�5��x{��]1pc�R�T�������[ DЩ�����T�����F�^d[�R�`���'�k��ʾo���ϝ�DIi�AY�����]�]�]�5M{��:�)��*���0��1K��������}��8���Z9��v���r�A��e`�3i�& np�6�1E~)�;����:%�B@!ݴt,�!M�uz �{w��O��h���G��(|�I��������V���\�tE�t�~AO�9ۚ���%1`'ˀ?��'ay�Qxx��q��P�'��V����v;�Ru�Q�:��e�Ef�@���_���$"HZ��M����V��T�hT��W-y,\M��Z�,ܮ��u�����>�&3t��D���y?e�������P�l����G��]�Ԙ���h5�n���;꾏4;~����cC�?�a'������l2��D� Z�.<~��ɫ�����.8�z����$;���!�!����O{��X���r�|#,���x����̷qU��"�7̳�FJ�O4�j����5(ݤ�p�'�@Q��Z�Y�F�0\6+I����[b���������k��J9�43wmʲѿ� �! �=���r>��-���pˢ\�S��}�o˷��V7ݙ�߸i�k�G`q���߉Ჴ��5��vZ�ࢢ�13��Ш�`=���FeU��d{ Dqd ̪��h,��=� �� W1pADv�0������"(1�!�e,-a�Vi��h���l�VnQp�щ�mNi��q����cȎ�U�3��l��r}�H�ڞ�H��x�v�1� ��B��`����Ffp��6�����ń�Ѣ�pW���zk���Ehv�����fg#ǯgf� �G2J.����e�U}ߖ��rJB�q���� �� �IT��$�1~U�n?�P�!�_�zv]qg��߽���(�u�7]�� ������+]�ZW�����������jSW4\�q�~��r`�i;ק\��5b��Yz�Y�N���:���^i�t6t�����fu??i�1~=es#r�����h���R{�7P�O���<����he�;�ǜF���)�8�W[��b�g#B�Ƶ�(���e�ˡ��ȁ)�SC����C�H)��7�F��p�9����|�a�h�y�����hc�y��(��ĘRLJ襭��Ջk��)V�ov�I+�)��������[S��7C������̿Gd���49�(�D� ���[�`�"�� B�N�(o�Ͱ(��b�,B��G�YiY�/��iU4�U�B8`+���,����ʷ 9b�,ܴV������m�+��(+3��a��?_g:�կ���S����g��6�?�G�뺓@;Kb����n;���8�2��}Wq%zK�����<�>P���F3����p~��U�&u�Rը)���7A��*Pܾ�6�x���?jgAGvL��Q>��l!ڔ~˄H�s�)��S^d�����{{{~�5������Q���aQS=c��Ş�2����:<)Mh�U�mj�Òr�2=c���.�S��8�)<i.n<�U˝$�bD#�ȃWy� s*�W!���PgZ8�(aQ��$8��j$���-Bv��vs�-���"�H&��o.h��ۋ6�h��M�:�H���n�~�j*�r~A����$/�}�%��D���)��B�����-r,�5��PV}c��cD�+��.0(�JY�$���n���P{��,�I��y�߁t���[����}�߹����.��ǥ��2�SP�����@L�0Sr�m��;`�K�L�E�w0���Dm����H�G�9�]`����D���'����`� 0�fv�7'�ݫ:0���AeR,�� �9�ThLf"#2���1���W��y*�7�a��A�c�j�F}S�+����3�V<H؞�+�g�X������7>���]�__rX$?���s��܍���N���sz���>Z����szhW��b��R4G�\J�K���ؕR�r3�1{�A"���.��A�7���B�+ {#�9�ғ(o~S���-]Q`�hY�s+S{ �+ ֣�IH����;�,Oi�vǚ�'攝��[F���Ȫ��ٲ��L'g����_�6fhu�ޘApf���(���+*�u��(��{�>��\�1�nl�f�j~'K�N�-�����S���U��X���)kt,��o �T�Ʋw��Hƍ!��i�����#L�q��r��O����G�*�����(=�4�}/��_�����I�j1܈�rI9ޓ��7��r\.�Y`��p��Z�n�@���N� ��E�캠z�H��QF��PN���!_嚰�+�W�4d�D�`s���o��/��)P�i�oT�yq�[V:f���,Eh%���$��<��������'%fő�Fg5hC��i���� ��V��3��i+����e=��^ѹ��� ��^���8�[�ђ�( Ҽ�����ߏ������ħS���Px� �l�OV�KH��5����� R%����_��#�98a����e1�Jx�ڐ��0��o��1�i�dbE"$f����S\��)NV��^�FK8���!�͋��ʳB��uT�� ZX�.m!1`��/.&s Vq�;��G�{�X�IOAzMw� �e�Pݭ�~]�u��@�{�,� ̤ ���q��kءk��w�I��}����-2l��/�j�ɭ�E� S�<t������o#Bӡ( �����XJ�q1�q1KL�6�CA�X� ��a�t�ʁ����.NQ�@���A�r��mSh9]y�'�y�t��O-7��0��~�`��ݮ���"�#�,�g���&�'�v��3f��k�K�P��97��3��o(�T�������g�e��h��ʱɐj���H�?�a�'�`���3�>lӡp%�[����ܗ�1�c�&���ǃ:�����b��i�3ɑ �8���q��IlȤ�p�N��wJTL�c!W �$^�a�PЌܒz�f�*�!�Ngv(�EA�9��*p��.`~&�j����a=W��/1^��⚦��&\49h�|:x�A|����������1_6�__|3���6��!'����wz�2W�
Behavioral task
behavioral1
Sample
2ba02660d3375ef2de91abc9c817ab53.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2ba02660d3375ef2de91abc9c817ab53.exe
Resource
win10v2004-20231215-en
General
-
Target
2ba02660d3375ef2de91abc9c817ab53
-
Size
1.9MB
-
MD5
2ba02660d3375ef2de91abc9c817ab53
-
SHA1
61d2ae4e94efdce420207e99bbabbfa043cc80f1
-
SHA256
0cef0362cf94b5dfa8fb67372611ff40e7008686847a1aea940804b1aeae1b19
-
SHA512
cf9134aa3050f4565e947e3468969b41a8b24cdcfde9b83581e08fe0ac9d18223c80f387022f2bb8d6134f5a3f3b4d09e1f10e23e052414fd56cbdb5a3b31c82
-
SSDEEP
49152:FnJlr1IgsrK11iBa7K5CL+NIps2lCC2x+n2CNQo+rk9n:Fxs6kBa77+NqsKF2x+nTKoUk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ba02660d3375ef2de91abc9c817ab53
Files
-
2ba02660d3375ef2de91abc9c817ab53.exe windows:6 windows x64 arch:x64
e7bd3f413d8a0060cd2f8bdd7775ec0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
aws-cpp-sdk-core
?GetInteger@JsonView@Json@Utils@Aws@@QEBAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$Allocator@D@Aws@@@std@@@Z
kernel32
LCMapStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
advapi32
GetUserNameA
shell32
ShellExecuteW
msvcp140
??1_Lockit@std@@QEAA@XZ
d3d11
D3D11CreateDeviceAndSwapChain
wininet
HttpOpenRequestA
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
acosf
Exports
Exports
Sections
.text Size: - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1016KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ