e����-�M��J�Å���Sǽ<�A}���o#�m�;��F��<S�ca�00�y�G|Duڸ�m�{X[�7��IW��&[�����B76�zQc�G��S#D]�|��|�(����Ld�������*�X[$GG1|�I�5��4ڐ�3SD�����\i2e��).ZW}��\�&�D�c�� �����}b��{ Dx6{McM� U{�i=r�*���i�hXMqT��"ԩP����@y���[.�h���M��{Z��ɂpU��thD/�����k�d�������=������m�:F�v�Ѡ��'x�po����������P+��&����f�yI���ך�m��|Beи�f�L�ڽ���u.2�M��c�C�I�X�{�Qj?iYo)��pm�V�ڛ��GXq��cӅz 6|ykW̟*�w�q��$�sʤd3f�D�r��tXg�T��9#8���Ҷ*�����±`�+8�SLl�|��v~�[ě=�ӭӞ@�}�-1ՓF��1=^�= ���ˇ^�z/h�)��OR��+�W��Ѭld������:Q�s��lJ��dۃ.�Ix�["���t� ̫{��k0�\�;�ᕗەj`hvovz�0P?���y|+N� �)�0�~���/, �*����t��ٵ����_��f����٫����,rk�eVȫz��w�%��|)��fp^�w����ݴ����0���8O.����0���S���/���� �� ކIyS>�*��#>����/NtDL��@�Ħ�i��5Ja�[��j{e�^A�/�5=� ����6�d2=�Ƹ��) ���`���!�D��o(YT�;�]H�%�W(F��Fp����U�$�b�08�s� �tL��3/��տ£��F����/Z���q�6�Tٴ��oj�� l���+P��}3X[� ��S)�U�2n<:�$�'T��I�� ���~�C|��廾M��ˌ�hR3�iq��xj��d��L����3�Ѥ�=a�*Dy�Os_�*_U����ovF�϶i"&�`�^�!�G�bE�T�Vyi!\���z?Ѻ�Y�q�c[6�<�1���� `��_[iG53D���%c��S�{q�֗T#b�I�'T�e�$Mi�,�U��[}f�~{L�;7X��5�ǀ�O���O��yJ��R`CV�>�Dei����N'���р(2�0�AP��}�X�6pA^�I�R�T?�#~Pg��\�_mW�u��_��eTv�ܟ�TGvF��9x���}k���']�@R�ɗ >z�9�yy{�!�����\��h���V�������cN����^��>�1���ѵ��*��٠�����������-:�eB7u� ˘�`� �\�>�t���Mi7���>�" $���f&4��ON�v�!)%����A'��k�8���:�D��k[��A��U��@���~-ׁ7]>��QdM��G��Y������z��nr�h����tM�c����\��e� �l�t����1ܮ���v���R�Ai|f�� ������r���r�%6���a`�L^�Y�Ҟ`�)@�B0pE(�����w�B��b�,��&������w�L� ��I*�����f�#���� �-:�qA_����G��* Z|m�>�)�8�������$e�ڦcf'��v�)�� �Ȭ�j^-������暕[6l^��m���^����eרq��CE���>c�7����(���2��A%���Ot'@�wI�D��M-�M����>>u���>b+ �xM���Y��s�O~�x6�i��-RQ OD����r�� ��w�-��"d-�y��W:��t�&f�9���j3�i���6�&�HN�2�X���8�P��-�t&�a�s��-W6�3^[��+�ژ�Nؓ��ƅ���礯@V�_@6�_Ͻ��LO�Y-r���+8�1;O�f}4��?d���]DŽ4�'a�(|e'���A-��^��=Dž�յ)k����C�y�F��o�A�B �>��lo`�Vy ��<?#�5d�:O3s=�*A�<��.g����H� ecl�z6c$ Z�EK���1��U��S&O�W��h�,N�������c]'Oy����xZܕC��F�fL��_8�-�nZ���E�:d��Ӻc���;9&㔖����JV�i�1�h� �7����Y��L�:��Rn'�����w��F��o&w@���$��nx��@K��}��t9=P��_?����ߠuT��8S�U�2��J��L_��w��ƑH�\�}����+?��L���e~Z�+�^��� �b���_.�d!��r�*����X�ɿ:��v'��)Է���0��D[YZP����U��<1�a`�x���^�n ��%z�M�b0�X�����{�~?���f<��� 焒<�5�iC��+�ВJ�e� ��q��� p�^o�i��㮕��fv����D@SVZ�HϏ���k�,rp]�l�5�[�<_$�C�T�������rG�a��E'�I���M�h�����5���%��G^:+h�Z/w�Fn���}�8����D�� ��A6�K5}��C"��}��n><:��;Ҳ�)�� ö[t�R���M�ֿN�M1����c�sSEGn��Q�x$�_�j���V��5��u�-Qv@��e��m`�!CeO*0�����Լ�/ǔs06�d��VR @*�i�#���W���w�t$�z��{�Έ?+O�QPp�d+BY��{��&��C�����* UD��1ӋJ��wqլ�G�34��HX�Oa�ݵ��gN����?SK���AIu�n�v��� M��J� ��#��+�=x3���w��l�'_�+���yZG���ѿ͡�P@4�Yu>w������*X�wu�[�,v���iz�T~L"�Qk:��~�4�β�����e�վi��֎ Q:0��K3ucM�J���~�$��/�Z��V��K�{TZ��D�4�� 5�nd�������O�y�d$i״KM�gxv��� �JZ�C��I:�2m�r+���Tԭ��ӘJ����6�����[M��ri�P`3Qѭ⺼�o���)�V'��=R��ͧ�YDݢ=�kgd���j�ؿ
Behavioral task
behavioral1
Sample
b6bdf16fc265c2e2521fad8b12b578a0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b6bdf16fc265c2e2521fad8b12b578a0.exe
Resource
win10v2004-20231215-en
General
-
Target
b6bdf16fc265c2e2521fad8b12b578a0.bin
-
Size
5.5MB
-
MD5
b6bdf16fc265c2e2521fad8b12b578a0
-
SHA1
fc975f6cb6a8f6f6fd42aa8fc9d743d83b578cce
-
SHA256
9345a7a2de840c526f8b4312494df12d8e7987e4092879e2aa6dee8852333ccc
-
SHA512
17739866ccc365a71909faf3eb0823e00da589a6fd42c6bb6364d8e9ca5511d56b3e9ef0ef65ac24512da1761e62ba2d54cf52a50a6870678129dcaff9a97299
-
SSDEEP
98304:vObuI+ZgmtaE6XvMSk807yDlPX0cH9n0sRi3IUdeN6EMzNgpidA:vOcOb/vH07yDl5H9e37dI7MUC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6bdf16fc265c2e2521fad8b12b578a0.bin
Files
-
b6bdf16fc265c2e2521fad8b12b578a0.bin.exe windows:6 windows x64 arch:x64
33ade291d074055060303e968eff7576
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForSingleObjectEx
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
??1_Lockit@std@@QEAA@XZ
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertCloseStore
ws2_32
ioctlsocket
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ