~χ������,kZ6���ĺHd��9rHa���Y?d���\�<�!�.4R��y/-� 1P��uڈhG���x�U��M�?EG$�۩���\֩��<���/��^�{�_������8_d J��\���?oFΉ'�����8�7�l<��M�����V` ۷�1\��"��H����[_��l��4$R��+Z����y�s�E�tך�k$j�{�y�[������D�����sf���;G���F�o�6�7�NUW�t��>��Ȓ�r>��_��L�1�+�$�9����N[�RF\� ́�Rc��dxs��_з4?*�*".V6�c�� N�A��U��H��K��b�Om�X ��v̹�~QmA���Edb�ꯞ(���I; �D��R��TO��:yR`���tk7v ��eLTV��p�*�av���:G!�pڃ q��������(ߧw��� H's�ú۬� ��ϸ#0�)C[2bEmh�W�x�F�<�ͱ�U3i��U<ׂ�W0�ʯ#��"�{�жۆ"qsc+���!'���[OPmǡ�.��+}k��Sb��۳���Y ah;_�/jm��6j��z6�̏����>4�7$Ă�^rSS���a;Ê�le��3ʩ���p�9�R� �D��`��8��Ȓ�"X�k��6Q���$])��j�����\A�J�k����s8��y8�?� ���~�ސo"����.��2^d�0��OW�� �+�gޟ��Vh>%�P�����ky��]�^��C��V&a7Lw�vu���y�*��R��'_� ��ն���p�N�Js�u!��\����`hgZ#b��x�sy��� ��9��V�Z��I<���;�`u�X���.Ӭ2�BKԉ{@xu7 ����0hh�v�,�� �� A�J`b�M?��b*���o��{���f>o!xϒ��z���=�FTL�۳;#���{��������9��0Fn���&�|�S9�\Y��KK�"U'�>� ���m�EW1�*�� �y����uM�ӣ^��H��f�R�0@2ųl�n��O僉~lߚ��PLnɩ�?u���^Һ�]�#�s��%��6!_|���˯ 4C�c#������ �d]N�ۮ���?�<�8�e��C� �x��{cx�(�Q7��+R�t>?��C�\ş��D�jY��J1�#ֹ��.lIΏ���#�q`~���|�+�|h�=��&ոkv��Dag��vj�������aVr���"s��fC�(�Ͽi(�pgQ�g��eFH����N�\l��R>��:!���)(jN2��!�b�� ���2��[��j8OO��"�.L@!���˯��:S1�ܼ�E����<�O��F�I.TXV�L� �O8K�����WD�D��##�j�Jo�;vX��3F����Tt�oa_`CjM���o։���>��I�J���`���~��� A:qgͫ�S]���0���+,(_��]Rq���db����hX���܀���r��<q��D�VX�����~�ЩyW��K�1���r�l�Ө��ѥ�A ��MA���Q8��YH#mTSG��FV��a�MT�l��)�^�C�9"L:� �!r�t2�J�靴i���q�+�WI�9��t��W�$,�����PJ��M�rV�g(�x���������QB�ܑ��3��]�y�����m�*�T>.2���1��AN��[�l��Sl����7����S��t�i!6�R��>A�@6�%I��F��nG<x��ov "ɒWf`��u|�L�V7��P�y*m7��ℭDh$4;��\��\�.#�^��^"+CaG�����ڋ��?�,�����Q�� �K�)��������(�l��͚��\W�,E5�Y��B�k>�������Z��u)�q�2�����'RƆ�fe��NM����������dř "�;��#�}�$�^~��9f��Zd�5,Ӊj�!;*ӕh�.���-��5�ě�z�E��{$wpZ�e���9k;�ta�4�ux�=��}D�>���@�TL; ��|-�O�هa�Z��,1��:�W��|�dkg�zN��\��o�J%�GV�Q�_�r���z"蓭��,��#�>�������%�OñA��*���'L�m���hZ�Q��Ҡ��04�-���~_x�S��$U�β�Mj�%��d�^���F�W��aj5;�d;(�Cq.�xQW�lU��*�|��h-v�p�&K�Vx���� ȕE�i����&�X'����;�O��\�G�Z��Eq;�㞰��6�X ���K��]���ow$�y��}Sڶs�j��Co��`�9��/^���s�Jy����Q)RF��BE�� i�Kv��4*�H�܋y<�����2�o�!]��h(�c��"�=�a�U�ٯo��E�� ��AK#�q@�p�'���_Ɲ1�n���41�<ϴ��k��*�=���w`��sJ��dС��_Y$������<"c����b��J,�:HY�oSH�YO7��~��!d3Zc����}���?!���������ni<�d��#���"��A�W�����`�49��I�DA�Q�L;~iO�)�H���ߒ>���Q�C�c�蓴��Qʡ�v�y9��H� ��UFC��u�O�d�ͳI�s���s-��{Ĉ)��ؠ�a�=�߸��ܷ�0ؠ��w2a|�]Zk�鞲OG������IH9M������DQ<)�����~t~^� m��<�����Ob�{ �uf���~*gnO�q��� 4����[�+=.Vhd��x�C��_�4��:�2��Q�5�x�h�T �g�4��LC^r*Dnj�2�k鞘��2܈m�M��c+�b�d�U֡gQ��t��8��9��[�ӇN!�����R*�e~���2�h������X8f�+Y�W�"���b@�� �k��s�*���?�[rfv|���ȇ��̓n��܂�*�>һ]%����w�� ��v������LA�-��)�.H��?�8I���Q� ؼ�hl}�d˘�����B� ���$m`���~�ķ�5&3�$�0����S���3�h��$���""T�iaܑ�;�]w� �
Behavioral task
behavioral1
Sample
cfae74be4939e3fde2f6bf862ee689461b03694204eeb0d9f5970807a5ea4bbd.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
cfae74be4939e3fde2f6bf862ee689461b03694204eeb0d9f5970807a5ea4bbd.exe
Resource
win10v2004-20231020-en
General
-
Target
cfae74be4939e3fde2f6bf862ee689461b03694204eeb0d9f5970807a5ea4bbd
-
Size
11.4MB
-
MD5
1dcd3bfcbdc87bacef240d5f07ba2c70
-
SHA1
19f98dd086e0beaf4888489ca0925a1ac5b737c7
-
SHA256
cfae74be4939e3fde2f6bf862ee689461b03694204eeb0d9f5970807a5ea4bbd
-
SHA512
170ff4b25efb7d727994059ace365f0300a4ce76f699121002cff49d67c9520a87666f72e6e011f861398bf8ca9718d6794f38daebf1218b3c1a4d3a7f73fda4
-
SSDEEP
196608:xmdaN/m2xNi107un8Y1KzSr//HZxv1wJd2vwu5U/DbEtEJM3q8cjfjLx5uNpiEj:CO/mm97YV1KW/jNwJkwuG4tuM3q8cjfj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfae74be4939e3fde2f6bf862ee689461b03694204eeb0d9f5970807a5ea4bbd
Files
-
cfae74be4939e3fde2f6bf862ee689461b03694204eeb0d9f5970807a5ea4bbd.exe windows:5 windows x86 arch:x86
ffafde29b871bdbf0abbbb376978bb06
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?toByteArray@QVariant@@QBE?AVQByteArray@@XZ
libeay32
ord342
qt5widgets
?inputMethodQuery@QTextEdit@@UBE?AVQVariant@@W4InputMethodQuery@Qt@@@Z
qt5gui
?qt_metacall@QMovie@@UAEHW4Call@QMetaObject@@HPAPAX@Z
qt5sql
??0QSqlDatabase@@QAE@XZ
kernel32
GetModuleHandleW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsWindowVisible
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegOpenKeyExW
hidapi
hid_enumerate
msvcr120
_initterm
msvcp120
?_Syserror_map@std@@YAPBDH@Z
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.2MB - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ