Y7�B,#%,�f�Bo�IA�R��ֺ�/���Q���}Pow�"W�y�/}���z�u6'���z=�3�}M�Z����{���̓���.k��O��Ι��{\ �#[���N� <'*f*�<瀜Y��I�>��Q�b�4�f�up��#�1�O�_f\~����R8n��Da ������p�����{�P�(�Q�z�3("���lB���=�K� �����xdo�1�|�@n��'%�rХf����Iڊ����@2�gS�g�����1D��s���6��Qڮ�P+�<�����6�$����ݠK�acE���<ތl��D��A_�9H��N�N�>d�c�v�� 7�?�hqHp@��h��2`v��Aa�B��to}��t�W�^���aF�9�Q4��VH�eэ~z̨�&�{4����������2=��#lb�o��Uk �?$qEa���J ����aA6�g߆���`�ܕ��#���/`�+�K�ޅ����7�R�[������k�m��GMBs��E7��0�{�!�L�u���G<Z�n�He���{����ƪ� ��߃�y,!D��W�{�Ō���v;�ܡ�����T25.�)�Q ����J��8 �ʫm���Wb�&�T��B�#�v�����������V�8)�O�́��.�bg����(�/���٤��s���v� zu�v�`Q�wׂ����#��-5.�$R����|L��h��נqS�-���52�癶��v�H�ܖ�Bͭ�%��Șt��{���Uvs����'��\Oz��l�"���zfx��pE5]�lCb�m�r�NI�Y܂�h��w0m.5��A�Z�Et��e.�2}S x�rC���s�Qw~m���zR,��p�xo`�P?jWh�Z��Y > x�w�u�Z�n���PwOY8���Ж3���3Et��o����r�8�;�b�_�-� �w��4�(��_? E����V�-� �N� �D6�Q��"7�w�=�����Y@ �(-�ߌWM �Cρ�^�.iA!����hKR��}�kT>���(�zEz��Lt�E��]�ز�-��ޝsʬ$�l�����\mjY��DA��c�G22������u�����L���G�v�r���q��[��!�ָ!��r[�\�b����ϝ����'��0���![�����m����"���aI� z��K���,vកsE�d�Ƒ'�a�ʮ���N��αJ�*g�=J���s�#��Q�1<�^<�E��������_/AJ�T����݈C>|�(F0�ד�\b���j]���k %�I~��DP�٘=!��>qq�p۰3�r�������U$)j8}�>KpԤ�nؚpm]��3����k��:���AK�â�`7�f'� �j{E4�ь��:D�[]��^ߢ�?�ۤRX���w;\���Vnh�5⌝�˯|�/^d\�����19�W�o�lE��f��R�n�{����*�Nx����P�1��y���W!�Ӱ���1t��n��~��-��?@@RR�6AR�u��8��&쁶��*��a�Gj��֢������qtB{��S��>#����z�[��~�%beҝ��ev P�Z�?]�+P��aEO"@m�1(���e��Mf�4�� �|IDNah�����M8 O}L�M�57�r��|��NYXD� �aT�m�=�Gs��;4��vg�H�}d�PQ�O��i�ap�K�@�����9�pU:w��P�U:K}w�]�I89�]��{/�OLp#��LA�SU��Ӹw=�b��>�=M�7r9� iXJ 4Oj;�s͖(�l�p�����b�����շ3+�]I|��=�x��+�S\�������Β�����!��d���e.&ms+a�������3�WWWeW��)o�!x V���s=g��������G���s�����پ���K�;x`��c%l������#���z���N9�V�s���dw�?G�Qv���y5��Ky�������F���鳡����Q��ċ��\��z�/��@c-���~�����^��WP��� �tfV���]E���T6���*��t������YM-4�m-���d���8���ٜj7�,����9]�Ё��]���#��egڍsH�����Կ�l��d�UieW���6�_�#J��@tO��3~A��xI5c�XC'�#�x��*�,��F���qn�}��Ԉg�kq[��&f��6p4�VCq�^��7ۙ�1� p ��%}� ���w_>��9��/F�]i������F���(���}�f�3�r��j��WO�趗[�}���Ȁ�p��!� _���ĵKݎI}��4�n!4T�0G��M�����[jnh���Rh�2�I����T�!�K�r��A�Ҿ`2:��o���K����>�'����Zd�@?�JZ �fc���xޢ/�s�7T:x���bX3k�f%Q7:'��]�����3����忊��w q���� ]���?@{�ͨjB7Mo�մ�X����W��:"�Q�a��^d�������)��x������|,p�{t�ˢ�j*|�S�sr@�8�P��mL�����p d9A�L�X�j���(<V�\z�D��W�e�㊠3�En��P�қ_@�"l�=�y�@[?]�M!?�n�� cp��>HKE�Q�H���:�lw���?���1�5��̲@�6c�R��,ۙ9Z(ɔN��L�p)��0e� ��O��8�ѥ �r����¼�4 ��Ob�Y�����\Β^aH��~�Pr�P�GF0�|*{5�ә�/�Q�c&f:-���:Q����C g��k>zU���к>��f�g=-�`��E8�9���6}�z���r����ag2D9�w`q����+6���F�)?-d�LUX�h��s��[g�3���MbV�F�kt2n@��8�m�n��:�i�����N����L'fo�X����������K*� Ȓ�"a�1@8��J�?#N�Y��Rug�dU�+�s>c���}�)6��o`�F4#(�\3��녞f7���*YF��x����J�D������8"s:P��դ2
Behavioral task
behavioral1
Sample
6b918b846b891f32717e9c9c22526624b8743625f48e1651ff9b4b2222d6d0f0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6b918b846b891f32717e9c9c22526624b8743625f48e1651ff9b4b2222d6d0f0.exe
Resource
win10v2004-20231215-en
General
-
Target
6b918b846b891f32717e9c9c22526624b8743625f48e1651ff9b4b2222d6d0f0
-
Size
3.4MB
-
MD5
d0e24a41c92c5a416111bc6578ab5950
-
SHA1
e8b6a01da5e9f7ee6fa0261582952db401175118
-
SHA256
6b918b846b891f32717e9c9c22526624b8743625f48e1651ff9b4b2222d6d0f0
-
SHA512
a793e293f719f8b57101b61dbbf35674dcfc37e6ddf275cc8bc10bdc854522e4b44046f14ee6744612aa894665d325c84b2236682d67ceb5c0d9e02973499634
-
SSDEEP
98304:gBXUH4FHThja6NirXZjjQdJJqlQCWp4PxCoKhhsYQlKQ:gBEYhpIZjjQ/ElQEPxCGPMQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b918b846b891f32717e9c9c22526624b8743625f48e1651ff9b4b2222d6d0f0
Files
-
6b918b846b891f32717e9c9c22526624b8743625f48e1651ff9b4b2222d6d0f0.exe windows:5 windows x86 arch:x86
999ff16dbaf5ee7d2a9074c8abb154e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MulDiv
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateDialogParamA
gdi32
SelectObject
advapi32
RegDeleteValueA
shell32
ShellExecuteA
ole32
CoTaskMemRealloc
oleaut32
SysStringLen
shlwapi
StrStrA
gdiplus
GdipDisposeImage
ws2_32
htons
wininet
HttpQueryInfoA
Exports
Exports
Sections
.text Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 571KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 270KB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ