ǿͺP~T'�0�ό~���)i�<1�s����Or'=o�F���� I\��!e4N�\�th����sJ�>�F��fIգeQ�^Ho�j�:1Զ(�]d��?�;u�-�O��5V@��*�ѱ�S�)R��'"w��ú��!�_K�0Ӯ���VO������G�b�{�[y�W�[w;i������`��Pz��*O=L��#��3������JI��x��G���au+�8$��(#I�~�yBE�hO���Lx#�s� ;&���3m�fj?:L�D�X>9T�k�AޗJ�I0O�U�`uW���e�2L�<.���P��CsVf#�]����j�*QE�y?��a>�Q�:ѩ��#��(�z:��'���μ�����h5ẏ��ǭ�uk_���T-�DXi��t�(�k� *T!LŦ͆���F��f���:��u��O�b=Hߗ��`��WIlv�a#�]���I��ŗ��^��R2r��=6���+7���0<�5��C�Ԕ�g�0e��{�A��ŘH^7T�X{TF�ɜ�V��N��������Io'?��=���y��\�ET�g�D�~Vc\1�9g�Ч@��n1 R%����ȥ��Z~$F���Їd����g?����t�i$���u;���|���?,q2`�Lf�x-���K��rX+M�C�y��3b�+#�_����g����S#�0��r6D���%@%M����ISS|R���6����=y m$�X����]�}�]��(���\�� ���&��;��E�i�TuH-$��!|� i���� �(ɦhy� ���� �\'L�W՜�������Ƨ�o��6�f�ه�dk����L6������g� ���%���*�R��"u|�60mޫ� ڬ�J��M߉� ͖u�V>�Z��N�{*�mR�v+���P������a>r�����BT�S��M�� lD�g��ZLx�G|6R�i��J?>��$Qg�����IY���$w3��]���� ����ܵ o�qȶ SVU���j�i=���U� ��L�G�(Y�+>����@-6H�O��33��MUNh�%� "��F+�|�y�'F"|j�(0����lH[�2�H�6,2* �\J����Ѽri"p�56��������ڏǻ��(6�<���n�'��S��F' �m9�w��'����B�����zV�_�L%Q�dZq���I��m�J����-�O�=�������|��e���^J�NJY>��d��XX������_f��;z)\C����\��3W��J8X������o��Ζ*a��$��'��Y�b�b���I��j��R�#8�/�6�sI ��\yp�ǔh`��= O �.>�A/ϭ����*CPmA���U��C�4�Mf��B��K���&�w��e\�,� &K:zN/��e��Δi�;��C?$�.v�ו�+Y�|{�Q��q�8롏�8�G�>����I"�J7XH��p�A|4�M@��=�LX�Ts�����$�E��EYW���?�����(r���Nr�4�K������?���� �! ��2@-Ho�0��\��-�I&��[i"I2/��"��/�.��� �[�ˑ�2��h~x���V�u���Xrcr{d�M9����(��1Q�C���k��oG(����Su���x���^��;��<���T"κ�-��E�7��v��g�<���;�D�"����N�ٕ��ln+�m���(Lh͵��3~���+x�������Ѭ��~����������S�s�u&>9�7���m"��/]�x|�I�P�T���i�G9iuBp-�l(�;�r�[�U�؞� �h��1�M|��/���-"#����3��F�쏑�zBb�X�1o���#�`�鮬�2] �{���� �u|�1��@r�]��{˖���+�Kt���t����)�y�(G�-_W�S������ 豨�������eds?�3�uc�P����)Yl�o�Jl�X��c�E$L�h�O|^J����{h�V���$҇5��/7,0�n�hgT�z�3z,�<��H#�o�Z��0�ϧ��H�gy�n�5�Hh������]~����E�����O<M�O>a��[)(������U�wNm������U��w���+���L�Cq4�7��F � �!G�~z���G?F��c܆���dU��p����P�6��=36E,�d�!O����s�Co�ѩnfn��T�@O�8�ѿ|���>a�S2-��5К���`�������A�v0M�x�T%)�4b�������Q�c����<�;tTJ���@�i4���y`F�5��v���I�����ߘ�--���?WWN_w�6�U7�uA 1���G�9r�j_�#��Q{�p����i9I Ǯ��������]Q����e�.��^�p9bc������k$���=x�{�K�?u%�����#��� �ڃ�������臖�'�zu���r��q�|�y��R�*�|J!���Ӗ���MO[G�B'��<��!� Z�����m�m��G�?*�`ķ*0x����ͫ/���i,\PЬiW��q��J����q'�@����z�6�G��h��B ������7�pt�\��h��4�>�y��NI����\ʶqٟ����J�C���$�y�9T�J�H��RAv����G�D��u}Xqۮ�-���&��� �-|Yu��B��;��5�v����q`��M��D��4�4I�}H����X��T����4'��J��� q�ŏ�bK"G���"U�d36|�����_m;��YpK�� j����h3�����%@Ȇ��j���^�|!��8�O\����`�O��%�G�3�[fW��-N'P���8�PhZf! ���J^�p�ge�h�7�b�fV�2� �����Wo}:�τp�8?��@}�5�b��@�r2j����su<��9E�$� 2GT4��x�M�>8�\&�9;[�ۛW�%/ȅi���������v\�����ă d��m�jf�s
Behavioral task
behavioral1
Sample
71bc090d8509c18f13fdcabda2d4595661bcc7fdb17589e37d9158f6d62702ec.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
71bc090d8509c18f13fdcabda2d4595661bcc7fdb17589e37d9158f6d62702ec.exe
Resource
win10v2004-20231023-en
General
-
Target
71bc090d8509c18f13fdcabda2d4595661bcc7fdb17589e37d9158f6d62702ec
-
Size
10.7MB
-
MD5
d0a0058c5ef884009e12ee91ae14efdd
-
SHA1
802aa19c9e1f4642467bc08d42f85dc08699b5a6
-
SHA256
71bc090d8509c18f13fdcabda2d4595661bcc7fdb17589e37d9158f6d62702ec
-
SHA512
c8af3dd555b67e39f03c3f1a822d7e74c4a0d13685aaab2e674fd92dde1a73ce75431cee6ab7a0dabd94b9cbcd10217c08c1815c20f1670f80fa454b970ecd9f
-
SSDEEP
196608:FrR/a0ISLXfk7Wcafe3VsyU5TnTQEu5ZVWjidWf+lHmzH0U:FrROSISje3eyUtxjidWf+eH0U
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71bc090d8509c18f13fdcabda2d4595661bcc7fdb17589e37d9158f6d62702ec
Files
-
71bc090d8509c18f13fdcabda2d4595661bcc7fdb17589e37d9158f6d62702ec.exe windows:5 windows x86
f94c5eb4549eb8d75ff1083338e6e89c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
qt5gui
??0QColor@@QAE@W4GlobalColor@Qt@@@Z
qt5widgets
?metaObject@QFrame@@UBEPBUQMetaObject@@XZ
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
libeay32
ord492
hidapi
hid_init
msvcp120
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
msvcr120
_fmode
ws2_32
connect
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ