�ᇈ$P�!�dp&I�����K���u&��! �u�S�����-��a�Ȋ��K��R�Py|�<������m�p��7� Xh��o!�nN+�(����c�5l%�Y��L�L���Sr�lFaF%�ը�;̂��3jx�ʉt��QȐ-����I�{�+���1�5+�Eo�?���������K��ĺLI����@���WR�+�d����� $�o�0�@l����s�����i��8 �f{����u�����i�o� �Щ�$�I��7���lM:�U<��zǡ�S3��U��͆'�U�EˋE�%,"{c�*!�]�G�Y��������А~t��b϶�YMEO[��k�K��o�\+4Ǜu4rWB·��tm8���� �D<�d���Q+7E��%>����� :��~n�[jĿ�oV��#.:���odAZ!�%~�<��y��c�H���+�n��ȑ�I5MM����_�;�E�P�š���K��0h�4��N_��yOv�I =��|J�~�@vc�� [Pݛq4 '{+Y�U�V�~I,s�u�l ]+�I�qP�M�]�<1�!��mY/�7ķ HL�V����e�e����=HP���8Ú�`<�j��t��J��G�,�G�qh�YvU�c��2�}�Ws��Q�/{��A��t ���X�+�z���h�>��ld�3<��Q�v�/�/ �ܓ�����Ls9d;�"_�`�zjh�\�m�3�>U$��t$x+��0��,�Х����u�I�������E���x��Fs�ή=� _�3�*���գ�.嗀��BWQ{%"��wy3QC�,�p%�2������A��Bz��^������>���K -c���c���mL��")�>o�#k�`�\0[jQZ\;���Q�nq���rO������r>x(�ɝȴ�^~�źi�kn�f�\�oY������L)g�Z�R=<�632��J)q̳�`:*z,dl�cИ������?>X�i"�B�Y��@��2 8fZ����G��l���gX�;'�����{;�^��DU�JXM�D�:RH������O��������0�+��sva�:�,h��r����U��XYߝWl�CCUuT{��Ż�ӗf��m��Su� ��A�g�6�6�C���"���:j5��X�N�ރ���+7B?4�]������>��c^"��<k�c�����F ��'۰hB�- �v���T������j����\�t��y�2��\㠦h��DŽ>A`"��j���_���<���l�������&k,���'����K�A��A%�w�!��t9�XY��kЊ�����҇�D ��� P� ����,�L�%�Tzf܂�v�~8!�[�I]���e�[�� r�4>18��Ab�9?���cX��>���!�%�/r<���W���-/��K!VY���뿱dNῬ��N���4-d5���������T"i��8GdILAs�n@��~*T]}�˃vå�T�\��P����zbޓ�b��@�/'u �/�"����>�)�~.0��!n��b;Q��������A�\ft����Yz,7PC.^�YG��|-�#�������ϫ�m��Li���7��R�@s�^V���D_�2A�<d�f����!��N�C���T؝G[�x2��e��yj��alG3���-������"����˳��z�x�K�=ohx0?,�a5\ދL����Z���a�C����*{&=�,F��D|P������*콱�7�X�K ʆ�1E�kx-�"�w�?����ä���Wi�У�������~s�W�]師ER����ub0�=���x�q�^ڷ<j�ڵۃ�VSg�����"�5l�E��GS �#r�@�Hոb��]D�1,$��룙ò-�wu�m%��������]�2�@��Nݚ�'᪑]a�� B�zEq���N�.�����f�q���c�G�r2�l���KK��Y6i�IZp�+k���r��«�Q��3�p��:(�+"It�vÐΝs��Ѝ��Y�0)���}�PV2�߃2OZ�@A;ԹH&�GuUrR��}�QO�A/mk;[0%v�i��)����_5��b�nXj�fhD�0�6�8EWwL�:T�E�pb� �戱��o�czZ,��|U�&��0ep|�=�����V�\ny����ޟj��C��ȽeԻ�$P�����w�l<ϕ����m�Ͼ�B�ߖ>�C^#���YWF�� e�V�� %���\"��N�Y��>o2�n�[n��� \�vA����Udv�x"��ڙj����*!��#�y�y���.ī8�����C� n�'�,Y����,j���6;x-Ko����ð(+�����}?7@�O�=V����[�F��,u��F7�{Qˀ�C̽�\[��w�]sߊ�-�D�WF/��$k���`�8��}�(33�A �� '���Q����i��#���̑��B��n�EN �&�7���|n�E��-��lg��4�Rqx�9/i��F�w��垬:�~k����P���m?�}�������y���`� %b��+�<��KKʚu>O� �~��'�KK�I�SՆ�)8���?���-�=����n���=�w���)P�hY��q�m<b��w�V����+�&�2ǃS)"_��^�_ڮ�����h��ސ΄�x���ǣZd�P���{q���C$F�褤�Z���+E�x�����)H�&��3�9���F���Z�������C��y�r�=�<N��,��Z���|���K��!������Etޚ������}q��z6f�m��O�A3~A2�$P���������*�C;6�<jVZ7��D������x3 ����[��>+�������`' �pK��q��J͔A���r��8�43� ��u�-��t$�R�����O���qw�w�lV�3U��+�1f#�HK�N�b��Y�`c��|%;.�(����۶�@����Gf��@��/|�K*�2�������;���d��7j��,b?n�[٨u�mZ1v�~wı7���f���pbY Y��/�:�ɍҡ.��/�!��e�/b8�
Behavioral task
behavioral1
Sample
bdae5abf4c1e640b534216acddb1687f.exe
Resource
win7-20231023-en
General
-
Target
bdae5abf4c1e640b534216acddb1687f.bin
-
Size
5.6MB
-
MD5
bdae5abf4c1e640b534216acddb1687f
-
SHA1
a4e853421d3fb7418448977c342d042e8f6f5ba8
-
SHA256
178e68cab5b7e85741d8a04c7ea74e68ac6124da33de301b321facb8048ec21e
-
SHA512
72d513a7bf4138184625ec28a6b8aa1b0a07bc9dda6e95706b0317c46779b05fa077c1df9fc3bd4dea91252771cf8a0b68a52f8a5b9371b066e5af731b0b204d
-
SSDEEP
98304:N+SDN/5BhRiuBCPemawYs2eXV1zxf9dadDPDstcy2rB6yAf+IB:HZ/PhRiuBqeFn8X/zh9UdDQ+b7A7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bdae5abf4c1e640b534216acddb1687f.bin
Files
-
bdae5abf4c1e640b534216acddb1687f.bin.exe windows:6 windows x64 arch:x64
5325e7540369b71ef5c611e515e079e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
shell32
ShellExecuteExA
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 830KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ