�B�0�LV(g��q�oӻ���Q���<���F\��\udO��&�J�ܮ���b�C��*�3�$u]=��q&�J�P�bZ�����Tf����7�k�&P�;����s�0�|������l��n�֊�C�YCp���ʜ!�y�uZ��}@fW�u�O�e���l�LP�ڢZ;�YBM��I�Zϝ�݃���2�_<����@���:%�c��pHw�����&w7*�T-Y$J���+� �΄��\㖔��!�О��VA��p�\�v_��NL�B{UP�մ��V�a��M=��������O��ۦ���<"��~�:����7e�R��B�C>��b�E�y6_3�#,je:5Ô���`C��^�c��c��m_�M˖c0-�w�$���7wi�ٵ۠�K@���|�;29���9{ʯo!ֳ�\l�G�F �M�g4����p�P�]O��/w����ε�#x�B�Vut��0��Z��~y'w�՞��GP��C�.��D��f'�����$��F�2��u�A:����.-�ӝ��$9jk;oK��A<�Q8��&�/��P ��T'T"-։�OX�I��@����G�?��H;�@� n��β��V�!��n؟d}���M�&r�����]��a�_�ǽ�d�[ꈕ���'9�� ����țL8�P��4��5� ��rʦ�,���,���f#�y���m��S! ��ꀌt�trE������g�U�{ M l�9��d_)����Z�ɘUb��WMh7\�g�rr�������ĒeCEL=����� �� �f��,�'n�F+�7X��Y�6�� ��ɿ��<{�b�}�3�CiKgG\Hb$s>�XR3RS�3D�:�A�*�*�R%�ͻ��% Q턿��������:z,�ظu� ��A�"䚊�(�]��D��tM�)�K�=�� f8��y~IZ��;�u@�Tv�Zj���z�5**���R?� ��#��r�$�o}V[�l ��ˮ8��Q���=N��=�Z�?�+��u8�N��y~�X��IVco�J����q�G]�W�S�^F�'x)��� �p������N���j�$�t��g�Ҥ �9~�FRyK�N���3Y��ȵj,���i<y$���Ҥ���?�}�i�>~����U�t;��{���x�Ά4��8�4:�� XNFic���v�5�sw�qj��� T��of[�)0�A|�����C��*8.<}��x L?�6^)�fj���S�!BM��W��b���K_��m(z�X,C���sw� �p��mT3|S@�^��tu�I)�;���۷���-cf7����ԞXx?2i4,Ab�R-#�&�P�oڊ?�c�S0�THol��X�.6ћY;��9���)*�91C[ә6Y��7�G�j���ɶM,����w�g���%����.T��?����6 ���W����uV��+D��8B��|p�(��N����P*v!��Q�)�M� 9"���?�o�.H}����!8�G?����vc?%����A��$V�4���"A��XKb��x.u��g@ +͂��n7�#�� <�d����;Q�E}|/�J�{�:��j��`��f���94(���.i�|j�h�R"�w"y?ʖ'&;�����s@�?�,ǔ��V�0�������{nx��!����*��R8&v�-���!D�&X�*~Q���9ko�Ft░cM5uЦ�:�{5�C�=Y>i�n^����-^s��"R�]Ļ@���"�P�y&��,+�Lǚ݆w�o�����l�Ԅ)6��#��.��~H/r6DH�V�~Y+Z�T�~Nφ�}_���l�_��eV�D���ŹB���,�c1ڮi[ ���e �E;�<��İwjAik9U��9��M>�9�T��1 �k"WmIk����7 _IF\k��kb48�&������c_`�b(,ʠ<?u�(�D�K,8߾4�Z��Mg�#F�j�]������d���$�ĵKxL���-p�@ڬ���LEiz抚��F������;M� ��$��ȃ'�Z�X%^�AӐPd��թd��G�� ����������[��?���>������jO��@�oږ�Ù)�boO6�,�#egwu�9��k�Ǐ>F@s��9 ސ��U�[��n��6w]��<�����<���n����E���b=���C���o��c>"�cԃ��W�+�������\@�X_�<G�<$Ϻ�i�Ur�IHi%�f���B5S����>��nw[99�<J:�p��E�[_��i �����Z*�W�2ؕH��:,��oj]}��*����vzX�2����Q֟9�=�K�,@#���I���"�yo����et[\?���tpY_�$+v��mfle��éy��8��oA!t+x<ާ3U(s1�>̴�s��sg�ѧ�7h��8&��]+K��$����y��}���ǐ���g��Šu��� js��B��"\kpʧ�E>lM�GW��N'���^G(jI:<�־sk��Ǩ���k�l���0N��a< ���7靃\�ip�KT��϶7���$�����\�o�K�C����{��Y熣L~��T��^ti��D}2�V�Ec��0�@w�o<>��������_q� �Y�SC�����:�p��E����I�m����I�I��b 1��#���������f�9)�)���ESs�7c���g����:��n�f߸$�/3���8z��k߬���}u����B���5+��""�B_FH����)�_�j���P��ÞV-�x��PS � �F^Q^��)��S�OZ)�|o���p`�H��C�3�Z�$��0�a���kL����l����}�VT�H!Tu�u��_�e`;�[ɷށ̔F���rkv��b�J�0c�Li���&I�7q�1�Yx�=�O4p�i���_[��¨�U�i�/�^�����4{�Z�3j�i�������+WwV&2#�&����2��\v�eň������������O��qɴI�]�+Ip�U�"��,�(]�1,
Behavioral task
behavioral1
Sample
QV3O9HuqZX.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
QV3O9HuqZX.exe
Resource
win10v2004-20231222-en
General
-
Target
QV3O9HuqZX.exe
-
Size
4.0MB
-
MD5
f470bd2714f8402cf17257d5dda74868
-
SHA1
966c9bc633362216e99e6033782b63825dd6c8a9
-
SHA256
e5d1a89a2a3ce98e3f32fd21ece77c4e1e50797bfe0a3e2db757eb6be97a5521
-
SHA512
e5a7fc08df4e7281539c69e16cf4ed16b35960e43689659ef6465af6c780d8ee6bca5274afbabc223106bf1114da61f54652ea7a79fffea6c6adc841fe6316c8
-
SSDEEP
98304:ifkxbDQsxkspBiB8KmdGqJMGFI9lPcYdX:ifkxbDQsxklB5mT9FIM2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource QV3O9HuqZX.exe
Files
-
QV3O9HuqZX.exe.exe windows:6 windows x64 arch:x64
852bae4294ea19cc0fae8d9041e6b15e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ResumeThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
send
advapi32
CopySid
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 353KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ