~Qw���{��?|5�Տ����{ċ��EP!�|�����s��.AV�3j�����{�A�_���{^?<����xr��>���B`�=��y��R�$k � i\�z��nKdL��2N��Z�KE����ي��tn憗+b�hG������6}��eP�z�fi��+%[�����"R�M�^�zqr�X <�X�\�>5Y�R�z�$���{KJn��Xev]Pdoo�U"r����iQ�����İ:��%�ti�����=��J¤�l�x�������R�R�ӓ��R��R��}���o[2l���?$��h%4��(�����[��lJ����N�E�G�����++��B ���t\���?�0���ħ������Ā�rMTp�WР���S1_�1��2��יO��,������*g������Lؓ,�����)\Z�Jo���_�� 1uh=3�P �t��$& ��Թ��S����2���1/� n�����W���7nX�BW���p��{�`�ih�D�~YBmm��(�ӟ�d�N��қ�����(�g�)PH쨽H ԃy~��0c�� ʈ�xo�N辱�+���'�W���4�R��J�c����>��&v͵��1��X�E98Q����\Ve�~Y��=��}\[�}���k����T#O2��%bc.D�K]D���~�]}����Z���c_�K��-o�Nc�'7�fı�ω��gm��E.����N��,9x��:��]F��)�[��$���5}�_���n�n ���E�Hh'���v�h�?-�܀idx�>w���j�}j笺!I���'��b(9�u<&���/�$��)[mޮ�#`��͗�sϜ��&���h:}��I �G��᧢:��b�;���mn��V�VR�/�x��G����KU:���1N��kKۆ|[Z�����G�΅�w�P�>9]�Q��GF��3�����Έ���3�� ���)8seQ�%�Y�JTlOu^��ࣉ㻹����a�@�Ҕ�Ϗ�"���\"��IN�M�g/2�Vgw��?��]�}�珩%��F���H�hgV� W�,l":� 9R��7�j��J��~(�<8 �r��$��� �$�����>����ﱖ`�P�3J���Z�B������~��� ˀ$�}��Of�r'����7YQ%��.=h�%�r#���`��4�ӹ�;���g;���`q#�� �c���|tb���8�U��Jc�-���cF�sߡ)��D�0!�~�}_8͈���Xr9�;V��>L��)���eف�`��ǀg�1d 2J~~�}-r>Iܹy�x�o��zwܤ���F&y�2�����nu5s��s3�� '&��`r8�Ɉű��)�m����'p?*�H{F�"��k��Mh�K���W�|H�@Lq�U�����$@�mWq_���T��� ��$$����D��,�1��z�sllb�������B���(�g��lQ���I��N�B,�L�1c3�2GM��$�HS��|���9h:��ת����=���L<�i�!)���=���i��&��^���.:�����Uk�2��<�=,xe���4�B�����zn���Y'J�lܟ�oZ�4��������{;,]�K1��O�e mݠ ��j�4H�g�^��{ �%�_�kB������P���4��?�F�~�k�@���6�F�[%������qD����߃���Œi�hM�[�� 莤q���!��;C�n������ R�܃���8�ڼ�ↂ��o��C�c�Yֱm���81-Q;�����`$�W�h�)�̾Ȏ��zf覉��T�]��+Ɍo�z_ܾ� �]֝H31I�%��������y%���k�sH��㒠���J���: �?�DF���]�6B�(���a��)��y���kW�����%^"Ù�C\R�C�(td/e�x:���ZN��,[?bZK?M�wZ.����Y�.�ȱ�4q���K�X�y�>��k]��RQm��s��AXSN�b�[6�FV�OVk� �3�=$<�Y��z�W��|?&�I��Ԑ�p4�)u�C�g���9�3P-��U[�h��@t甃���� ����5�����!g��aG�c1��y��~b�����O��Q��O��w��O�ă�&cR��'MRN��sLGȨ^3��T吽͵��v�jXV������� �璺��Fm���:��g C��]�y��=ԵCǿ苖���~�E�w0&6z?X���"��'����a�w��P�p;uԮD�cޖHL�M��7�*���G0���ކ.3h���!���jV� ��W��̋v�E�B�2P:bm� �t���9���9�m�&�r�b��^Nʶ7mY�����!c��-��$��j�u�� �j�nRld��:k����e������JC���'��*S��ݸ�YU���b�4$QJ����+L3��QmY��"1�KU� �3�Ρ�./�F���Ҩ�hߵ�X��N*ua�{BGy�os�@�/�:,|�M���������tzZ��A��QY���F��ŔJ�s��'��f4���{K��$�ô0�}1��[j\I!б�`�i�3�<�m����`� ȈwM���.���n��"_Њ��_4}�����&�V�ag�9c�n��o� J)�[zU-E;���7?��C.V��31�;��`j��N�i�$���"j&��d�ߵ`J��C�f��s@/濃�q�5.�=@^U�Qv�[�Fg#�9֮*�G�*�ȹ���玗,)tB� �Jy+"��l,�,��i�,@����y�ϡ�]a7f��`���V~�g>\ �vbi$9� :Y���"��4�"?}�� �j���y�ϭ�����ͽ]��\�ޚ��ޑ,�.��^�4�����q��c��F��R�z��%݉�XO$���`���_H2}�Z����S*���ƥ���&G��J����u���Y��o1t���j�7�Bg2;m&!������3�̶?�����>�O�J�/KX�du�bv�&Uڅ�`�� bހ�s"����@~z�\Ew�� �>@��7
Behavioral task
behavioral1
Sample
61bd749864cef92f6ff87d7efef60e4423bc0a3952aac2574b24efd75da205dd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
61bd749864cef92f6ff87d7efef60e4423bc0a3952aac2574b24efd75da205dd.exe
Resource
win10v2004-20231215-en
General
-
Target
61bd749864cef92f6ff87d7efef60e4423bc0a3952aac2574b24efd75da205dd
-
Size
10.7MB
-
MD5
38e38279a8e030aef12972fe9dc5026e
-
SHA1
3b9ac718077c30e0eb8bff6deb4981a1f453ab1f
-
SHA256
61bd749864cef92f6ff87d7efef60e4423bc0a3952aac2574b24efd75da205dd
-
SHA512
c2aab0d5a488f04210396e029e236efaf96b4ab992499baf85c72d94e51ada151d29e291766dcc6f1f64b3195607a3e15f38207299313c419772743e575f2c3a
-
SSDEEP
196608:Kph4EnND/N5NllXsEWR+5BlSU5Hbeub3hf9b/JNXlc4uCY6LhhA32:ybnLmm7eYxf9a4uCY+bb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 61bd749864cef92f6ff87d7efef60e4423bc0a3952aac2574b24efd75da205dd
Files
-
61bd749864cef92f6ff87d7efef60e4423bc0a3952aac2574b24efd75da205dd.exe windows:5 windows x86 arch:x86
0895b701aaa07be5304d2462dbd4bce7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?qt_metacast@QParallelAnimationGroup@@UAEPAXPBD@Z
qt5gui
??0QColor@@QAE@W4GlobalColor@Qt@@@Z
qt5widgets
?metaObject@QFrame@@UBEPBUQMetaObject@@XZ
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
libeay32
ord492
hidapi
hid_init
msvcp120
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
msvcr120
_fmode
ws2_32
connect
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ