$�]��8�F��D]�� �W��0.�?a ���,������~�� ��HC�U���(�9[ՁƊ����Y���?.�,n�J\D�"q��%�v�8X��n�^�n�n�,$\��� ůD��QpC��a¾�]��ijC�h������{}�}�SA�J�mE+d*RW������������&u=���=������㢏�H�Co��ޜ\���������f3�X4G�sE�X��J�P��:K�r�D/����$��j�M:�� �����/��5W��A7#�t��s����U�;j���k��:#�6 �嚝!�xMX����X&�}���^iw�h7E݁���4�n7�Z6�r,��ɐ��`����x��:I���h�����w!B��!01t���2����\��H5��y�� ��Ә�H0V�{��E����6��U��)U/?��0��C� �69w�^6n]QE.>R �P��^�/���2�ۓ���R��"99������JC����!C�E6���h�0��u�t��k��M%ⷲ��d��������J���9.�F�3'\<C��,T����Sx:M��S�UXQGU�N��X�~�5���t�R��F�]�����춺�/�|?oʾ7��D7� =p^�l:M?�rY�ٵ�� ���� �@���wi�*;��~��<`�Cb���t�s~e^k*0��'�i�I�*[���2m�)O�h�����1ob��3�;s�j���S!��K��E�6�dW/j�����7��[���������F����)�rl�I8N�Pʅ2�"�r�����p�?�)Ԫz����ǰ5�Jc�u�=� ���n�B�h�Û+n��P�)į�y�Nj��nc������4�����T<�U�������R�� � ��Ͱ�=)E����P�z}��{g��b�<f��c�*s�$v��A���|D�)�f�LD�:������m�3�iҧ���a�@k ����"���{ �1�0�Uki�+�ңV�&ͨ������[eؗ�8��=m����넏�B�=�H#�\�z�7~U�c0g���ycdj%,c��v��fl����M��r���u�=���8{����������"��Y�cKg�r"� c��:Ǝ���Mc�v��@�Ƌ �d�+�S u�6�mp�3��G����e���Y�/?ڼ���E/L��B �/��V�#�E�UO$(t%1k���z/���H9,v}�T0�Ԫ���_�g��0���D�p��� _��b�)|�fz��i5;��@�&�7�m�z�Z,�Y���Ȇ��:9pH)�>$��>'7$N��������ޗY�0>�B���ގ&�7�#��>�;��v3�HE݊y|��3p��Q�G��-Ыh9�����Dl��y�5�����̤�&,�My0J7 wj�� ��U�'��h���͎�Da�h��k����w� � �n�(/��>�T���ZZ+��^9h� s�.Mɝ0 ܼ���i��_�\��3��$��F<���zP|��O2��(Y�Ϧ,~��k��yg'�u,�'#� ����S-�#��S�+��X@���Qf���������.(�b��mi�Q������X^$����cDK���v�A����e� ��J}@z�)Z�Oym��lpr;���Ԡ����Z�B��Rݘ���+�7| g��������Ѣ*�R!��'�5����ز6���eC8��bx N�DÝ��y �@��{5h�Ĩ���Z���q�|>8F��-F�N��y���PѵCR[�^b�2;��7D��wv7Z0p�Gup\��e%���!�ʵ�N��a&�x�<��F�m �K�M�yv6���MhF}F3]�L�@ӧ U~��^-ś�'i�8+{��p�H�aZ��0���lv�j�8�EF\��b�4\z��t mx�AOp|���s�ۉ� c�*�pw���R��- a,M!�<���Ǽ��e/� �L�um��j1)u^5Lmg�ò��͉�������u2&H��&(:�4�����?���EfJ��rT^A$d p+[2�����m�9Kt�tB�J��G0G3$��"�.�ۅ��>��8F#������x�Mkަ�KD�^���u���p�L�o'��ݙ4j�X�<� |���� v{Z��ܐ����!���U�������4�ٓ�U�� �G��vg�\�'�^S�O����!��D�ퟲF�I��&�_}#/!��r��έ���ܭ����{Sq�%tn��1�+�"��%z�[|�0Z���"�[�e�ގ�A ���\��(�����O��d���/T�Z�]�C��[[��Ey˺]���M��E�fw�����B�ҍ��[�@]�k_|.}6�5U')nݪ-��5;(|�:�4���D3�:uE�F��0E��vC?|oƐ�<ǟWr��:=|�P�X�f�U"w:�ͅ�y����QGUm�%���(�zv'�d�Kcx��W�����6� ��~������+���;k�����f-K&�nPu��� |A�ӛ���L��w�n`�V�B�m�_���e���_�:M����lh%���"�t��9Y5��f�r|��\+#��0��'�d���S��.�U���u)�MN$E0�&���9q��ƕ�5�ߍ� ���2�n�1|XV���� �9B�Yb�#!�>Q�bqF�TV����L��4���W����&K�[�����2i��W�q�;닕���]�5ZI���"�H)VsI��O̱�<W/��fi��&AzFu��g�V�����࠴0�l�爓�<���8~�i�!'�����~�0/��^"Z��و�1)rv%���[�IuWط|/���Ղe�3u�� x����br���cj9�0���x�������\z/J�V4X ��%v��7��c�:!�;�5�GRV�@�f��W�Q��Lx9t$�~�!���۽m�����Q����8l��q�aB�NU�}+��dsa�;V���p:Ѓ�9K�X�c$�+���摫�k����+�BE���Q�=���C� �w���5�
Behavioral task
behavioral1
Sample
3f115b1ffc4a220e1428694843ffe98b.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
3f115b1ffc4a220e1428694843ffe98b.exe
Resource
win10v2004-20231201-en
General
-
Target
3f115b1ffc4a220e1428694843ffe98b
-
Size
6.4MB
-
MD5
3f115b1ffc4a220e1428694843ffe98b
-
SHA1
07dfc7134564f5fb530b40f8501aaf92cdc0c060
-
SHA256
56e8b1ac520db635a1ec1407ed768c977bd93179a0caba250144dccb9f98d2d6
-
SHA512
55cfa818c035bbb6691c24dce1fbeea41b74e198a15a48f023db50900d84c516529b8e0ee5e18833a66e99d41a77e2c568c280741dae0c46049af8e11bcf9abc
-
SSDEEP
196608:mpAi1bmK7XxHEEKK1eeDxq7a/xEklUz+IgoW1:mz1d7REEKeeeDw7WTl0Q7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f115b1ffc4a220e1428694843ffe98b
Files
-
3f115b1ffc4a220e1428694843ffe98b.exe windows:6 windows x64 arch:x64
05362a901b3077f010e7f4399ad1ca11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
accept
wldap32
ord50
crypt32
CertEnumCertificatesInStore
advapi32
CryptAcquireContextA
kernel32
IsDebuggerPresent
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
ole32
CoUninitialize
imm32
ImmSetCompositionWindow
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
ntdll
RtlAdjustPrivilege
urlmon
URLDownloadToFileA
winmm
mciSendStringW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 824KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ