��mQ��;k"5'���<�LD�\��"/���|��I��R�^'��i�E�F�]� Qn�2���B�_I�i^��s��������ii���MP�T�D@p}��n��)[��>�J��^N%qۘSH`G@)��%]d�p����,e���c@���OZwc/�a��s�yaakT���dL�Xr������5+�8�"��bN�T:C� ���G�*���>�"ٖt�G��g,i��3��:>�V��eM��H�С�Ry�w�(xB��0��:\$���r{���z�x�k1Z&�����?�#d�,�ڑ�Pi� 0<M����nw�lu�Az*7�3��٘N��P0�|r�x��aUZM8�y��l��.1��`��_c)��U�9�� Q�g����yg��-]��w��ɷ��Gh�B$H��;�;�I��]��m��ۍb�yˢ&A�+>�6Q�D����=�/Aٖ�V'D��}ʞ(#bc�ƞA��Y�=R�ݪ��D-����X6�dG1�� �I��Gb��́���z�ѯ��C�B��;�������\��B6��>��,�XIV�F1u�I[�� ��,��H3,��g����f�4x��HJ^?��Ues�u�ԉ��[�o�g`�uFz�����Z�۬��k����WP����68�xT�[e� �D�S� F<�����g�n ������ �GU�F�v�:s�6�Ġ��X�`tb����m�F���Ap�`�w ���\�����Ȁ���W��us����"�p���+��4��*ǐ��t���ɕ��bZؿ�D�O�P���C������ǸV{[2�;r�Y�� 螫�A.Rh�c0L����vxp�϶Ap-L�;O4`)+�k\�GQzӘ4�Il��"��56���F}���4a_�+��b�E����K��9��NB��S��`�l����५V2g����V���Z�%$�u]ן�u��QF�"�lB�דs f�8�chw��I �Ҝ}��-�L�dY^�:#������/�� �{|{�RQ�� Ȧ��2(�R��"�5�~���~�J����p�d�p?�W�g��r�(�p�(��G0?z�M] qV�AѷS��XB��#�+�+~��^� �q��� ̖��$�� r�h�LL��ؤ�A#�No�q[�S��ܠ���M��6�8��z}a��n;��Q+�X|��5�2�W��K��&1�iJ9�zb��{V�"��)>�nT���Y?�Dj���[5.�$�����GWب=��gT��t�De�Z��M5�c�&��-��*�/��A������?p�.ct���kV�ud�{�Y!{��������E���;��y��b�]��C� ���<�\J�� ��[� ���4zX�i~5y�����Z��B�I{��G�<�`��c�?Mj�׃6�6{��#��:�/W���m�xh@Z�==�� y�h�dH����{&Њ��RW.�Ǧ�L8*�rL���-'�!��-����o.�����Ik��ݦ mQ�9��R-�V)�q����;"m�~kf _<u��Tʜtv�����t0�?''M�x���}=~)ȇ;�v��kF��xyc�=��ּ���S���홥�*c����PA��٭�O�2HM��&֣URt������]"�joW�@�����V�����2zUB�>�`<)��!�D{�G�Y����yХf��S]���%mQ� ͮ����Y����"�����ꕪ�O�:��Fu�o'��+ƨK ��V�h�d�<l���I(�gN8 ���¯�&*'�7:Y�}|t�l����XFq�k6���b�g�stZ n��^Ђr�+~�tx�'ɾ�y�]U�R}��`�wO���%� U/����?B�gYމ%����q�5���Y�\���]�uK�E"A�(��ܥ�X� ��ݺi�M�UIԽ�UʭL���0Z�y���<h�F�1��&�{N�Nm�} �4�@}F��v����e���Y0��HŞ��S:9�xw���r���c�p�-�@�[o�a������r�̙M��ttn�8 ����j�&[d$1�-o<��ح�M��f��;di�%A���{|j#9'��t3�+ά����o�bH�\�7�7�Ĭ�#�=a�k��*�Q-h����~��=�0��n���WJ(�x4���U�����ޅy7���3 �����̷;�S� �<?�V��f� 3I�2f���NR���>����b���r����bOC��Q�ݢ/����ٙ��A�f�U@��eѩ�\�@��8.�}8�y6,]�z�0�8'#/<6�8C�c�n8O�~Z������@|=���`=�iW� �?3��- *I�I��^X�=t&C�9C5���cO9�;_��z����Z� [?U ~�Zq;w��7����L�_��L���k����~!������ǹ��¨Z��>$!<!ʏT���a��X���Z��]��愮� �:��`��*���x�TΑ�/V��m�F�A����F�3=��3����$�{��,9�M��;�� ���k��D��7s�A}k��ݪi-с���泜0�yLo�^�݀��/�S�~�w�O%�b�<)��M��%�����F $U�݆i/P��f�H�b�z<�)V��mH��ݱ1,�mt�/l4����e����+ x�'�A� �$<��*��� %^Nߩ�E�θEMB�Ma����e�z��$�Vz�24��g��,̻��]��������Ѩ�~=�r���v�>÷V�m��,���=��z��)����}���/eZ����t�{����F?�m���?L4��g��zKn�[�NM~3��7p)��������������a����g�aLp�q�#(�HțƴJ�[&����;x�;8�g�)���0ҵ~e�p̮/�;(D��ݴ���֕4{\��qٺz̿i�ȇz�J�v:�U�$Ԏ{�Y�O~����H�x2��/i�Hc��Px�-�*�&g���y~6� ǎ�+�I�,�_�S�uM��:6sZt�u���tG�(����50����a/����e�"���ם���9*Kz�
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W64.ABRisk.SEHN-4312.15067.11103.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W64.ABRisk.SEHN-4312.15067.11103.dll
Resource
win10v2004-20231215-en
General
-
Target
SecuriteInfo.com.W64.ABRisk.SEHN-4312.15067.11103.exe
-
Size
5.7MB
-
MD5
3ef712fff55786d9c88e438c0e9b64fc
-
SHA1
999447b41a54b3ce86d1d04e18728d28747ff495
-
SHA256
633edf72348a8f439dd839054c4795578c8c055b942004fef61821047de604c1
-
SHA512
707e84dba619e4a6d1fe62cdadcb84adb62ce9ec7175e1df3c20da2498ac3c46f5c2b43929b510d3dfb1b8cb5cdbeebbaa0dfa1ac5c0d21801930786d9f5bc63
-
SSDEEP
98304:gr3SCHQHBwoGFNRnmBkvDOaOizE7deEjNX7z/Ic6qg5CIuFnoQQhk:gr3SCKzmpwMyFiY7dJ379+AFn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.W64.ABRisk.SEHN-4312.15067.11103.exe
Files
-
SecuriteInfo.com.W64.ABRisk.SEHN-4312.15067.11103.exe.dll windows:6 windows x64 arch:x64
d3ab2cf31941bda21b27cacfffc18c55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ