�1"kp��̣� ���ع������z�NT,�T$l������k� � 䤟�V�)!�i7$��-}�5 ��2.k �g�%%Z?f )�A���P?��d��I;)Aͭ<������[�)㞊XMl���ۈ�+F�i.J��|,ɒF�}X���7t{�rq,2%y��R�j���gr"����@�V�g�ق<alP��=M�{�-��5���)v���E���z�A>&�Gu#m�~C��js��6GY�R��+"�ϔ��l|���w�\�H�ϚYh+\2�.&�IԄ7k�Z�I���p0lӁo�2x����8��� �?G�Zц��zOYY���<�@��\�.���iFK�Ҭ�İ�u�������a,G}J��/�,�a�pW��@d�k�>)�`ר��1t��6Y�����_0��#�!t��袬�$��%�[�[�ܚ���h�3�WJ*4�����"nJ��MI������蔿��;�7'Z��`0�=%�u�7cA?,�~�7D�){�S�p����w_�} y�>Tt����I�����ijxV��a%�T ;���E��>�0��N�'%�%�"Y��q(>擐{���Vׁ�%X���Ġx�a�8b����=\v�=a�qD�@��P�������l�m�!Y$@�P�k��+�<�җ�jyi���W�ug�D��X�b��������l*��Q�o�w��U�dS����~��E���n|;��܌o���X����ަ��/�cH�!���T�_4P����>Kb>������� FRJ���ɱ�Ǥb��W��0��I�ñ��ˍ��T�{��Pm/�� s��C�Ờ7ӈ $�c��X�C ߱٪�.����˞�-���2�ic��hu�U!"KX[�c_�U�e�?x��\)��1?�y�:@�I壀vHo��4�� �,�^{��B���q�-��z�m1� ��ڦ�8k�� U'����K�(��l^c���F�Ȳ�t�o�����hʃJ����CaQ�n�)(8sZl8d��NꐈuF�l�d�ky�mS�~|:ug�~uu Q� �l�-�s:���F�AW�i�8b_����4b�D� �Ql�`��w��C��\�j0�<�~s��� (x=��=��c�X�j�[�%���h�:�Pu�Z{,,E��x5,qBS%0���]A!�"�,��G�Y���ģX(�ɴ�A�`�F��Ze��҉58��F���?�����ϯum��÷l`@�=�:��x�_�3�O{� nxF�m�,Ps�[͉�J�N���ힿ�AG�Y��e�.�T�~������+�)���a� �Z�- �Aр~6�T<)�o�i+D�-c'�o�p�*A�>Փ;��{�)|��4����g�5�L�����z������l�Ŋmֿ�����N5����%"���s*��$���_���:[���� Ug^�����gO_E��)�J(!0M��c,��>��#��MY�FwuԼ{XXC�������G"g�=�I�|��8��&�'����<yd���7��D��k|6���#�Lz1�ߑ$pYզ� s�����<��ح?� _9Y�,�a�����l�m"cV!F@d��z�Hݫ6"X1����R ���QI����bT�A�G`�CNT��D�ǯ\nj�W���"73N��A�)B*&�����B@?��ֈ��.p�/.D��^v ��0���z� �<*�bB$d�f��,{�PC��r��Ў�{~�f�o����*%fR��R�N��v����^�8AZN$��`�)��@��l*���I)�����C��� \��v�RMz����C3`�A9ە���� ���KҮ�Ta���e�9�0'�!�� ����Ssq��O�,|/������&�Ro�as��ʜ̢�=<*6��J�G�N��<҅C��{Ԅ��wv�x^N!�h�dU��S�����_,0�_�=R�f�!h��6��%�ù;}2 ��"e����*�~�����JK���K�d��1�- �Ĵ�����NB�P˫C�<�`|p�����g4zA��:SƕE��[<��{xĉ7�t}�[#�(�i!r;�Qĝ���v3�IΎsc�_qj(��J��Б.N��f �v���d�i����(o�vID�&1=}3:Ǟ*u2-��"f��S?�6����NԐ��N�������c�h���+ ��������F��q���k��"<|d����Q�)&tF�Љ0�&�|NZG��� ���������=vx��k�P�f�)�S\��D�e�����ѳb4]L��K�Ik��ӀGWo���E���aЖ7(S;@����5ꩶ.�\,��$��?���HE�SӖV���{�u!q�!*��S�ld��`m����FwC���VyQ���_w�v̝up�ɳ�M�5Њ^A��T?�-�`g�x�%�;����Tȯ<䔓���� �^rY�S�qSo��wG�b�`[~��� �����[���W��H��|�T,��y�� hϚہ�&W���+��R�5�p�-UQ5����?�wg==i� K�"��F����k"8,�{J��`��P��u+�I3�������~3^�zb�D�Ʉ�vY��} �Y|�44��F��%_D���2VS�t�8%�pӣJĻDD�������{ ~U��x�6�mV���� ��jB��_�߱��ͨn��\,m�7 {��5p'&����a�՝��_p��30���; . �����ˬ�-K�GZV��W�����niQp�I�樁:t��fYT%��7��CM�خ�9,M3�m'ê��̋Ϭ֖f����Ů�>���6����#��U�.�$����"��j�Y�=�pA7Q2[�u�SV !�,�9�h;�MFΟ�`]�a������݂����SK��� K��Յ,��?�d�\����d�E<�YD�H��+��r� �0�tm$�X�6��h8=pmM%}��h��bQ�B����Ĩٰ,E ���x�C���$���ܜ*��.WW��=�����?����� ݔr! ��CU���zߛ|�+�CVf$�l:ܮh�*p\�o;�-���=U������S��
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20231215-en
General
-
Target
Loader.exe
-
Size
6.4MB
-
MD5
b9deb9a70d187dc7d4937432e0e29bfa
-
SHA1
140f99531e118553a41c97835dbb9258070d00a2
-
SHA256
d62328ce4e07d0585c7a52dd7dd3dda976b7a962e9b3984458800e4bd484580e
-
SHA512
0e65b8a663829134241e25a0893c30d048d8a74c0cc5af9a2da89eba82e38f10ceb517f08507a7e67e851bb287e62184c1806107a3a721588a1d0fe31f014019
-
SSDEEP
98304:qpBpEPW220sG8VpVlo0PTOlREKW1g33WL6j8jM6W7V27SCHu7we4EF2:MDssFnoblfhHWLSl6WQU7we4q2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
23e2906a0b39e81e50aef8fb579cde7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3dx9_43
D3DXCreateTextureFromFileA
kernel32
PeekNamedPipe
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenSCManagerA
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
urlmon
URLDownloadToFileA
shlwapi
PathAppendA
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertGetNameStringA
ws2_32
closesocket
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 605KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ