��n%Zt���_G���iOm�i��{�^,T�0N��������JE���` ��@5�����;��-�G�������̅?$�9��;�����=bS��5��"�O��0�O�$��z%I�m�$k�J�R">����F��cR���J�h�s�!��T7�"+T0b�:�S9@{,�@����A���?�̧خ#��-z-�9�W�z������$�Un��"�xL `:��M�B�/��*�c╥����@Q�]u����()����QL�U^Ζ9R}�5�m>5Fi���u�^}߬��Ȇ8*�&���AK=�VP"�o�ğ1������lkG�]*f�y+�Jxa����l�t{3��~m~�f����@����0Z�b�� Â�i���xr�����wT/��I����<!S" cD"V���g�+~��r������' �S[b����(Yp��D�����]sH�C�!=���^/�JWGSH�fYl9��Dy���e#fJ����[*l�O���?j�����%�:7\���Y�;��= ��XY�SF\?R�_�C`�i��&\H6�HK DHq+�)"��.�/���g�����Z툒#n�yv:����b�T+Y߾�T=ѵA���)�Аs���JR=��<O���W5m+l��� xw�ҽ(ߞ����.��K�v��c�k/���Ł*����"�����_e�~4l�+o�5!X�x*TdWeߴ��p{�עs|�_sA��RB�����ז�5aͩ�����N�3y����$#P����� ��cQ��{�.�����'V)Rݫ+yQ�ӆ;V<}f���2�������^�$�'9�*ls�*N�����|y� F��)7;���v�B��u���� �ĵ��XSxR��X�{�Rm��$���5���7Э"@фm�}Ȱ�鹔�8K'u?�>��!�,���� ol�g���c�D��l3Gi�!P��|���+�S��L��-�řG��w���W6�`f�p5r�i��!~�';(� ����l3c��o��xo�X��>�;ev)]0(|���&YI;W�r,$�h�D���H�7�<b��C�jbU,�D_(4��[ug��ո��q<��R�n��K���&g��rF�*��9c�"����>���7X��O�C)�,8�tZ���:�:Ū�|�έ�G�L���> ��B�=J��P���478*� �}-j�Du���b�xU�d�S"̖�1<䔏��o!�r[VՄ�ù=�� 6�Lh(����I v��Z��4L�Y�>�J�f�t���~��<��Ί�K*@f�::���Z!��X5G}���X�xo �2X�R������"(�q v>v]�V��������6�J+w���L$�>x̗&C����r1p��~�µ)�V�/�|�j�9��<tK���sE/�����Z`��/��zʲ�sh�DC�Q)U�{g��B֪�� j�l�"�����]��~/�!l�*':�d�4��o�Y$��7ͼJ�y��E��U�!ŻHA��6!/��Kj]!��O|�`cX���Q��_y��&F0&�z �q��e6�g�~���8�4��M�Cࣳ8��K�nվ-��PAW]A33,�4�>�5(��2$n��r#� څOI�� ��TYS�)P�Ojٴ�� T�*���'�(D�;V������m���XM���,BUD%-1?R��i��(tg�XŔ��c��=��,B�y)u��yP��\c�����EY���Qpe�������V0�SD�xM��v5AY^��>�H�q�4�>E��5�O��O'2s3��e�KJ�Q�Lw�K��Xq6�:�(�;�m�߳-�Z����Q�-�Cv��^5���MB��&���&h��������>ް�s� � ���}����_�%ޭ�h1�z��BAƷ��\��k��U)�Kʁ]� �.��]���*�m�E^k,"`��w�Ĕg�T�iw�`j�|�'�2n����86�p�-C�F���T��O���d�� H�Tc������� ���U_�\��uԘ���쁮M�U��x6�¡��QZЂ��J�bwfi2��5A����'� ��F-��E��O�g�v��D�����*$/ׯoߡ���7�f�?����p�qc���1��'�N�J��COj�>i��H�=��BQvڍuF���&ݦnz������zt�_Dls�t��T�I2mf �^�s���2:d����ۅ�{�N����U�^T7=����\+$�M�}v�X:?�;i���K�־�=m/ gț�0���G�����!�3�Z��a�����T»�.A���s}�I{�e� �A��4�����2� �\Em�t-#x��,�ҙo��,{��� �������rdH�X�D�������1�4n������L����px�����0e�t,��5�x%v#4 "�U��d����(2)K�<3]�q�X�:�EB�SAύr]��:^���P�3=������~��\��[UT�*{�'��~B��4���.��Jf�F�,�������c�ш�40�����;|���HC��_��f�@������3dr���x��E�F��k��uX�JT4uE*˙z,R�`Ą�G�*⩩oC93]Ѻ�_�4�i�8g2\Jg#C��qE�o���R�[5�����ߪ��u�5���˫x��/#$n�`�ʭ'#�?��̀����� �`��?�m&'uS �X50_A��7���(-�X�y��D�/}�M�ƅ��hs>rK�!�������/��sm���ϥA'�{b0�l�l��S�U���@XI �� Ͳ�v�V��#��v�~~Ub�Szq�O�|������bƷ��Iχ+��2�$ݜ�$�/�\<S�<t+W�A�nU��5B�F�@m��i��A�2R��+��v>��N������q�P T���mH���1�>�GU�n�s�|;^�/b������E+"*��1�dN���Jq������M�e�r�Û�0�Dq�� H���;��c�@U��p��R��v,PP�Z�ka��^��
Behavioral task
behavioral1
Sample
b63115a884633f516ef70693291165c33b5ca2a56870dd5c0f10c3dd961407ac.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b63115a884633f516ef70693291165c33b5ca2a56870dd5c0f10c3dd961407ac.exe
Resource
win10v2004-20231023-en
General
-
Target
b63115a884633f516ef70693291165c33b5ca2a56870dd5c0f10c3dd961407ac
-
Size
13.9MB
-
MD5
516f8f479218eb58168aa0a651a4e3cf
-
SHA1
1d3e1a35d147ba9fdf7a80c3e020252d66f6b866
-
SHA256
b63115a884633f516ef70693291165c33b5ca2a56870dd5c0f10c3dd961407ac
-
SHA512
d6b222003c77c8dd5dbb1abb1049e93515d279d824a112a7952a60b5892e9931374840d416c2c066c52c45d49bf92e95c5070aae9e37b5b7c08f3023ad340372
-
SSDEEP
196608:WM55dOXajv13R9bufY2cGExos96Z87QGymK99oZFKj1Pg8CzM1hwQHwJyH5zcfts:9xMGJHbuATxj3lK9qZiJoQQJK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b63115a884633f516ef70693291165c33b5ca2a56870dd5c0f10c3dd961407ac
Files
-
b63115a884633f516ef70693291165c33b5ca2a56870dd5c0f10c3dd961407ac.exe windows:5 windows x86
f63140ea85d65a9826ac330b13e46034
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OffsetRect
CharUpperBuffW
gdi32
CreateDIBSection
shell32
Shell_NotifyIconW
ole32
CreateStreamOnHGlobal
comdlg32
GetOpenFileNameW
advapi32
LookupAccountSidW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shlwapi
PathFileExistsA
psapi
GetModuleFileNameExW
wininet
InternetTimeToSystemTimeA
iphlpapi
GetAdaptersAddresses
imm32
ImmAssociateContext
msvcrt
__RTtypeid
oleaut32
SafeArrayPutElement
ws2_32
WSAResetEvent
mswsock
AcceptEx
crypt32
CertCloseStore
msimg32
GradientFill
wldap32
ord127
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 698KB - Virtual size: 697KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 38.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 11.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13.2MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ