]�\��:��� 3ℾ���ޗ��bUዯ�CS���� ���R�\�����5q������Lc�y�Z�v��3���F�1s��v7]-�>C�;A1�[&ج������6D/y�"�&}<�H���3�]��亏'"��v���F�P5Y�c����܌L{[�W~=��'�h8ԧ�A�m�c�������¼vٙ�����.RX0i�|�=��d`Lp�z�0��/c��8i��;�аC��-r�$R�i�Z��D���o���}��-u2 �#Q�LJ�4-o:���4���[�w��,�9TF����WV��Ca�D�H��W |j�14T�tAd��m��g�<����ėYm9O�]χj��j 7��FԴ���x�|8�g}�˿ǵ��1$�-PR��-�ȏ|�����g���Z�U�<����ʒ�kJQ�'iÞ�m�5.^�J�ʓ��xm��ʇb�=^Z����y?�sDK���mo�ݾ���#.6�e���t�=�h�Gf���P.��zz�s��������kQ�1����Ї"���s�ֹ�8�۞3���Ώ�{�,� @rKD�H�o}� }��wÊ����"��$�[���{��&�0:������������ˆ+�� ��G�qq�W�̴�o�/�%k/��|�8m�o�f�^�,U�ޫ>+�ɜ�F��qF�U��d�B�7��ֿqo�wڏ�F��x�&�����rJW��/&%�6X*��QkY��nݯYK}�N?�5�T�����<�5�,����߱�6E��4�?��&�vz����x���^"kf��8%fX翻�{�r�N�Py�Ѝ�|s�%@ �ӣd���ӑ]�)���{����q9|���6�����'�����r �m!��4�!��T6�;ҷSo��S,[��;��vV v�I_�L���%�� r�Qe��}`��07j��.��� ̃d��C��|\����1����Q�(y8'į��n ���te'�ֈ~����t�dP�6 ��SP���d�&�-�!09��(�$�4�gx��q�����Ʀ<YH6`�iB��1�K���^�)���Gˇ�ɦn~�����/T�bD*��x��q����{6�K{Qp�|"����vi��OɘMnFn��Ё+c�`�]58�%a��c>�/�n�Vu��#[k�>�X��)�I�<����dH�|�Ȯ�U��N~߽�)��^<�9�)��>��F�"uЇ�E������e��4D��I�YR$��c�W Fj�3;��[Wv�{wF4�5��,��t��kػx�F �����G���7�3K���mb�`hx5:0^���t�v`���Ƌ�h.����b��WMm �5�69$7�bC�OF���"���38I�w7C�-��0Lo�/]������zm�����2�Ag��z���o�_��h��g��C#Ƽ盧�k[��os� 1�+��/�,�d�ZRnHj��gU�����NNY��J�?.�^�,��?���A���<8<�_v A!��r��A�����Y�U�{�}d�����`��yL�D8��?��,B�L�Xv�bt�_^R�ca��f��_� ��:����l(-p`����8����/r@if;���6+�xi웲bX<un�����>n��y*�z�n3��L(X,�g�F�� �G{��!���{���L���� ɚ�d�K��nC^=�{��|(9�eF��1@ĨW��f��F��I}O/�CL4`���i(U(=`s���� {%���&-�������85*� ����2v{�.C��ga�+0>,ddBO,ܷ�]�.���F�i����]�����IXS��� >��t��P���c�%mæ�s�:�=t-C���.D��� ��V��tVP�1��n}w�?���q~�q��C��Zʏ��s���ǜ����ٷ��V�9`V��jrS�~|����$�b��F�Jk�Xc;��#]#>���� ����èVl<�o1<��\=�{N�1�`F��^MK;�;E��i���s�y=7���%�D�r\G}��ʽ�Y� w�[��N�,�����ۉ���r1�(_q/�)�1�������m$; _���gM+�t���dž��mԹ��<�ib����;�J)��G��'Rm0�V5�X�����-Sw|.��t&H|����v�����c�Y�`JDQ�*��ѸYD�����r!���=�e�I/�)t��K(����F����G2,�}l%Ț�\�j�����@%-��쟺�7-}���0r��ě����5f���P��E���U��ð�3OT���wY�J�G�K��h�Z���D�dN�K��Ͻ7��d�����o���m�Hp��|E|,�^[� h���tt%�v�4���L0.�Q���3�rN0���A:��0e�CK�~��K�7��9X ��|����A���&��t��2v�Ƈ S+�]��������H-.\�����9>*@���}��z�%�0n��a�N^�,��}�g���;�4'!%S��F�u����ٹi��G��R!���Sd%e?/�7_�'�\�������fGf�e��К��m���3�#]*bk���Y5C��6T��XA�g-�l�neC0��g R�VFPbq����8K���č�ha�ZA$��V<U�"~�#��)�P�:��}��E��lqJ�^���'9�\t��}e1�Z �����B�@b�/:����u�J�h h�� �O=�;��D`�f��~����~nxZ��\w����uh`=ހIhPjl�w����R���k�H=��R8֑S�Z���bj�aK��#��N7���'X�1�s�+�jơ��_\��-�-�:X�������+��L�u6�ާL�p !�.��K�)>_wG���ط ќ��B������H�\5Euj�D���Eqf��J��6T��]�z&�x@S*?�7�]���_Y�7���9�u��}'@��8".�`4G'B�NzO��g����5�p�\�-b,RW&��qާ�;��3�Na�C�63I�dqj�*6�I��'�6�v�S�T[��6wCXz9���:A��lʺu�R"�D��-��W^
Behavioral task
behavioral1
Sample
bf3ec841592f32123a91c2804c72fef19d9c8a7fa49205ed613bc4f71968ca8b.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
bf3ec841592f32123a91c2804c72fef19d9c8a7fa49205ed613bc4f71968ca8b.exe
Resource
win10v2004-20231023-en
General
-
Target
bf3ec841592f32123a91c2804c72fef19d9c8a7fa49205ed613bc4f71968ca8b
-
Size
10.8MB
-
MD5
2fe966661b909e6ec2139837b19bfe27
-
SHA1
1693af60adf28ad386d63e1f47824fb402c888a9
-
SHA256
bf3ec841592f32123a91c2804c72fef19d9c8a7fa49205ed613bc4f71968ca8b
-
SHA512
d272a7997b3611d4548c053b89e97df619b41c25aaf9adc0c0a7b8e8f233c3ae6ce29cdecb4dc9a8aff3641206d7ea66de387525d75c4cfd14d0104590b085d3
-
SSDEEP
196608:4eHiyt7kvE1E7AwYD2L+TUy0dbK3nwi9A5WlVu3RRN9Q4tQRUiKEYUO789aHdnUv:Fdt7kse8w42LI8dbpOswoRN9BkfEwWUU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf3ec841592f32123a91c2804c72fef19d9c8a7fa49205ed613bc4f71968ca8b
Files
-
bf3ec841592f32123a91c2804c72fef19d9c8a7fa49205ed613bc4f71968ca8b.exe windows:5 windows x86 arch:x86
0895b701aaa07be5304d2462dbd4bce7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?qt_metacast@QParallelAnimationGroup@@UAEPAXPBD@Z
qt5gui
??0QColor@@QAE@W4GlobalColor@Qt@@@Z
qt5widgets
?metaObject@QFrame@@UBEPBUQMetaObject@@XZ
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
libeay32
ord492
hidapi
hid_init
msvcp120
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
msvcr120
_fmode
ws2_32
connect
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ