��푣��ԉ��y����� � �顣��}S�/{����_����{�b=f��Y��'N� �ia�s�o#�jo�����\�Y+ۇ~Tb��2[�>��j��M�j1��"� �����6 ���^| ����Z���n�{Gy34���O�~����NPgkެ�hW��B���<`/ʈ�Z��HU� ``��yt0r:(�6C�^����1ݢ��F�3��rn(�`�*r��ք&F�v��`�/��������>����VT���|��.g��/�d��%�/�3K�S.�zV�+ؑ���oAjII8-�o#�%�ѧ�� ��Q�1|�2�����L4�J�;3�w4҉�?��~�8Z����j���R�;0mOL�[��&��m��]O8���?�]�/x�h�0��P�3�k�`}�ƥfD�,mj�q��% ��J*!#���?&h�yB�!DC�Ϯ\5����T��ݳ�Ո��U�X�GwVg�ߨ�b�#�ۙuHd�s��K+5#^ݸN��)�������$��i{�f+�u/� ��n*��!��B���������Z[ ��/�����,,F�宅Ӛ��s��͝Zz᧒Ա�7��p��Yu~�qZ�E3���9��j8u�g�vD����P%���s��e��>��׆䚏�q��*��&^������ Ԛ��J�;�I�(�d���\��D��E[��I`,P��Z�T��X�.՟=�J�z���X���P ilm�S���EB���1V�1t���D�?��Q�P��d�Η�K���>C1���W�3��ȉ3>ʦK�������l���A�jo�*iJ��7���m�|~"�����H .ۻP�zk�V���E`T�Ezt�}���Y��G(�"=0UP���qU��Qk=ݙ��Q R�\�-,�vB�to��q���F���L6��@=A,0.�v=�(&>�~����8��`���t|"kɕ���+γ�7ي���P�R�?���NG�j��uo^ ���/�;S�nV��'����4|����k����x����_���t8�f3�%�A��^ ���V�1@[�:���0��4ZeC|�üF���l����&!�!��s�bXɨ�QK���'�gn���k�~��<_�.��SԽ� J������ӹV�ny=xHc�>��������G�߁�^�:_�,En%*zo�O�~oO�8�@����Ϸ2m���N��
Behavioral task
behavioral1
Sample
d30fae6c6f87f498c17cab124632f9d7ba1aa07610823a9dd11bad0dc50e21aa.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d30fae6c6f87f498c17cab124632f9d7ba1aa07610823a9dd11bad0dc50e21aa.exe
Resource
win10v2004-20230915-en
General
-
Target
d30fae6c6f87f498c17cab124632f9d7ba1aa07610823a9dd11bad0dc50e21aa
-
Size
8.5MB
-
MD5
11adfdf96d4a52ca2486e8145c4ed2ba
-
SHA1
7912f7c10e5dac516de37f5588f33e60dcb114ab
-
SHA256
d30fae6c6f87f498c17cab124632f9d7ba1aa07610823a9dd11bad0dc50e21aa
-
SHA512
799d23f0e3bab177a0f991971b678a4c13f0d67500c9e0d90878d9ed42790d683c86cdaf628cfc3d7f38883ce596c22a34f24f097e363a60550c12bd56ea9eb9
-
SSDEEP
196608:+MJFGavNH2cLBRBhFLKkiv/iuaiDYGzk:+MDGavNWctFFL5G/9D1zk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d30fae6c6f87f498c17cab124632f9d7ba1aa07610823a9dd11bad0dc50e21aa
Files
-
d30fae6c6f87f498c17cab124632f9d7ba1aa07610823a9dd11bad0dc50e21aa.exe windows:6 windows x86
1fa1a0d07d631fe2e857fc61500e1607
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRectRgn
msimg32
TransparentBlt
winspool.drv
OpenPrinterW
advapi32
RegDeleteValueW
shell32
SHGetMalloc
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionW
uxtheme
DrawThemeBackground
ole32
OleIsCurrentClipboard
oleaut32
SysFreeString
oledlg
OleUIBusyW
gdiplus
GdipDrawImageRectI
oleacc
LresultFromObject
imm32
ImmGetOpenStatus
winmm
PlaySoundW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ