�g�����̮�*�D�Q���/ՙ%����`�eF/`�!�����w��}�'�Nq˚լ�r���ǡl�q��ͩ����ߝM�5 ��dP �ra����D����zl���j�#�4ģ3ؤz���� �1�����3��g����"�������ߤ��a��@C20��q��Ș>��bT�����蚴 Y_Bj�"wF�cAͲ4����Ļ��~�=�v��[Q��QdWY�� ��F�ba���(�� ���ą�~_��t�N���4��_�o�$6��vTu��Z���|��s��z��1->X�5j��d���C%@ˆ!�(�Z��2F�������p��0��E:���z4��N�;v�<'�̏�>���8ir1�}HZ��s��xVU6�6AC rma�3TĹ�+?������Ȉ�e1!w߾�-���9�E��\�i�D�uV���VQ�0�6 �v�1�ջ�*�)!��X�P�yFHfY//9�ZH���� �(`������ B�G��u�'Z�l�L����5������V�U ���p�]#��;$і���|��(b�=D(q[Y����ɡ����r$RC釶��h�Ք�_�P,��V 8���C$O����0�>,?PtJ�"v�$3��e'�At�����0����ف���=��SQZ\��������X���g��!���{��f?�n��bq�$�CJ�{�:�y�H��Ty.$����ΰ��Lh��u"��l��:k��%h�#�"��_���,N_�ɇ��6N?M&��qTH��Bn�8w-&�5��8�IQn�E���+!?3���:��rP�ޥb�6���P�xz��B���w%�Ƭ���^��G�2KR����ݐ* .մ��NBFF�k�7δÿ�=2�KՏK�E��d���@����JI�$Ƕ ��m�O/M�AbE��$(�{~j@8C���,��f<�� ������3���F�vP��)1��2'i�J>5����z����[�%L�,'��{����q�oȬ q�}�lf1AUz��~�]ݼ,^�s�Zr�oqb��8a[�/zn#mK�����%�%;��r�4��#ԙv�}�<F��{�f���A�Ȍ�ŋ�?�]k�=�O�����!�jd�fFy��?2,���:���\�� �_�ϗ��s�a�F�������֓�x���$ғ�I�9���$�)�'���u�斮e���krG� 8��R:�h?��+S�c�iu�M�RM5���y��>�I먖Z���d6Bk'+�������JYC逯b@��QK�]�o�������'w��n������ސ�|h`�g�75���<v��y2��R����Fz�X��)GmJȑ.��g6�F�[y�I��-W4�x�<xel��ْ5�hcgf4Z3��Wֱ�'2E�L#Ȩ�(����q?3�����8��o<D���D{ID �.�ѝbO��[��ȗ�pI֍��)S2ݠv�p�0U��]����U�"'��V� s�ԭ�[�X�!Y��*a38QP��\��Ilҫ�5�M��'`�o����zҤU�q:�Vo�+�Px窚�1�q�`�E�"�ȱ1'���j��Y�q�`�?�N�U�o���#���ڵ���,^��Q�dV'\�W��� "��X��,<-,�`!'~3��ꧥy_�`����� �j�}�Y,/���i46��m(�����[ܟ���x-l6;�<�~pB��\j�eȉ�z�Z�[�ɕ��<��@�i�2le�0k=����' ~�_%2�����wh=�OY9n%C��_;�;<m �&z��-��E�ƥ����切��bl}�V~�EB5�)���F�Fϰ�2}q�Y!���ݑzj)Nl�"n�$������i��[� �4C_FC S�o*����z�� ��!#D��=i���%� ���o���f�?{8�H`���l=q�t4ںJ�]���_�;�44:u��0��� dӛ��}QG���e����M��F5ss�n�Y��L�c��W��5�I��[פ����E�b����a�YGx��.��:��av�76��E�LQ��f�e���ƙ��<��j7ͦ]�?UTρ.����5. ��}ͨK�Δ�l�]Y�3_f�6���{�FH����H�PT��7y�"_T/o�37/k�d8���[��������i��:L.��L��ʉt$'y��L8f���.�s����]����@Aq����6��v7Df41@�p��e欚~�5�'�$I��^��e|T5Wr�Q>�0�V��HQ�l(�Ԍ�,rW���:�G�S��5�x!Q+����=w X#Y�j��0봚мD�������&�#�;��P�6����g�d�rl�O��C[N{��2�U�AM�+c����#��� KN��V�:��+������R�����ܘ�A�?D�.��?��hp5���9�%7���{�RV���4��w�"z%8�v��㳲C��yvW��V`�Z5� k� �!�.�[�R��?��~������(-!��^�+H��Z �K�,�3��ӊ$Z����ph��&�g��[6��z�- kM���ޟ��j8�^���^�.�(X�5�|)Y���oc�������V�F�O�8��r����ڒ�ں�h����mG���9��@���5�?�dTF����g>+�tO�%�Nf��{�\���ɌX9�m3�p.N���$V���_�z*[�J[ߔ�+`ӡ�5�5D5�-c��/~i�I�'��;jS���l֣��T�OzH����G\t����?�oyBf��{���?��zʙ��b�P�2��3��8�]����g�9ݰ��謊��Lҗ/��.�Aa��l�����]�Zs.ؒ�F.ԯ7��`��wy��9�e�o�/_�c����؝�uQ~ ��2N{!R�)����[�c��]��T���U�>�����>����@A ��F���((��P.��RV ��� ��������;�)pӣ�ͧM��2R�Y8C�����jlM0�l��n�����㝥�7�3�?߾��ٿ�� ����=���]�kX�`�ٰ��B��ԏ���s��fp\�FX��I>���B
Behavioral task
behavioral1
Sample
1ce9a4226336da73721118f8b0f3abe95ece9d876fb77106b0e95114331e961c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1ce9a4226336da73721118f8b0f3abe95ece9d876fb77106b0e95114331e961c.exe
Resource
win10v2004-20231023-en
General
-
Target
1ce9a4226336da73721118f8b0f3abe95ece9d876fb77106b0e95114331e961c
-
Size
10.8MB
-
MD5
8b7bc8671ce77346fe99350684c4b990
-
SHA1
57d5f274b423014711f8d2a09fcaad073046abc5
-
SHA256
1ce9a4226336da73721118f8b0f3abe95ece9d876fb77106b0e95114331e961c
-
SHA512
9f71e4836c8a8d221328c57afa2c4064cefeb48e29e686f0551528bf98c42aa1ea85b5a844833f7dab77bdd2d352a59ca457fd25b91c3d781bf6f84c4c5ca735
-
SSDEEP
196608:bTxUoza4rNTDeZgsCCZHKlOqRth8jKaQ+ufEsZUHECh0LHO2SY8Xc:bNUoG+gmsPZHKlOqUhQ+uEtrh0SXs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ce9a4226336da73721118f8b0f3abe95ece9d876fb77106b0e95114331e961c
Files
-
1ce9a4226336da73721118f8b0f3abe95ece9d876fb77106b0e95114331e961c.exe windows:5 windows x86
0895b701aaa07be5304d2462dbd4bce7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?qt_metacast@QParallelAnimationGroup@@UAEPAXPBD@Z
qt5gui
??0QColor@@QAE@W4GlobalColor@Qt@@@Z
qt5widgets
?metaObject@QFrame@@UBEPBUQMetaObject@@XZ
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
libeay32
ord492
hidapi
hid_init
msvcp120
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
msvcr120
_fmode
ws2_32
connect
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ