k,����Z��,��{����]ۥ�1+i]dx���ٝ6 }��4g=@t����'�29���u(y����@��[�;MQ�776ilKE4ʫ�(�Ead�q�������;U��H����*rr�l!��3�E�D�����*�)�|�݇�K0:r��#�['����4,$I��w��N�o^���6����C>V��dé�>�=��\�$-E��@��a������Ln��~�6r?�^�:'rM�*&nb}�7O��}�0�^h���8;`�*���u��s`6:�P�]�Ww�O�5-�����N����of|���7Nl�nTοXf+e_p׀���EWm� �R��&8=ڞV_R1}tiZB�y����u_��ӂ;˒�"-�_D�R�Ť��5��*' ���:��1#���tE�Q��KK\a�8"��W&>VWz�L�\W�.�����+"x�Y��d��ؠQ���j $�iz��\��z"�c9���E�z*�l�z���-�2f��H��`���c���$A���]�����f水y��q�Jl�|��̌�=��a1�O�.���W��������8�h�0�T�D��t���p�^�3W��*�x�!V�}�gi���kf��y�x���"/��(��f�F�Q��Q4"��Yf��BGs/'�v)2��,X�W�_Y�@�yb�U�v%M_T��K�H�?�E��3��B}O|�`'h�4�E����?��'����E���>�N�`'O��0�;�+V]�P��Eܳ�z�����ic/ҽ�e +alg�L��ƚ0��n!���薡fI(�ޫp,�v���$*c��R{pV�Ey�����������������r:*�Ԗ���mӛ(��a��Y<�eSYV�joː�J��G�c&�Ft��hI�5`��dᠯ����3�k��3������������o60P�� 2��c�$�H|����o*i"C"��bWj0��{/���F8��|���Ɲ\[��\v�i��:@{�Dv8Ht�fNk �#kO�ޕ�7���y.2�vO�̯�v�ȱ�.zW� �v�� '�F����L��U�AIѺ9��ϋ��IJ�I{�^Rf�V�5�~�� ���xkIF�:�\=�r�f��R�(\�9U�*�QW;���M���U"_J�IC�_���}]m��S�ZMD�"�;�q�B~$����&6�����l��=��1T�t�8�4VE��B��5|@�@�;tK$��˛A����=��5���d����$�Ф9F�b�7B�OC�̻��v(M�=J��c��F<�?�:+��� ���4���{���8��$�3S淵s�壡 ���U���u�dߣ�lu5Y�*_>oSNbl@�06s���%e{������`H>���cT�I'�$-^��5l�NQ�\Msǐ��8�O-�T��ea,.o�iYCё�z딾� �fw+�;@K��;xA�</�j&��9Ŏh1' �ɢz���B$�s�����I������^�;%���U�,�5Rm�)0b���1���,��j����>tn��+�����g�����tǺ�]5�D_�z�wE�J!�y�\u������}e��h���hJ����Va�����Ƕ������u�����r#�e�Fz��Q}�^E��|ffe<%�lk7 �x�9�q���4�'�������B���r{R��Gi�M�L$�r��7�YI��� JY6��ST���'�83�;���L0( �����u5Z�QSt�ˇ[w��yw�b|I�*��(���Hg�R���ؾJ8��ٛSͫ/Gj땲K�?��`d��v��$jq�7؊�b���,�e�.sA����,.kP�;�����ev}���u�c����pǍ.� ���@�'��2EFL%r�;&a6�=���O#O�8Hb��fQ������,�7k�W c��玭gȻg+� �(�:��؇]� �&8+�S��xh��p!](B�<�l��Z�.}?�������ȼ��c�k֤?�'�|[>v\3�Q-��J�k9�:~óy�LS"Wd���L�!,��1t݇����a�|��J��=�T�N��kJ�U��1kC+ a=b#y�a��^��PV�X��5�������c5�� r\G���N���SW���f�l��ĝ۪,�,�A`�����N�|8�E�uՖ��P�L������z��ώ�e�KG\=?xNN�~}��X�����;�dɞª��r��L��Pn��wxP�M��Y��#��Z�������e��9ъ�@��dVj�4A>�W�y�����:�5)��`�����j��FH��T5Ь��rĜG��|^ަy!�(����Yat8�q�}��K���$!�7��o�X����ӵ&dJ�EkR���N���z9��ET�=[���!]����}���Ŵ�+p��ќ%ǐ7�B&Ґ:� ��5��0������ֿ��g�q�Q���E�鬫����(W���ƺV��S����/��@�/=��(����_ڲH`u�L�l����٫��A3!>���?�E��W�����h� y�rj-Y��L���Sf�����?B����pq2�VP�+�-F௵����%���T�R���m�� Ν�_�G v��W{D���^���s���bߦ� ϋD0�]?N����1��"@I.KS�G�/H�[��i*�w8�'x��N4�I��ƘY�?w����=�o��(`���><n�)V5���T�eV��B��|h�{�ޟ���|�c��2�Q�H�t�F�.'�Xn?� �]kz�����:�ry����M���������8��Rv��A�"r�e���)D���C�0�ֺo�Xw�Ŷˀ��M���y\=z��&�y���F<���%Fk!��(5�3~��Y� ��`�/C��5��� �����������2І�W�i���B@�*?�� �ok���mCfuo�(���D�r�yw��82� ���7��& o5����;9}Fq�˗��nf�� ����<S���1�ol��y��#��a7B��� �J�zbi�֓��5���]�����y�N�i#�'1�[+�
Behavioral task
behavioral1
Sample
2dd6eb3e7748b1371e6e5d55c1b6212a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2dd6eb3e7748b1371e6e5d55c1b6212a.exe
Resource
win10v2004-20231215-en
General
-
Target
2dd6eb3e7748b1371e6e5d55c1b6212a
-
Size
2.3MB
-
MD5
2dd6eb3e7748b1371e6e5d55c1b6212a
-
SHA1
f1e5befcb0fee33198ae04fd14183b85507961f2
-
SHA256
d93c3d9802f5bb1c47c07ee5ab06a5c0a3104c44b19db8c369268692ce08af2e
-
SHA512
73f2822b362fa757e32e743d3dcefabd7e503a80129d9be39b49827c9f6a2ecd0b86648f4c63c85453cd5fc8e71c99d8c0933649f168b97aa77d734e9af855fc
-
SSDEEP
49152:1GmwMSKNUllZHIUIHU/8accc47BoModRFOLRuG8Gkx+EVSXVhdbc:IXlKNUl7btlXc4kOLHIct
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dd6eb3e7748b1371e6e5d55c1b6212a
Files
-
2dd6eb3e7748b1371e6e5d55c1b6212a.exe .ps1 windows:6 windows x86 arch:x86 polyglot
ba62cf661ff8b966da05a58a17112ea5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteA
qt5widgets
??1QFormLayout@@UAE@XZ
qt5gui
??1QIcon@@QAE@XZ
qt5core
?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z
kernel32
CreateEventW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
CharUpperBuffW
advapi32
GetUserNameA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
libcurl
curl_easy_perform
msvcp140
?_Xlength_error@std@@YAXPBD@Z
userenv
UnloadUserProfile
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 289KB - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ