g�s�oݛ�^� ������h!� '�Q���$s��UmIC�D�$7�Q��RU�#m����� ɼ��z��E �� ܑ���B^�[b���+�)Ee~1C�*w���<����Lg�w�������+������Pg%�>ꮀ >08�T��Xl���z< �5����9��.67>ʿ�7~��k�s��\�q�"�8�Ǩ`��4�^��K�ҢBM������\on������{���5����o@,��'�u=A[���hq�խ��z��f,$�%B�<pR|�HD�^��O�3�}{�w�ЬȾ�{��g��_��vQ��݁�n��y�h=�3PQ��|A�"��G�i�?1Rq��=��JQ����{�?Bڅ/7�=?�'�/��;�ś�z�����S\��C80�$�|}Y�w��ܳ9��52)��]��\�y��ϻ|���\Z�U��Ç��^�aAPy'X47t�c)<�O8�����?��)�%�Q�W�|�;��]ۣ��3��mYH� ����3!b�_`]N�)Bq[da�` ��� ߿�οOE�����?�{�L�e�o��n֜����l$�+ ��L�78����$uh������)q�M2��ǎ�LP������{Zr�}� ̟���������p��ɑE���]}0�?��s��V�L���Y&q|�E�b �<> �y���-�\FQ��T���>�e];F-V,!:����X�Z�#Z����b{�$������9�}���1y���ئa��ڝ����^�����?���D�: �����87��׀���n�l�W&tnڝ40'���+�>[�9�X7�^4@A��i{!�HyT汿�����YT�n����Ȏ�J��|�^6� ̟��ܭ��K��W��n'�i&���������iXb���Q�YvY`f��k'����? ���e^_s�(���G�/Ŵ��2:-�<�%� ڕ?����dX�H0�/�19�#���&)KA�]ɿMJ5�YgQ�� Q@|N4C�3c��I-�,n���Ү�ٿ�E@k#�$oz�@��c"�$Y}_7ӄ<`��R��bu�Q��I:8c�d��ƾo�w��]����n#e�ʂ�Ig+�_���r(Lh�s,F������輽���E�8w��m�g�UШ[����%ed��d�y�����MA�'�([C�(FL\4$�pT~��?�A�R��ID�����F����!Z��m$��`���X#.oϒl�\��\VY�nl{P��O�j-�A�Vg�u���H��f���B��u����dQ��(@H>��+�LX�ߖ�����!��EӸ#������l1"2�-�;�>������歘��by�����`�6-=#r��b#��Q��E��a�$��Ist��Z��{���U�b�����Y(�"�Os�����.U� �.!���3`�Q����[!���7�rY����O�^��#5EH���NB׃�X�ǔ岒��z��ai�l�K��v����n�� �y��?�J��א̾!��x�O���p��dݘfn D˯^Ž���ۢx|��,j��'y<{:�f�l�xF���I�5�u0I���� s;}�g%����PB,��c�� ݧ���&��Ju��0U-U�������]!B���p$�]�6�=����0�9_N�)�Qǥ������������Xj��Λ���J�*o��9=!*���C9ڞ���CX�&����C���2a�^ �#�8� ��E�u�+C�̔�T�ޥ�ζ�+����!���D�;�|��O|p7���5D*q[���'�x��� �9��JB���&Q��?�PC6Űp�7��7j����N���\u������㻁��n�7�M)P��#��(����BF����,EC��rK��^�w�?~�q� 6��pt_���� Z��z]�q�a��;��L��9j��:���~V��#��xՈ�r�|�p��H���T��������c6��l����2{P��A��x��)�Z��L��}护9dz��8��:ll�{�R��\���\�ÄT�����Ѣr�0��3U]r07r��5����̘��~��� �'�73w�Q+Г�UM�XS�͒�{g�)*�.qٰT�i�T�+�EZ����z�G"������ԅ*��x/��+��? n�������������Þ3��{�D �_�z4��j�'�����"?�Q �|�����E������Õ����w�.� �G&� ݑ���4� ,����� ?�0�WN4�`̘���سo�Q��tqlb؊�|F& ���)�m���$�^�"�@Ǣj~�Eԉ2�;���v�.�e�T�]�zNS҆s���"�{1Y�잓����-[��D/b�@^�Qb�טDB�(ʈP[�]��@�����Q�*f_�onx�������'��ʘ�B>��(H��=�]�0��HE��O�b��;���$Ŧgj��c6^�!oa�� �a=`��pK|Mt,�+s�y��G���;��%��_D'���=e�$* 7r�;�엂���X���qt´�.>����o��>� pꢃ$Dr-��c蔐/$��4�T�fW�������������~�#C�dPAn�uWތ� }��g&#~DW�ay�L���J��]z��)C�Ɨ��Tr���K�AÄ���E�^�|�����4��� �-p����]��φ��ףg��_�-�!Hu (q�'��g!�i����J�HV�YHZ���� �I��r�E���UB]<x�XytF��ۀ��+�T��W��`06�U��:��5;���W�[D�6#��p5�J���5�ۮ���s�p���Q.��bA��]�s|���#�h~��^�\o<����h��@�M������6�)�7s ��k�@Y;��sw-�d)������p�֤T�:w������x6.�w�o>"Hџ��8�8B��݆��v~*$�R.:���$�U�$��8�Rwȿ@�(�ǘ��-�7���g '^d�&���z�yKK��3D�1C��(�W��m*�p������d>����jP��ϳ8xp��
Behavioral task
behavioral1
Sample
b1ac5a78595b3161a8ce829d6295c5ebd400a96d4f4b4b4360979a20416b7c57.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b1ac5a78595b3161a8ce829d6295c5ebd400a96d4f4b4b4360979a20416b7c57.exe
Resource
win10v2004-20231215-en
General
-
Target
b1ac5a78595b3161a8ce829d6295c5ebd400a96d4f4b4b4360979a20416b7c57
-
Size
10.7MB
-
MD5
e50f1758c6432c818ace005663bdda95
-
SHA1
1d48719fca4cf6da9814027794ecdf76ac01487b
-
SHA256
b1ac5a78595b3161a8ce829d6295c5ebd400a96d4f4b4b4360979a20416b7c57
-
SHA512
5663e7cdabe626ed3d468a95ce785538d2248e247b26e50a7bf5c86383b7bff44be3c5af048cdfbb398b98f6ee39aa13fdc5dd926c6985f276d3fe685834f19e
-
SSDEEP
196608:R7kr4rWHLpwWgZhK8R7wxlA7kQ6ZTGsdyeJ4Wq+rDSqoHFRVsX:R2uWgZc8R0xlVGOjJvkfsX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1ac5a78595b3161a8ce829d6295c5ebd400a96d4f4b4b4360979a20416b7c57
Files
-
b1ac5a78595b3161a8ce829d6295c5ebd400a96d4f4b4b4360979a20416b7c57.exe windows:5 windows x86 arch:x86
f94c5eb4549eb8d75ff1083338e6e89c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
qt5gui
??0QColor@@QAE@W4GlobalColor@Qt@@@Z
qt5widgets
?metaObject@QFrame@@UBEPBUQMetaObject@@XZ
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
libeay32
ord492
hidapi
hid_init
msvcp120
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
msvcr120
_fmode
ws2_32
connect
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ