���̊��%�V9=���?X�ť��������շ���Q�������i*R�B�����S�Qu�cZLV2�������!3P�� �v�%D������T��_�E?��U=�obZ4W���bh�/���7TR%��[�`�!vtcΘ^~����/��u�;�(�����K�CAb������%�����tzE[�2���Rd�3 �ƬZ�VFM�8���qZ��տi� kߊ�ad��e���_sWw^��^5��K�:�̽�Dl��`�^�xѲ\���#�G��Jɬ��~B��0ɧU�x��W�t������������[�-5�ôuzУ��2;�}�\6� ��n����<!� ����1� >��F1�K}.2���^��>I�n�MӯW�)ۚ� ��%� ��Y��_ ;Gssԩ�-��Eqfq��Җ�������-U��N#eaf�+�Pv~�� ��R�`��]/ͨj�7*N@�Y��ɹ����w��h��P���uU�`�R���av�DϱN⍦�f�T���x�Z�}~?�\��I-yJ�!'��m=>�� (;!�����a����JI7��#��r��z���]=/���}���+��6Bn�̠�vVRA_U{H��.}%YA�t�A#��������*�"����æ�m�u����g/r�5��6�� !�PU<�">K4�bRL�b��8����ˮ��֍�;1�bk�~�V!ڱoDK��o�/a�4�������� )Z�ơCtEb�kwLMRS��RIV�W���Zمɝ!��tq�+/�G��� ��.���Q�=�~)��S"���s�Ki�hRtEd���YvR��_|i�#f� ���! E �� 9goi˸���������9�6UEBx)��M���P�cB�����+�J�eW7kE<��H~�uE���Jy��<���}��u�o���\-��qqv}�<�����kvi�v���8` ����cꬿ��?���� ì�� �Qqr~�v�y��䟒l�H%k�'~mOo�A����j%-N�$�#O"��3��c�9�����i� ����a��/=/4O�m}|�6W���43&�J�u/O#�A?ffF���\|7����S.��{�o������C���u��H>���ήpn�BXl͐ ��_��e�$�V� \����f5hm/�����KS<�z��wa�PZ�����fY�PE��k�4}&ei���Z�E�]@�s虝,��� ���*��Xܗ|�f{����>\���CȤ�W������O���S~.���K2�����+�Rj6�[�R��-tٔs�5\�pve��X�S�-�MҼ|��1�,@r�}'4�3dL�ӎw����`]�ܾ��I�3�[ r,m6k9l���g�էUz����kŭ�,�cN�9��&�I`2"HʧU�*��$��<i�b�c$�D����F ��Ԧ��zLq`\�j�h�quM_�A0��Qd5��j�ˇ�l]�#���M� � <�K]:�P�>�]q�eI�yU��W����;m�H��ܠ!���\B��$0V���|/�g���g^ tD�\^����������C����d�|��7�z��=0%���Uln+��Bw�_Ԉv��$�Eu��D\�}���b��E��z�A;�,�=��� �7��t%K�j&�*g�����YτL��M�#�p^0Hggљ�-�x�m�c�d�*9�v�S�C�En������H �&db��C=�����U,�(�)�nua�t��EH#���2šD��٦�Լ�u�6lv��Jӥw��K����L"�6�R+O�7Ң�+p>����Y�$�Ӣ^�� ��5��lEnqJ�H|��G�¢�U������V0�fa�~,���}�i7Ԯ�h������(&��]���������֙T��GC��:�¸k���3�3O湃cJ���_?E+��� 39M�X�m�����r �b|�U��A��0�%�������q��P"ٽ��,A���1.P��p���Cx6$N��I]�����EOֻ����� Q}�M�!tu���S��'�#b\m>_�+���Q\o����dI�?a���j��Tb@$�H+!SK���d�vԔ�|I��Z?�Ӯ]�d�),�n�G��E��;�T��]����gPn��l��X}�Igq���KQ� ��Y��7LWִ�J="qq��è����tm��:EfD���*2L�t@������4c�:� �y�ϑֵT%Zu�G�P��o���x��֩?���y�w!�ޯ�����a��S����d@1%��Sf{Z����!N�,/S� KFG���b�a��2�=���_������>=ּIM�4;\5�mIm�T���&�_)��U�߷ڗ+���c댽�+X ��V��@20��G+Сu4�����1;��~��/�a��e�&T��t�����C�,� ��/�a�*Ǿ:9h9���GL�K�&vß��/� ���_������<��Q|s�r2N�(.�_ƩCI� Mv #�>y�Yd:��Eg�[���N��� ���/,9$��NN�k�*�'��K�밋�fLl�K�SqBf�H0yC2��C�Rbx���U1r'�Ә:O�3�UQ&"|�D��I ��pyKի:�c_����hw��-W���s��`���f�aX��������J�\��-d��z�,N�����{3D_ �1RHו�A"����)l���cJI��� �C��xB�a����/�"�sN�$��n��� �ݷi_68Kxj���_�G�[ Fۏ�⪎�s�^�Io����b��ve r_���:\W�M��.�3ވJ���O� ��r�-�d~����Iӷ�W}��UG��1�����!-�s�bFZ��Y�j�O� μ��9�d@�ј�jV����P6��ީ_m(�Z��D�=�����8�<��q*CR����� �*���r~�d(��0����<s�)BJ�~��# �f2_��w�rPՃ$�B1�L`�Z9�7����uq��/�/-2�a���Pr5�LL�;���#y��"n�3� �n$����?}b�����CR
Behavioral task
behavioral1
Sample
da54c3f30c065cc26b6243e1b758ed6f3e856dba3223b23dd007c76fdbf8085f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
da54c3f30c065cc26b6243e1b758ed6f3e856dba3223b23dd007c76fdbf8085f.exe
Resource
win10v2004-20231025-en
General
-
Target
da54c3f30c065cc26b6243e1b758ed6f3e856dba3223b23dd007c76fdbf8085f
-
Size
10.5MB
-
MD5
90ab7be75c08c136b27dab311fef0ae6
-
SHA1
f899fded71d3dfa48d789b03e5eafa10b76ad3dc
-
SHA256
da54c3f30c065cc26b6243e1b758ed6f3e856dba3223b23dd007c76fdbf8085f
-
SHA512
2b2f66aa6e34838ac8530bd48ba43a2d846095037dced7d84c6971f8450f420b0a2039d46a42aee002934f651848ca955f9a8f5081057a39fadb6afafa66859c
-
SSDEEP
196608:WUFG0qDYEvlUu/KIjw8M31q7hLNSd9U8S4MS96GfFPCZvM:WU4/HHH5M3Q9LNq5SfS96
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da54c3f30c065cc26b6243e1b758ed6f3e856dba3223b23dd007c76fdbf8085f
Files
-
da54c3f30c065cc26b6243e1b758ed6f3e856dba3223b23dd007c76fdbf8085f.exe windows:6 windows x64
23a54f0b7531904cd3570898eddbe7ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtCreateFile
advapi32
CryptEncrypt
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
TranslateMessage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
CommandLineToArgvW
bcrypt
BCryptGenRandom
imm32
ImmSetCompositionWindow
ws2_32
WSASetLastError
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertEnumCertificatesInStore
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ