�fX��9ol�뮪w���$�ʲ ���lq����+�h88&'��_���; �&O�bÒ�Zr<����ZB1@������y�AY����zv�:�g��|{���Ŭr�=�5~�w{чu��<0���tW��DB q"B����]#�~�N�P�����,����6�A�ڒh�W�*��C<�h�G��.�;ƽk�7�Z�HT�F�zS)���)�%0��Q�Ξ�-ij��k5س�hF4�E��uj[;��?�e*L@�J�d<�B���(���dd �˄�����X�_@X����z>�0'�$��l�����3x�����X�V�8�7<3}!?�HRF�#��u�;.xP�R����A8d�Y��+ p��U�^�ȫB(��79��TTf���S��3�y5|�$/�*Ԧ��m���7�؋~�4a�����@'1�0� )Spy�I�h����UV�����D�=�l��n�{*_��1�S��\ŷ:?�Hի��F�)�Q9 �AC��Eo�����MA��W*��z�h���V[��<1�e2���N�W#�ͫ�:�py$�G� k�@�F��q��� 7Z#�|����B:����Z�@�x�l7���-0DBk��%9�j��U��m�"}p��O��X�T����\�34ʸ]�1��$s �$��s�0>��3��an���ę$Ԇu�i?6����_��0DoX�u�Il�m*�!�l^A\�D���L��R��0�[G#�4u���®��^����c�S�"% �� 0��C��l�вn�cŽ���.�NU#�����^��J�q.��_g)�F=���Qu��������\C����ƀ��9�AXg����h�~BF��!B[mT�`��7�&/~��b����el��u��QL��Z��D�c2t$j����s�>���N���e��2\s顇bF����V?���y<�94Jv��� W��U�����6�?_�D�'�_���>ZD�Y�;t�'�|���q���.��� �S�����j*ݺ�4â=_&[nc�S{p��^��W]���+՝�z���=t��_�qV�˚�M��)��0�sl��HL:A+AT���7A�z�D�����C�UI�oQ����x���y4��H �~.��DcKq��ݘ/]�6EXg>bK۬��l, dd3��ʋlc�Y��ZW _�n�:r��+��BY#8�������.�t�whZ�u��YKeQ��k�؞\꾄�I.�9��%����wڕ~�f{l)hc��Z��*�� <^�W���(<G,�}�=�EZi��n����@����<o��S֛5a���Uh�$8��#̟Zbf D>C_�"����IC"-�y�@OR���ݬ��s��#\��C�;c���O��PO�U������Zoj�<=���W��6�� 4���\�WdI/�T�Q@_��M�6k:ɩ,'���*�*¨�%9�vρKʃ����7&~�j�km����I�� ���n�8��zh�oq�m3�.ѽ{x�Wq�b~a���H}@ �T�9�?��������lGz�Ai��d�t'��Z՜(t��L�+��J\��\��7C�/�<�F��|T�N�c���:,Rͳ�>@șr=���%����_����먚�2��A�-����w���ӱ���g5��7j`��8���@�Y���w��b����v� \ˁ�l�������f�$���:T�\_8�x3�!�-��a��wz����z���1�*��@����QV���ɶ�u�d����W*<7�id�D�=K@�S�?�[_�{� �7���W~~I�zk���z�-v�w,�I�T\�Fa�iߠq�. #Ybޏ�S�Ȭ�L�܃�C٘KH�����������p�1����8\��gz��,$�4�?��j������7�\sy,;��h}6+O�h���'��뵍�laֲ�N�3������g{rd�C�>1���]�@h�EmwÍ�~�7���X�5�U����ϵN����vz���ރ������J��f]��@���5Bd�+�����!������G�k0�*���1���:]E�����E�!��d1��p�U���� ����d-P/*[]kR:y慞**(�Q���}2'�:Y�{(�e���g����܂o���K��=�8�~�������R"Aw��xı��皗���Q�����r�����bU =�;� !$Lq��| l���G��RR��̱9���a�:TV'�@�V#�8qe��>���X*Q� ��ꆘ/_!�F/�:% �Ft����y`�p�[-���+�Y�`F�&�-��<��k���<<����B���`H�lo4�E���l5�RI?N�#f@}�H��]g H�j����cK�v~{[�g�G��6w8��ۅKjJ{��Z�a��s6�O���v���Rl�ۡ���"#d���Èb�r�u��s�`�MsGQ]X��j�����'��3w{�_? b�3!Ѧ�v ���BE%�4��B;Brz�:���+�wD����_3�̌�rl*ģ� �ڶ*p_��{����H=��2�MKEq���S�l#.�oX-�!��,1�>�g�$�����J��c�Ǎb��6�&��~��/��;պzxbo="B�zikHA��H+U�$<|��>y���wn����xy�t>]ظ�~�Gx�m(�:��b� �j���e�qm �:(94%�"|� �b�`���N�p `U�LQ߁ b�ۼ����q5����&W3|y��섩*�n M�[tN�>��r��0���������F�M��ѪBJ�Q�� S����!@ ��Q[���D#� U��Q遳�)���rntnE{�o� �4���v��f����0E�+z(X���L� 2�vC�F��L�C��zH2�6`���q�`b���q�����Pƴ����h'�KrR���?EUS�g/֚#N��D�s6���W��D��h�/h.�sfI���D*4f�����L� ���J~���C�j%�eVL�܃�X�@:���"̾*)��Wyt�I���� .�(B��-xA�c��}�VOi��dՏֆ�`ݺ�7
Behavioral task
behavioral1
Sample
f467sfjhh2skjff.exe
Resource
win10v2004-20231023-en
General
-
Target
f467sfjhh2skjff.exe
-
Size
5.9MB
-
MD5
ee6d707074c64999b9d35b21ee215d8b
-
SHA1
89fd45be95afff8b17e75f6353be5d8a0f021ec7
-
SHA256
faab1d2c49d31fd0df60554a05ec97b9b285cb433e4be1d12898fe6949626c00
-
SHA512
e5426ce5b2fbe14f607eae251a9b3067ab2f765339602aab72f7682f75f41bc641c3ccf2dada6ddad07594f5f4d377c71de9749d15050dae855d2a1284a038af
-
SSDEEP
98304:3WI96/TaxopAETynIQLwlJ41Idm5UPdWKtYJwKmyG0fV21E5ov0baFZtw+V1Bekq:3r9DxSyn3zPUdWKG+wDpreFH1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f467sfjhh2skjff.exe
Files
-
f467sfjhh2skjff.exe.exe windows:5 windows x86 arch:x86
1c3089afeecd11feebb05bc59eea335a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ