��ီ��.K�%��R?�j�r.��-�8��@Q�>bSϾ���+�n�(��<wA����@�)�*�0�p����0Pm���d:�,�3�ܷ�k8K���/�I��`|iKl�\���<uՠio���1���v�L ���OzP-�R���ʮ'זPT�͞C��X|�*�ߝ�غ����mB����U�E~�K� �s���mȄBjez��W�����n��9H�sþ����ű�'���}�� X��5i{��ʴ-��@Mc�Q��� O������O��Q��ݯ�$7}$�`����Yy�=K�F|aųXM���( i,/�9!u7e�|^������q���ޔ���kڊ1`r��z���e}�����7�0|'^�O "��<�]ɸj?$"��m�D93�+ ��{��,)�8��J �� k��l�T�kL�����H��:���"&Ek*m��L�#>V�b�������[����%�~?H�ނ�cDTP�H�m�y:���>�M#�萄W�����~jʇ���v���u��5��M@�כ�%�"�'��{e P��QZz�*��DK��|�5vj��t}T���x��Y�@݅sw�@��7g���� /@�d0�tN%eE?Ѐ�?k~U�=����Ŝ�N�FH���0A�ƣ�OI�C��a��a�p�x��!gS�P�U���g�Q���R��7���P�C5b�Klk�M�h)L����Fvݍ U�,J[���ޏ�Uu>�1��e������i_�a��n<�y�;Ț�K\�ֿҺ�y~��$A�ޒ�=�~,�z���i9Ob��S=��|�����2��м䞱lrȳ��qU�x�9��Ҿ2�_���S?u�Qm�����J.%��N�����: 矤dm"�drJ �L|�M�:��#�%<y}�?.�!������bH�e��Ӯҏ�G�� �cuw+B� ��s=���;5�R�����{3�����hk��![���]5:���R�5]P����Y�4;'�uV�K�ZgKk��OQ�Ol�Fz�,(��,cV��ĨI�2�o���tST�.�D��{: �k���,@��D� w4�+��,�I��1��a��|A�[�6��� ���6����exr0h++~�������ԧ�?�~k3��~�췢��W=wm�����zJ���������Y�FП��V*��5�ݝ� �}N� � L+���O��̆e$���8`P��ũ$:�7N�M=(6bR�x>���4��ֈʼn�]��[*��O��� KȂ�9��*Գ� �.i]�{�E�]1~Ҧb��Uw���܆^�݂�"�Q�_�y9��Ѱ���s�������h�8��*[�ei�{C�%�����mdž��ex���J�4��"t_i�ş�~n38ǫ�0����zQ����o~�|�,9c[,�Ư�S�v.K,��c/��~�t���jI^݀����`�^����*Qbk�+dU$;vf��O*�X�(~@��YT�7��7[a0xX�Z����f�}�Bk��B�J�I�C�u̫�m��YO�ࢆ1{(�+ֳ���7� p�]�h���`��)d�����(,���pM���ma5O��d"�A[����.q��s�kD���:Oe<��uG$��^��U=�:�Ia�ã���v�����3݂~�:QoW[��Ň��F\��W���i�j��Kw+n��P��{G_��R���uE������������b��3�]��+�8�3yՊ���2O��L��NG��S r��u����Cx��T�����r�v�^�>ʄ}�Y/��m���9������7k����l��EU���!,�B����i���ʗ��6Q�^�9��'�^Z��O��r����"��Ba3��[5<�N���. �g-v��97����،��b����=ď9^ KE����)iw�?aI��|ЩfN-�U4aٌ�-i,[��X햒_~��ԩ��O��������A����7�<�����@��L�^D���8�;��G�����[W�0v�<��%����ൊM�u/J�)o��s�� � �92�Q/]�aw�uv���Kג�5?#���T�-&���O�C%͜��YN倁Y���TvNV����B[�Q~�y���ݚ��>ߍ�:�$njcmh� �3x���奂5�{�g6��W:�O�D~��RDuy�\3}Gs���n���H'6;,��H�����6��Ca�����[�z�?� �L��f"��?#<)5.s�k%]��^Yi�*]t�.$��Dy%g���g~��_��.5N���G<���"��e䟎D��6��������́�9eUV��3xI~s�'V�p��z���G��f���h4�,��R.^g��)}=v#3�ӿُ�睫�ܦ���oo=���g=5֙�Ő�����χ� �N���qL]�C3���������4V� L�Ye�d"�ܳK=C�bi��^·dU��K~� n7;��J��_j:�"�μV(�9xmP9�X�c����(獯T|�{�L��.�9��p�4ڍ'��P�\-e��N{u���A:g#�9k�ʢ��cm�#&#̚�C�hf� )%B���x�B��Ź���-Zā�,�ͅ�ں)�b7���"9)�j_����k*0w}o�zmi��!E1���ŊUW=������%4����:_��X���m��H�`�3rN�]�ϵ��������B>�V��h!2mc�F?L�*g1�����ڷ�֤�(���}c;=h2�&<������(��Qi�a^��uk7���1)���<^��7q/F.�0�<���Lp?��N���my�A��ƫa�Ha������=:��5� �k#N�;m�J[�xa�Uf�;����ao�J8D��A���ڸr=��\�ސ�dn�z�,��>T%9���ʙ�.}Y �}碏�j{�o����'��1�a�-RI�t�+�(�be�� �#��� Ṗ.�V�y�?�W�"���;)"/��b.��AĴ�Z�w�S:9� n�,�����^���ܸ�95�� �ܟTe�zv��Y���:}�#������h���X����&"od^U�{.�k�R��Wm�W��+§O,|��p���q_�/�Y
Behavioral task
behavioral1
Sample
a50d874a517ee69f44fa810f255b66e64c4fe6f067d89a93f000853d4039ba3c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
a50d874a517ee69f44fa810f255b66e64c4fe6f067d89a93f000853d4039ba3c.exe
Resource
win10v2004-20231023-en
General
-
Target
a50d874a517ee69f44fa810f255b66e64c4fe6f067d89a93f000853d4039ba3c
-
Size
10.0MB
-
MD5
87908a286f42646727a91f02679afa2e
-
SHA1
f3bb90d2c7ca015f472fb4d74b8520927d156089
-
SHA256
a50d874a517ee69f44fa810f255b66e64c4fe6f067d89a93f000853d4039ba3c
-
SHA512
e367a264dfa2ff7fcd690f91619b7b929c803598725e14ec21803547d93f6964ee1badfe8f59fd8155a2fcaefcaebcdf13acd211dbf2a71eac849f15343e4993
-
SSDEEP
196608:bm+xJ8Ynd1xLmwmRlAmwI+rt2i0qX2pPXfpL5fCrK1oRLXh0b35iiWO+kvyjE:/RdDLr4Amw5tp0c2pfd56rKSdxSpiiWf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a50d874a517ee69f44fa810f255b66e64c4fe6f067d89a93f000853d4039ba3c
Files
-
a50d874a517ee69f44fa810f255b66e64c4fe6f067d89a93f000853d4039ba3c.exe windows:6 windows x64 arch:x64
23d07f22f744a2e5655e815a6d5bf43f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetNativeSystemInfo
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
GetTokenInformation
ws2_32
gethostname
wldap32
ord14
dxgi
CreateDXGIFactory
d3d11
D3D11CreateDevice
d3d9
Direct3DCreate9
imm32
ImmGetContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 957KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 635KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.0MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ