�į���$�����̺X�pW��랭RH�n�6�e�%(� ��'�{EG&\����̼�B�QBx1Z�(����Sܮ�`�CO�Uc�'G?�*{��-����X�S�Kro1u&;��!~��K�����1F\bX�o�K�8]F�/];SPí��D��6�̯-�B�����Ca�����k�>|[����������E���W�&<���;���8z uM��`�vt�Q]b���������[v�k�� =f $[�����I�5}>h�[�-�����"���-����>37��v���٥ˣP�_Ȳ?��I�����yG4ȅp��l�H[��»s��y��v\�(R").�*����i�:>��zY�܌1!����t�7���m���>�<b��[���Bz)�wwuw��T�j��<T�P��`m"!����]#��&� ��}Vg�0�G�:-�W��kTT�|qa��jmʹ��z]UlFNo��i�H�*6�"����e%v�\�=��rsz">@F��U��G��[o���O�X"(��H�&�N����kYA+��j���_HrvWD6<��l������X�3��X f��j��^]���+\؎���#P:}���v;D]���H�r��'ĩ�^6oؘm%M�x�Z��_�!(eL3x�P=b�'Y���D��#"?7VNٴզ���4����$_O�-)z�}�F�$��:����x �C�9��24)�uE��V����ᔇ�KnAYT�\�̀�#���q[��- �4� �G¬h\�&��2*��@ԅ'�Lm �Ϫ�����K{� ]��Ha��Е�2I��v��Zs�Wzk�lØH.�G~!N�tj�J��0�1>�5�˧\��!A/��]��� ��j�(�&HJ��� >��^8���*��/�ޝ$8�Q�bo/";��2���~ե� u�܉�����~�:얝\?4M����]!��į���̈�IF��P�x× ��a��.��!��LW���6�����cϾi�a�yI)?��c'�,şfn}l�?% ���v�ջV� >�LJ{�A;I�f�~y��%-7���������a9ȴ��ϊ�����QI��!��&Fj�r�Ͽ�R 7�y�7B���j��z�i;�T�5�I�0�8�Q�M����w}������4��+�3"�Vq�A�eE+1�!h��a�.���l`��j������\�Y]I;!�`�]��MnXң���v��șf�~2� *fd�E��_�y�@e�}�N���)Ryk1W����*��t^�\�iݚ���C���ЫdO:~LZ)h#ܺZ�I{/"�Ѐ�,c�;���������៣(�U�s1���P��`~(��3=���c�����ѷ�3���绎����58\����P*� F�G�lτ���C��u�Q�2?IB<�Ԃ]z+)H�dr:D��Z�G���Ul���䍻b��ֳ���ؖ1A��US¥)N�����E������*��zr>�R0���9�5ޤ�P:��i:�"?�������@��[��؟ඟ�����)$�i��O���[B /5���{p���'��L���UCn��'j}������ �Ru�\���~ք�FL��O�Q5�� %e���z�P��!� ��B����<��)*7�6��\�gw��#Q���Lzg@|��0�3���*����6o;>�%=L.b���R���J�>x��'��7&�=�@��*]��p��k���Ry��;�,��k���#���Z���d�D������t�}6NG��.f�о��S���u�..�U��<%/��cw�$!+}�`$�2�<���G�C!�����U�3����۔�[�4�dJa��MŇ�3CV ;S.�2!��+����ߕ��*�n�+Ȋ)̑㻊����- ^��^�z��:�rI�� ��w�L'D���.ҿ5������n�tt�/�;��I�+ �djB\� �z ���N���(|`�����[|X?F���F�Ph>�y�T�~����@�[����cP�q�g�4[���[q��8�\t�6Ɗ�2�XPT �t��t�z�I�������͙������f�<�xGm4)��3?F8w>�E_�{]@�+)�s� ��L�O�HTu!��F<��s����Bq��&�-�҄�YC�2��a͈P���h!�ӽn�k�l:Z>N)�%�������aJ����:U��T�&a:������*ܧ���{�B���s5� ��X�L��<�~��&�_��%Cbv��S��R�&�:�����Ws}і� ��K���QG3a(���1��.��p�����3� ��+ dՐ�>c��_7�f�E'��e����QpQ�C�~,��Z�\�iۣki�Q}� Z!!\����\�~vS��lB*�l��g�l����hW��lߗ�/��3��3��U��.�~!19��h�;�Y�� �uo���ezҞ=��ux���A�vT��I���7XZ���.w^�����ؒF��U����ɚVn��բ��9�K���8�V����Z~��a����IZ�tkDB�&�!�cu�3h�RL�B9�w�w�|������Z�P�?6���E��� ���9��jV�Z;�17]�{sV�,����g�6��{*�W"��7=i����Kw���j&O�{ob�t��FQ���a�x6q\��%��F����o����ۂi;��Ţ�;H����!L�m��z�L��1�(:ÀȒ#��st� ��w��s��}�*���q�� }�|9��P������m�V@��S�H��p�������lq�a�o�\�g��پ�# �4A#�.���Z��k��1~�m� �m%���$KH�%��9cg :iA�ϗ��Է������� DAiq��G���Q!L��K�/�� ["��s�t�Ug,��EN;�[�ScX�-��<9��R .5o��]�<CH�u2��VPv��q�=���9��tu��ͦ8~Qo���)�n[a�e�q���d����VI�i�����W\�y��f-�D��3���"�
Behavioral task
behavioral1
Sample
Stub.exe
Resource
win10-20231215-en
General
-
Target
Stub.exe
-
Size
13.8MB
-
MD5
894a60693fee38d4b64056cb10536a75
-
SHA1
c427e45b0f7eb66583d2fb410ddb0c0e6196c0d6
-
SHA256
2d6c58c043a319b7d9de60a16184a3cfdf1465b79771d27223acb2cac197851f
-
SHA512
8fdc9499bcd2fd8c1c0732db547e1560be3e889ba0a243b95ae03c0d5ed6e3229fcc35fcce736bcab9aff11692e4d3045471d227393a55379264b8f7a8bf87a5
-
SSDEEP
393216:069fCksYPBDTr2L8zhgy8mTZ1fy68+dl+up4:0kuaBDTDd1uEl1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Stub.exe
Files
-
Stub.exe.exe windows:6 windows x64 arch:x64
eefd58c0250cae43a36ffdd6ca712f77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
msvcp140
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13.8MB - Virtual size: 13.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ