qI=e���*�Q��+�#E�)��Ҋ�=�Yw����F �>m���=An��0�W�c��@[s}��̰���q�j�U�1`Cɑ��f��ZF�=Q��I\!��� �[�2�T�vW���"�"�����]���h�CG�ٷ+d��L7����ފbG�����>Z�� ���n��F=��k�q����L��ZMzO�N��Y�o^l{��AF����L��DV����W���`�S~�«��S.�3g�j����v����%њ�����\����&� �������dx�ql� �V�`�9^��6�' 3��ħ�L�ZH��mP�e��%A\��_��]ڪ��Ld@]l��X��4�vf|#���P�T���ގŊ����ء���(���E�m�������I�!�T �"�i�SJ� .��<���M�Cė=�r_,[����n*�e~�!��'�ʦeu�x�|�2��njI�@i!.DORR<�����N�o1y䲂wx�����O��.A|^�)j�\�yX�G1�"cx�.�0TFQQ��� �@ Ѳ��t�rs^4���!���F��<.0��F)!I�8&?���~w��}%Fcq�H�&����pN����E��틹����<����=6h����5���\C�_���]�$�4����-e�����y��x���*���ݔ�G�{��M����N���B� g���Z}�E��M'Gnh�:��|!�Nn�XD�1�:��b��p��$Bs�\�F �L��ϭ���;�7�'6��~��1i �Ũ&��H@:_����ߨ۪ �q4�9�\@E ��7X90�H�/�%���]v��c�s\5�w�^�����Le�j��XH{|�a�%l��*@����|������V���1�5&�˙��V���Z/[�ϖ��~�8��6T�e���>*��T[�0�����i���c�5���v:�_ϲ��Z��9�"`c���=���1I��.�У�U+��,����\���OQ��LW='Y���F��Fr��I������ˢ�,���/���r9�@�B�)���#�����a���si�3�y�2�ܡ�l+��Ec�M�щ N��~ cC��� u�T�N��Mq-�T��ۻ9����9����"�.�"��z!U�) � �g��[�3"�Ăc�[r~Z��:�A s��|Q9��w�� ��Lb���ħ���G�����}o#�܀i̟�(c�I�?���J3"P����HC�P�jB%~�Nck����ē��ZH�x���� '�R6���<Q��Ex��a�Cd��L�W��0�:�'�]��-�Ǫ"F>�)^���w����W·��+Lr�H�(TrijN�� �ׂ�ȹ �U5.�8�J�e�Y ��jlC�}Y1�����@dd���{�'� V�d,P����f�}� �^0�t�%���j���W�����M��ֱ!�Z��d����;� ���ۻ�ڇ~��F=xd�"$q���%w`,��o:���Z�X[��<,�� ��M���v;����2�H��o���� ^=���4_[��>��8Mż���}��S�P��la��Sre����j���jz0�=Ƙ݆3!�S�%u��R�K��d���,?@�QK��~����p�>Gڲ� Ã��>\�@\qbk[�=���V�7���z3.�Ie�_�jn�ܖ.�Wȣ[�U4ǹ����L�Hs��������\"��2lXV��hw7��A3��-/���Vi�l�^��L>-X�pk^ˁ����j�9���0��BU��NN�����F��44��x�t^����G+�Yk��vlap\�Α_�UW�Uh��������Wc��o�;�T��;���W\H��3;���]'�(&����[D���~,Ag�Y�^[�b��ί�QH�8��^�2Zӊ�q�{dp��)B��Iu���&�%�<dK�p�����/�S�/,]�X�"��Ȳ<nƚ�F5~O�'���7P����+{���r����~ء��2�M��@w�h(ގo���է5��ꏳ���ٚ���'�|4����mfi�3� k���}��iJ������ϛAN��l���U1��������I-����#��ƯG���Xc�3�����d��cN��P+d��C}W��\Q7*J�+~Pr�W����� �x_�_;4S O����uT�uN�`�T��xȵjq�g%6��:Ӊ�,�1��8�Ϡ��/F���1i�F����~�vx��h�����P[l�03-@Fa�G�l)}N��V�t�:�- �ω>$>���>��<Cgx ��G��,%-��sӷ�>��L[(��! �pH`QY^����P���\ �<:F�N���j�.ҹ�9Njk2�f�ȓ[�j����͖�k1���kt�a*aY�b���a�<�y�������D^�^���K�=@��u�b�Ɯ��j��=��{���~,�ǚڿ�-"%�#͢� P6\)a~3{v�Ӵ��X`O�a��%��mY|&VZ��s���p�(A�٬����cxCq`ft}�0�+��s��;���"r�զD(Q=��rM(�N��<�}f�&�Xc��h#��wD��<�A�6�xl��������A�u��m�mF����2� ��\�$�������pi[݉��]�#vd|[�0n�/���w*�`/��3֘����ͻW3���p��1\�,ƾ���欷��L��5��C�oXÏ?T�;�h�������+�5I9l샇�����[>@I�������z�����W���[Y�(���[ga�gysCc/n&YJ9��mBz��V��ǿ���)v�t�2�oi�k�T�S��û|���0�Kj�G�#���(��;,1�i(8�k����5U��q����Z'g2�!F ��Eˆ����q\�'בWc-(�}�uO�j�y�h8�!��R�� TVr�9u� d\���`]�,= x��k�2�o��H�C)����� Qw������9�JA�f�\��+��j:"��C�HгH���%�ȼ%��oh�B�˲�T�t��땺q�+H��ۥ0*F��[����}l�/xL�V(�ɾ]��q
Behavioral task
behavioral1
Sample
c399a85eb4a58dda5ab2e16483be2357.exe
Resource
win7-20231130-en
General
-
Target
c399a85eb4a58dda5ab2e16483be2357.bin
-
Size
5.2MB
-
MD5
c399a85eb4a58dda5ab2e16483be2357
-
SHA1
f80ee2d5d5d68803e773113778121a87b56007b7
-
SHA256
c6f3d124c8679771ca65f0a03c5995da466eed2a2f707a7ea5b47aeadc5a1903
-
SHA512
ea6333833654e19a5733ca8811fa3beed6ac44653d55dd763aa19f40518287a4a79dfb052d7f484a5708592d04f41c7f6eb19b4632cda06ce902b87df607a7b4
-
SSDEEP
98304:cvRIzi9OycbX1bFY8xboccA3DO4G/hzwhq5dyku69RQZO:cvt9OdRbFqjUNhqdzu69RQZO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c399a85eb4a58dda5ab2e16483be2357.bin
Files
-
c399a85eb4a58dda5ab2e16483be2357.bin.exe windows:6 windows x64 arch:x64
a7961ddc5b24b5d6b87dbc9a27d06aeb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
crypt32
CertFreeCertificateChain
kernel32
QueryPerformanceFrequency
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptImportKey
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord27
ws2_32
ioctlsocket
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 546KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ