�. �HXy{�����H�QN'����,�X7 ��/�}�1�����$d}*M˴��\�*�[a��7 ������]��6Ϲu�HW�>M,�p������n�Y9�`Բ�I\T���HJ����gO�����xV���c��ʮ��r�h���FY��Ql�h�Eg����l��x���!�m���u�R:���Zd,W���Ů�o�w㧘��_ӗ�s%�������������q�����+(� �����\}�gӐn��u��F�ų�hC���@�s��������Љ�:z��Nދ�9h�����oG���i$�*�؛��n�Ѕ) �a����5�<O�� ���(c���`YJTL�7���������#Jyk!��r���&@��(i��j[�|1���(�f��{{������W�e�t�C,{j�|߷�_?<ߎЖtojh�N|�Q�4��Y�$��e�����B������!7t�C�-r��ȩ�f�Z ��Ѷ����:����W���6��0*�ʖ#>���;����L���V�'��'�Zxi�D�L�,�wk� ���s:��eǜ�� -����U]2o@�?ߝ�d�x�U-�Ð��V����w�@� 8��Q:Z���+�� �T�'DJ!��{���z XPa�l@��3��������Z<Y2��'�P�'" �?>/����ӟ��v� �]��������oh�3fh��%�=��e�N~;?ﹶ�J��*�(�A�GSG|�91Ql:��Y��"�<|�"�i=�r�tK�'�e�X���P�T2���V���_���3{y�����'��¿t�1�T�Ƙu7��H?/uau9�L�����ܬ����X�_Q��&�M�;��^��W/H���*$���8 �H�v.��VcQ���U��5밎s0��b�����KI�|�씧�������`o����{p�*#����b�a���6Ӵ6}P�vҷ/ya��������_M�DOB]���������o}��6�:����~8]�vn��HoV��A�������&p��/S�F�}�:Vc�f���_� �ϧX%R�_��9iЎ�$N��89�"�~L�ڷ+��@~��QzD�;��,�RD�o�@�1�y� �Iދ����ū��÷ڳ���"�*��ZU�W���6si�y�X6����G��@h��34 *�Q������0W�q�x|�����7N���2�$�Ϙ8d�8��:mL� R�;�����U���1��)`U��=ӫ���hנ��7<:�$��1ʘ��\c��7����_��_�j����䈠dr����q�<�a�'���5l���n�����:L�)>�_����y)��5a�Q�+�ֵ _�b��HV]H�|�ƚ�`�/T���<�|����,���q���w�@7���#��;��g;��m��ݩ X=��,����︹�4Io��>X���ha&��1t����\k l%S���#�/����jC��T�IJ��������0��`�X� �,?���% %?)x��J�~'�j�����t��*�<\Bm�"�� �fڭ��qх�Px�a03����Y?ͳw����&}H���7��u�A�X��<S�4Ǐ���$>���R��I'�8 ��f*j5U�������z���?������Jo��m��+2��N{%!)26����ܸ17�o`��SkSyV�d�e�=��o�G���Q�Zg>,x�씙�t��Z�uP�1~�g�#p8{.t�.IhܿVa�Y?�.t�|���.`����v���pZ�oG͓�r#������}�"�z'��Q�<�5�!e�O�-�Κ�=�NJj%������5[��v ��cR`m�9t�$���z�U=-'fMi��@*^sR.t�l�c*P���_�c je���*����x-�c�/Q��J�,H't�c*�jE� ��B�3�D�;�!<�=2�gr5o�-��`y*�|aW�1;]�R��-B��2�@�����i�^F����4ߕҬ�"���F�~��T������v=����k2��*���8vC��xȖ�=����/@园�rJ9M,P������tYK�P�+����~Y�� �B��Rއ�'�R`�;�;k���"��������U���e���F�%������L��J�ѿ��V9P�� o�Z7xa;l����~��&����`z��M�MUG�.�Ҟ��&u(���9P��E��Y\���`���^�3.��8���D_����.\C���L���.8��n������qj�kh�r_��D�Ǻ��L�a�����t�#<��&��t2��ɾ�L�8����*y��*����$e~�<s�})O�� �oV8�w�^���!�X�u �'�=�ǽIo����,�, �(������P�2�>�@h�����R;�1�}�T2[���YEOF�]jILm����_s���Bhy����y+I����҃�5a�&#皢#(3�i����Z�²|��"���"�x8��a�Z�N`���Ao�{g'����i:���{���`qI��K� %̊�,E#�C۽�F�?�v��\�V�:�;y&"�d�=xF=I�O��#Ĩ��")W0��-Ϝ��9j"�c.�Ռ��9�R���s�5U7Ak�!^N�r�Ay(�'�&J�)��y���Xl�}9����~it��.�(�3:�j?^����ŷ櫃�tz,��U����;;�Q�ҏ|�!��Z$�U;���o��֓`4w�j��u�Ú����L:��� ��²X�&�\�6s�`:��P��AH3���_�x��l��Hl ��uJC8X�(�]ހ��&E?Ėt��_�B�v*Ɋ�#G��~��.B,��z�O����7��Ě+n���tW�O"]ݐ2\�Z'��}K� >�bG$�D��vP�h@�}�gsw��=��n��x�s��((�tY�]�Dr.�/C7��γk��I�hT� A:F`��W-�<��.7���X�g1����l�u����<��4i��@سRH|����a��tߓ��c�yW�,�A
Behavioral task
behavioral1
Sample
3f0a7e21c3f0b409e6f38817e2c907a3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3f0a7e21c3f0b409e6f38817e2c907a3.exe
Resource
win10v2004-20231215-en
General
-
Target
3f0a7e21c3f0b409e6f38817e2c907a3
-
Size
7.2MB
-
MD5
3f0a7e21c3f0b409e6f38817e2c907a3
-
SHA1
73144a6aaea4b8fb3cab5bf6b2c0b6b3c5f0a082
-
SHA256
8d162507ed2aa6c181bcdf05c141a0ce52cc1dd2db253aa2bf96fe3792f73681
-
SHA512
02fcf9fd0cbae14f64c5288875242a83edebcdd219c44444a25bbfa166844c268d9e3cfbf2e71696416f4afbacb2cba3bed9621c3af84f97b1a718ed382c8f21
-
SSDEEP
98304:aieXXTzCsr3rxHZStHVS3fY5Rtbs7YyuFmaiqqUgh7MaWSMJvHQRZPvMXU00qdpI:qCs7xEHVSfY5jLyuFma5Sh7cb/YZEU0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f0a7e21c3f0b409e6f38817e2c907a3
Files
-
3f0a7e21c3f0b409e6f38817e2c907a3.exe windows:6 windows x64 arch:x64
bb9bc237d0224ef156a64b3d8468260b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
ws2_32
htons
wldap32
ord211
crypt32
CertCloseStore
advapi32
OpenSCManagerA
kernel32
InterlockedPushEntrySList
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadIconW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
dwmapi
DwmExtendFrameIntoClientArea
urlmon
URLDownloadToFileW
imm32
ImmGetContext
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
UuidCreate
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 861KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ