!x�b���7$!9tl\�.}��a���<��k���D��Y����~ 4+���A:�ٝ�-h���<HͰj��ϤQ��a�v����OEn�%�+���aO�#/k�.c�xPD1Ʈ��ā$����/�1f�=�ؼ'�~w��j��n���2�tU(Đ����AY ��UD44�H���J�Z�f��nn���'/�����v��*I�s�c{r%�\v~L�TLP����P��,`8i��Y�G)�w�����[�s�h��8$�Jt���Z�l�1���7��\��A��X�Ik���'�-y��g���5@ط���b�;K�ؾ�o/�"7 y��L�1��ߨs�`�g �����p��4���K>��X�A-Lr�{g�L�����Ȣ�����V>cN�F�,:9'�ˆ�"�l�X��d2�:���Q.\O�=D5D���k��2S7�Q��o�;���,6�*����~���Dd_������Ѳ;'<�t��g�V��?����1�[?w ���O���~�1�[��%���������3�[G|��a҉"�p��-U�z�_�4�!Q�͍o7��I�R��Y��>���3 `q�v�q��9��o�����_�L���mY~$��5#��p1�၌M��3���2�8Vn]n�E&fg�c5j?h�x���5>Q�.=7��V�>j���G��8�Qqbv��9�_Qu�`�N6�K8o�g�~rឋ�b�4qb�`��ȹL�p��e�7��-��Q���F�ͼI�D�?\�+ֱ!��~�C�ě����]N�4!$Ӆ�8��I��Z٧^{�����/['/��6킠���s�W�b�y��Alb,Z���qN����nZШ�ڈ�QY&f^8M��*,�db��ۻ�����P���85�`����D��iw����9��L�:���À#!ثN�0�@d%�y���I�+GH�&�9X�Z?��ЅU�-���Kl��֭TP���!��X��5yv��}�&7�V�|�0��;f|��Q��h��}3�fs�u�u2u�/���sZ�/��4Fj&�i�!F�j�%B������G1pN��>3� P��~�!���Rpn�qŸ��7$��'�����YbH����R���y���c�R����#5Q[V�)�s�4�B�$��Z�3���b�*����H�jV���#��D)8R�ƴʹ��/��G�>:�xS����ߎ�4�<b�N�I����p����%{`�r�;�'$��,:hY��NL��Z�zП�������}ܬ�\D�rD�Z��ԛ��F7˘�����TS�~e�`����WF*�-�5��*c�:��z� V��V�ZhS��R��Q ��'"w��p+�;BE��p?W4����CH�Gl��Y~(�JWr�%��Ɔ����3�*���~g(Q̒p�Z+�v�9����1��Gt ���Q�,�^������u�Dݽ�ߤ[X����A��kj2�h�`�C��H���^2��N�e@f�8c,Fj��6�*K#(����«X �2(�1��":�&F�$�)=In�ls��~�i9�{Y�fUZϴ�eB���(VzE8���k�@%��aܑR��������7�${8�孚��VS�5���v���ދ�,�x�d��x��:��Њ�ԁ�� ۂ�����r��҄zw'��Y��Jh�:'���ğ�euה�\O��$�`��<���&+R�MW�a���K��A91}��b����y�Z��-xY����Ϗ�h�LA� �l���)�qJ���*+/]��1+�n����B#�O�������j���]�9~�;77<G)�3�74�'���]H��K�:�Law�A��m�Vݑfc�N�v�o3�iJ�*9W��1�o9���BD�=��+F ?��xt #�Io�4)fp�02y�b��8��x{D"pjP�1�R�p���|�*f31�D�x~f�q�'��r�A���87� �Bg������1yI>TT�v�~���E���q(��QLPQ�0���D�Q��t:M�C�v"ri�=0��b�.y�)w��yn�x�\�C�#S�ϗ\@6���}�zbV��G8�լB�Y�k��1T���{?5e����:���d�#CU?y�~~C�ߦ��I?'w��U�!�>AA��䧪(�M�7(U�Y^M$�%i",��ȶ2�3�Adl�mf,< ���z\6��Jse���`*��яm�k�K;vʎ�Xr�j�4Sע}3�Bbܙj{+��r}9H����YK��t}2��F�!i�ڰw�I[���a�o�#��������0ߐ������L�6X�H�AOPl�!��"ԅ4������hF�Q?w 첕���b璏�7$�=�y�F�I]�R�4�.�T��$�:������m�u_�^���|OH8nؔ�'�����t�۵B��I��3>Tv�C=�Ġ�Z�9������+��'����;75J�.{�k3�ܹƘГ�\��U-�� ~ ����|xӇ�t�x��`�`x�N����D$�ח������{߯E�����Ȉ`JG�Y�n�"��$�"xl�k�h!bf�G���];�炭�oEn,�w3֪��H⛌3K�6n��!�����)�n����F�R"N��Q��,��E62D��J���DnjC/��c(���i�d�"�Э�Wk��\� ѹ¯�����qx 6��,����%ߥ�/myA(��F���p����xGʭDj����:~q�(��^\0����������Q�%��0N{�[k���^ Vߙ^�k�h)sD��;����"~���`s�+���>�]q:si�.ߟ* �z[.#G/�/X�I"V�<)B7C��E���Ǟ-",5����4�bJz����\-���{O�HBpa��9��U�S-q�kjSL����q���������R��'�\��O��NaW&(���!���M1e!;S�dWՓ*A��}+շ�d2��/��D^>�'�F��، �{����פJ�$��oT�5qO����?�{V�f�Ԃ��@o#3��;U�hgS����.�MQ����٬ �A��J��! ��!���� �� q�o1U�Բ&�v�/7�~1'3�
Behavioral task
behavioral1
Sample
0b5d9e2c711e7eae95833951c2491cebf9cda050c75a33e935dde16a07d62480.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0b5d9e2c711e7eae95833951c2491cebf9cda050c75a33e935dde16a07d62480.exe
Resource
win10v2004-20231023-en
General
-
Target
0b5d9e2c711e7eae95833951c2491cebf9cda050c75a33e935dde16a07d62480
-
Size
10.7MB
-
MD5
78e07c1e12297930d3761407df3b7122
-
SHA1
6fe80eaba16037c9da73d574634fb72195135dd1
-
SHA256
0b5d9e2c711e7eae95833951c2491cebf9cda050c75a33e935dde16a07d62480
-
SHA512
7e5b303384d6eacb7ac98343576a58ba4dd9879d196f374225fc9ed9741b76cfe733990aa549d335108cda3677448d3f1de35b13862b7593c07885c2d9299262
-
SSDEEP
196608:gmMd6qV6KaAXA1puwAD9Pgx/lFHdC2l307Ej1bG0JlcZHV3b:BqVeAipcD9IxN9QYvjw42HVL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b5d9e2c711e7eae95833951c2491cebf9cda050c75a33e935dde16a07d62480
Files
-
0b5d9e2c711e7eae95833951c2491cebf9cda050c75a33e935dde16a07d62480.exe windows:5 windows x86 arch:x86
0895b701aaa07be5304d2462dbd4bce7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?qt_metacast@QParallelAnimationGroup@@UAEPAXPBD@Z
qt5gui
??0QColor@@QAE@W4GlobalColor@Qt@@@Z
qt5widgets
?metaObject@QFrame@@UBEPBUQMetaObject@@XZ
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
libeay32
ord492
hidapi
hid_init
msvcp120
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
msvcr120
_fmode
ws2_32
connect
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ