I��(�}��r���cXa������'G�� P�:yUP�2�?��V�`��[��P��dNf!T暊� ��H�fu�͎8�1�R2 �(����K�*b�)�}��wҎɔ�ٍO@�^�j&���YR� ����S1�h!q)�lL�V�x ���t��P0Q�fT�'Hx�?�`���<��ŋ>�K;�3�S�{j���v{�:d��j��У:~��9rg�"��!��{Y=4�W��xʇv���` ��"V7��O��K�w3}�<�:r��9�^m���� X��P�,��QW��^b��RP�O#�)��A�Эn4��RrQ�mWI�9�}b?�0��4�;x�}Z2P82K���6aZY�̄$e�����[����*���� ��x(��m��\����'R��}��� �6�� �3%�ŪoD��4EA��!lc��t:$��o7��pD�in}˖F�]��2䨱�~�c��]��ІLeí ���l�oQZH^����9�ʊ!�!G�q�)J�_^w�)���G`�!F��B��p/]���U+��O�Rc�O�bƤw��?����X|�&��������5��-���?bF����|Po�MJ>'ijP:��V3��[��T]}�J�����+v�pN��(�� r������04�n�j����/�I�tR�:�Ui#p3^_{�� ���Ԣ�Қ���?�8naW�x���>����w�z1��/�(s� ^vH��O%x�?^�*��o26N�l��2��hT���sd�c[̍�h3�[�=�~5�#�����\Ia����N�nNH�4����Hӓۣ��T�pq���P��7�3ˀKTF� F>��9;]kX�g������$�P[ñ oj ��M�N�Jo͵�mq-�E*��,�=�P!Y�4�Fڍ�j)�2S��7'�����#�6�s��e:�Y�i�a�ik�֝�ss+-��6��Vj2d�~��9��m� ��P�fe;u�2��+Ҝ@�4$�M����I[2� E1�T�(���G'�$J��k�l��9K�$k�Z��L&9�H���D]���t�`I&VA�5I�"`���2ß�26_`ѩ�ع�>��lT9�Ev��ʸ��":M`n��r�Do����K���^���@�2����53Z�G^;��Ts�Q���l�Y�'o��Z����)¹l&yZK`mx����O��g���'4x$�K#.���%P�X�,.ؚUs�CӨ�x���U�OT���%t-�`�+�c+�,���XO�����*@�>9ڽ�Tvc� ����s˃���g�a�}�&$��=z,`���۠3�$� B�8�?�g�3�;���s]}�S�^�-&���;�yd0<GP��ʦ�"<�A�l�3��7�'�B�M�q�y�������˄�9��l�}Ƨ�����w�z���X��:�[e�gF�e��:�&a9<�W�Y�p�0��+.i��)/�p�pƄ���6�m�:�R�\��(9���=?�(���;^49�9���6���� �"1� ũag����(D�QZ��T5��&��$�Z���t�����T��:��i�:�߱% ���`���@��L������R��Ŋ>#��@����x{�z&��Q. *KE"՞��[\����C~��<<�����c8����~�y5�4�'����]� S��y���r}ܹ*�z��LIꇅH\a���ԡ�yd����oo"���Ŀ��C�l�ѥ=B�"x:��/����.G�_�C��ƳP�45��n����9�z}v�utk�&K���tT�����}������w��D�xD����"���r Q,���˴q��R��*� ��qd�H.�p7�X��Ymτ���}�C-�� �SH�D���Y�4���F�P 4f�r��>��Ҷ��[U�)�{=�E��ֲ���q�pSB�tl�c�(���ł��bsV�I7�DZy�N�Q1���L3D-|���5���z��@ŀ��tÁ�NL$���U��Q> �//qQ9����X�nl[6Jo� ������P�^�W0�V��$�����_J����1��(!����Ʀp�V}�k��.��OtI�T7���M|����/��4�����v|�>�Vy5����%�Ք�=+��6г��T&�\M�GM��]9���r0�})�Ea���}��m�zO$���99{&���(6*R�gG闍<���20��N 2j��U�Pʜ}&5n<h�ш�>b,��5���a�+�W�c�e�`���^�+�|ߠ7�k�#$7���sؼ=�:b�\��`E� �)^�&�n~X�����,�$��)�a�Z����������0��M���zs��9��Ƕ�"m˿}�H.���W|lj��E�J<��oo!"?�� �m!��^:�{�$ �4q=�Tp�퇥��+� �<I'L�� >#^C�v��j��V�F�s�o��%=�t�GÓ"��[}�CX�;�a��*>���7�@��f�x�8���3��zU�zĀ����Vޝ� �#ZiH���&���|��i� �I{įf�>%�|��Z@�?ԝ Y��l��YXunl�B�C,����\d�-x��.��ؾ���S߇W�d�)�2ʶ1!��"OAu"�D�����Y���71#�Em3�qeK�^z�� ��H����3�*��'� ���\ u[��k~�Ro{�wu7��v���Rt�c��FJq8�3��p����'ܣ�f:�.D��`�=�mS�ɿ[!�SBY'�2^ɗ��cEd;ʊ���ج��m�U�ӂ�O�����k�R��݄��*~���,~VH�b��4�ٜO�-&�~#�/iN�r�߯ ��H� �ϸv�9�W+�ݦ��D�)����ܸnK�,�ЌJ�n�Y�i�f.-HS�m��t������澋X�$?�Bຈ����2�}jݳ����"�W�ԌD�-�%� ]�͞��-�M��]Vq���p'�%s�,1ʈ��;T$�Ӂ0#��!��)�����<A��0Is��������~���7?��j�ǫ^�RJ�R`�
Behavioral task
behavioral1
Sample
7e239e009ff6f7d17fb306a67c0bc8aa.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7e239e009ff6f7d17fb306a67c0bc8aa.exe
Resource
win10v2004-20231222-en
General
-
Target
7e239e009ff6f7d17fb306a67c0bc8aa.bin
-
Size
6.3MB
-
MD5
7e239e009ff6f7d17fb306a67c0bc8aa
-
SHA1
c4783314156ef06ebb772a58c20116bc7531a5dc
-
SHA256
7be34eb6f877111ab2d8f36b1b0330a5ff2f5d5bd60d4c26ab3c156c75a66779
-
SHA512
40aaf75dfff8a42bcfe35d372a652b51392fed4f814cbb7a04da7cd409dc1be9ec5f20250b933d9b76caf34cac1fb9335b328885a1634f1d4a4d291ae4e4e73b
-
SSDEEP
196608:j8cnmu7dePTXxTmwuL5YjAwoEyYlbqR6jqj9c/inKInu:j8g7dyj2FwtyYqjeuKI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7e239e009ff6f7d17fb306a67c0bc8aa.bin
Files
-
7e239e009ff6f7d17fb306a67c0bc8aa.bin.exe windows:6 windows x64 arch:x64
a203819bb730d0ef57a417d9145782f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
IsValidSid
shell32
ShellExecuteA
msvcp140
??1_Lockit@std@@QEAA@XZ
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertEnumCertificatesInStore
ws2_32
socket
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strpbrk
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 422KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ