�ئ��AWDu��w[f.A�M���0ߔ����j���$2���Հ�%� cSM���S��N��+pIW[dy7�"����7�o�䊊��.�����e1���n��]�$)�7~P��U�,��T\�O�jU� >�����B�ʟ���w�5�57�9wR��t:���p`�.0�bTU��l�j��@��r��{��1D��̠���z@o`�5�X��za�bB �s�|��3�+9���E��4]�x��4���2N� T���7įc��J���i*5�w�:�r��^6�ի�Tk#8��(�c��f�ذ�x�&�j���h����SoN�1@����qm9�4WcNU@@�b���*��.�E��ȍ��FEi��G�cdч�O�%�l�����cX>�����ky��QD�c��gh�@��g~����q���>�ܿʙzN7�4�Ԭpt��1�d��:��,�^��j����E���z�$E d�&5�kS��O@}6!#�;¹3�S�&��������.�Ȳ�u�c����ʈ��s��`opeז?3x�8������(��?�X���L��07\���n��zAK���Ҙ=~> ���z7I�x깇�eQ#�?ښ '�;K�r�s`�G�\��'�EݾxD�-�L;�D?��>���4��%�v�s3Y�,�$��������á8�AQ�po���u�!J ����%����Q�Бz�W�Y��]\'ӷ֦G���ʹ�* 9tʉ�(H+]D��Ҡ4��!B�o���������̣[cU�p��о���N�T?�a���۹����7����Z�� ^R�(�0��Ja�HI/�����@��8��;w�l�*����1�+E?��Q�����r�<����TX:���WݙO�[��l4^�����kt���kJV!��K�-R�'���]α0*�R�oBx���Ԡڬt���*����Y��#�*�o��9�>1hN�*�,�:�d/Vd�o�%c�r��|�ފfL0xפ�1q��.�`�;s&}s�.]d9�kQ*�y�����NA��5*�� b1�8e�[�Q9g�o ���G�ޞ����g��l��������0�X��!~Fl�Ȏ�-x�6�r��_ܞ_�Q���l����f�F|(G��?����L=�ٖ=�B���0�E ��bi�HO�`X�r&�z�)���-7��e�����K;�_�CT�%K93���jV�G���(�T��0��3Wᥒ�*�3�6'�%��ʑ�_y�3��r4�6���F���@nZ"����QN9���u#yp��*o��������+#�����zZX��n����˫l���H6��ձ@�ͺ���|d���i��9s� H�/��%���Q�H�]�����O�wj^ '�S�� %R/��+��c��Щ3�����[������W`tQHa�v~E5;qS�q���l�*�*�����{�:e��w���1ޭr)�)���(cA.uD�\���D�GP�9vӒQZ�*�\ď��\DO�mQ��eK�;+�����/'�H���� �>�2^X��~-p�b��%c��[��F]���ﭠu)AVJ7,� "{n0�ZL��-WQh���Z;'��ml��G(n����hJļBz�x(_kp�u"I(:B�1t��뱦�����]A���yz��m_��/n^a�-�����`U���=�uz"�Pjv�(pV�b;������P�-q�g�����TP���%k�;"�Y_�l�O{�!�X���o�5Q*��.���^��s�=j���(���u .��8�G��>+D@�6��'��9gI�A[���RʆF�Ph�TQVR�-=��~it��J�I���+��E�y���@�Bzg���W�eCzs����n{x�����K7N����ˊ�8 {��e������'r#QO�zn��|�T���>�u�ǚH��}�-xVW�c{��=�;U 3��V�KTa�F��vz6��Ѡ�I�WN�Ǘ�0}}�H������� ��@�#�8b��0����{����T�U�a���d��.�lw������T�)�ϻ�Ma���-�����+����܆���������$�EU~Ǡkr9]�>����>�L(,�$[���q���cr��Y��������s; *�,��}Nk|�*�2�w�:¡$b���eLS��E��zO�߀T��P�ҭs��T�qͶagf�k4p���8����2H� �A���[sQ`����z7WݤRO�u�a�Ho>�Q�Iӓ@�.��#t��,�4��S��M�Ħ��/#R��1&U!u�%]��y6�V�+L�jU)\���~_��@�D�o �t�6�^9yƒW�陽p O!���xAu)Ͻʽ��MG��g���z�D Y|T� �RBZa�( �/�:��Т��?BB�؇N�:/��'Ca�Ae��7x> �x�&��r�����E��!���0bM��)iP���^���~tw�ۃIY�ܹP��K��K�G*�.`���o{�����3���K>ա�_�̄=�)�@��!<�~����u��?b�q���1O��\��+_�)��2ÁFճ�{��a�����C�V.�����iI���������O���<�U���,�GT�_������/+�N���#��pO.@۷_<��$���������O�ܷR�|���8�������������&�O�P��������|v=m��JS�AH(�)���� r��wX��p\X�Ǻ{h�&hh��2��3*Cw�Ϣ��%����0�I%��k�*NR���N+�/�g�AN��}�yA[��t"<����wy��ж�YJp}]qO�n]�����N)�X��sx�Ǹ!��$�X�~6��#�������7��J*�`rP����%�^{u�]pJǠp����T;���+� w�o�\��01��Q���=ݜ&�C����W���A��� cl�7�#/�J���^+/� 9e��L�e1OQ�zAYH��f���@چ�Y0��Ae��l��:A��|�j�C��h�]��P�VD��3GA��' <�2?��{���8����C�qb�3�� ֦�
Behavioral task
behavioral1
Sample
6f8c8be45af315608274fc2003223866.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6f8c8be45af315608274fc2003223866.exe
Resource
win10v2004-20231222-en
General
-
Target
6f8c8be45af315608274fc2003223866
-
Size
5.6MB
-
MD5
6f8c8be45af315608274fc2003223866
-
SHA1
2f2d932aa5b76fafec36e149d90026480ba2c267
-
SHA256
0db2aa29c05a61039eae304dbe4a30d092c4a97f88470fe499216b216fb0b167
-
SHA512
e199de5c062cdf90b89e9f3de09a90a88b81b91e6db288782ab49ddc25acef3d071928c7d46a559faa60caef1965e0d23b12dc0fed1a6137da1be4cda8db4f42
-
SSDEEP
98304:1digdevFD5MCdnpihyJvG7pPxT0DfM5HD7lXcFcGW/L6NgsbH2He9fNndMPgSY8v:eYevFpdpVBM0Daj76W/WvbOeRNSY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f8c8be45af315608274fc2003223866
Files
-
6f8c8be45af315608274fc2003223866.exe windows:6 windows x64 arch:x64
7271ac425f0595e27bc3e739991245e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
GetTokenInformation
kernel32
HeapFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ntdll
RtlInitUnicodeString
winhttp
WinHttpSetOption
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 544KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ