�ND��g+V7�<+�X���H� يfN�����O$~��@@ Ɇ;-Λ��SC���c�0hI3,ہ�f��=~uLB:�|">v�=川c$��U'؋fBA���\M�3~��������<�q�)�4��\���������rVХ\�&G�����7{�g�]�/(M.��i�O��3�; U����y�sK��a#��f2����y�;g��C��BԷ2��q0R��\%�r˥}g>�q�nT ~1k�cO��b���!N=O�B�2S#G����vѐf��C���H5�n2�9�<������ϟ5�z8�~1�V����LSt�E�lE}�4����s�ÓORSw=dz���/���Td��p;�7?�K��ٵ���V���xfR/�s����eH-��x�������/U{4x���)��� �'��iG�� ��%~T�f2�D�=ո"���Ɂ�����Mڐ�ީL�CҨ�Z��KW|v9a�GW���)���b� �kᯛ�p,C�� � ђ^]lW�h�`�ƶb�r ӥ Ϥ.�l ��� ���J�R�+�`�~k� �G��=�C���v4˗U0h������N$�%g�o>ݡr3�ך<e3ߘ�U��� '�W"��m?i�ɣR�W�ܴ����GAɲNc�O�7ܗadI@�LW0I�]����7w<��3��M�+��_9�ŋ|@Q��q���Á2��Ψ!��K�i�Q�� ���^N+�kܓwb>`N�6d��e��o ̖j�(i�Q ��&� ʣ�mGf�������l�j��"��H>�D"f��r���d���#���[����Go�@� =�0eI��6�/ID�٣e��U�1�b�W�A6ξl������D�W�zBnæ���<k��W�|��,�U����W��H2��v�$��;��U�~���M��Z��4s�(�S��B�T:8a9|�g5L�u��ݭ�|e�ԥ�������S�����%D�ݬ���~I��&�.tk3bB���l�B]Nw�Pfu�4^��j�܆a ����?X_k��;�x��V8��K%������cb>;<��������7u���ܔ�-%��p~�����y��ՎSj}d�� ��sW�影��p��V�VKc��N0S����9�e��\4D�!�:t,�l���kVf��#wX�?��m�)�{F_7�K�A�{�+�WY��� "Ps'3�x)��:�c��uRha72��42?G&N��-�����l�g�r����5�%�}�����"7�F��������$u�Va����вIQ=�G���t�nH[��swh|<[q�U�Lz\l��R�����^�g����d�u��J�e���[����Z��0Ӯ5�ӋW�ffP@:��:ө �1G4^dJ����m3�9��=PCFl<�C�h��<$ur�E������!ƖPś� �+c9[�T��5Tܥ��h릙����G�y�C!�D�#ij��^>���١��;ۥ)4/"g������~���� ����I���=�Ӳ�b2��KpO�"W���r�(�Dn}ED�v*���"�V��\F7�S�NT�Fob7��(���)�Ň���: u�����: ힺH�_��5S�ʾyJ����?�\��F�S.~A�4 Aix��ui�LO{�S/���a^fT=Am��YXR��ٓ��ӜK��ly0O�>ѵ����I-���=�ōM��v�Ɲ)����[B'p�*ru�|u�M��c��\?:�ǚ���tK��3�x :5�����(�9�Y����Y�����Z �ܛrS������e�T��)�]v�ߜ��b�h4�M�kuv��:W/!�؇#��u@"Z��fC�$Wչ=؉=c���\H�-���+�s1WzVQvk���RHѰ���@M(�*�Ā92{�I<�x_�|��Z膋�%��pk������f��ޯD�� �,1��SWx��I{7I~�C�XA�JD�VӤ��6~�6T�6�.���u���=҉�����{{�MrJݛ��K��>��zxVd��/T�B�\t��EG�%�ȣWճ�`�� ���-��K��Q�dʻa�t':3������eIhS��]PX��P�y*����P ��UJl�is2�˾ٓ��TOJ"�ㆻ�㱅�b��WR���yw�,C��焌��1�N��Zo`v��wn��!I^�y��}\)FE�v(ٚz��L��!�@$ͱζu"��3�\����<>֙x)���1����9"�� Qq8�T��c0���_�}�0;niqc�tZ)گ����u+��_Y��3�&�SF����_��8E����rV��z,.��QV���Q2"���ڴ��ۙ9B�2�4ۨ9�kb�Ł�Y�F�=��ĝ,7��h�V�DŽ�A� �P�U;�6�aѼv��m��[fp�R��[�{�0��K�CY�B����Zg�$�Z�J0@��בЉtI����PK��UG0ݔ"яV�!@hh_e�� Ҫ@mh������ũ� ]�O4(J=~���7F�Ae�}���ω�,�.��Xp��7JG�(̃8�Y�-��z�0���w��t<��X�i����֕�$T�~�f�h=���td�ڿ�t_���`���&��O*.>m8dK����b��ca��̈����\���ތ��#���!W�_�<�0Gǩ����으X��n.��k�H��DN�C&0_K{���#�5�4�4��!`iy�^��n�7˸�=��9�\��P�j~i~��4@�����P\8fpeU?)}��+ʹK%_md�oJվl��2e��B�@�觃�S�co;'��z��)cM<������X�����Ji��~_��B�K���� �M,A������%����'�S�p1�S����k6K����VI}f��2�R^�EՅF}9,+8G��E^��i#h���y��X�w��փځT� l$ ���EO�� -՚��oB�D��q�03*����Bp�}������xr��,�� �U��`��������M8�0��Q��R�Պ�%b4ޝlgߕ�4K�"�|�
Behavioral task
behavioral1
Sample
TVPaint Animation 10 Pro (32bits).exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
TVPaint Animation 10 Pro (32bits).exe
Resource
win10v2004-20231023-en
General
-
Target
TVPaint Animation 10 Pro (32bits).exe
-
Size
4.5MB
-
MD5
c68adb829f6239c6a7792f9283a208b8
-
SHA1
9d9c8c878d0329832a2dad06aa37d70c6ad87029
-
SHA256
b94a4e067b7abbe68dc26bc7e3ec4c96171b1a534e520e2e7ccb2c0e2c41212b
-
SHA512
c89aa6c0dfca305de4ae99c3449c0945852a45dee3da0dca59f071617bfdf8ff7f39898aea6a22501461823d079bf1c413f8af9398c0f53b84fbe5c5a3b69243
-
SSDEEP
98304:9g0YkxgmlUSjbQ+k8Ei8MkIMambjFCUjRAe+OKI+GJpdJQs:9g0YQLm+vVMambjFhjRAfDI+qn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TVPaint Animation 10 Pro (32bits).exe
Files
-
TVPaint Animation 10 Pro (32bits).exe.exe windows:5 windows x86
ab22916749d7c3661b78a5be7d487d74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
advapi32
RegSetValueExW
comdlg32
CommDlgExtendedError
gdi32
CreateSolidBrush
msacm32
acmStreamUnprepareHeader
winmm
waveOutPrepareHeader
avifil32
AVIFileRelease
shlwapi
PathFindNextComponentW
shell32
SHGetDesktopFolder
ole32
CoTaskMemFree
user32
PostMessageA
kernel32
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
oleaut32
SysFreeString
version
VerQueryValueA
rtvlib2
BuildRTVFile
sku
?Init@nSKU@@YA_NHPBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 644KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ