�{�m�f�he��.,Om&�,Ie^S9�$.R�=�9����_��p�5�Q���6I3 �VR�J$���8H0w���4���;+%o]�[��p-Z/N��%�Z���Y���^�~�}�����lt��4��I-�}�>C���'������~g��9�GyhrX�����t]���ǂ����H���=�dÇv!(�1��ϒ���wl���Vԝ�S,�i�[eHW�%_iW<xp���M��@0]���њx���. ��f�j���&� J�u�U����v��t��\��O#~ c/��RQ~h:�[��0�qS�����v(�����A�Y�sK�} N�j��i����ڣ�%�vZ�!��h�.���M��z���߽�����E1_.�c�}t�3r�@Z�M(�e��qy����DO��Xpq�T�۞�K4���+Y?H��%��M{5�+�96��/��Fg�KD�6k��=ɶ�iͯ�WG���m܂ry�f�Dq�ii�������^j�A����af��,��{��L=[S; v/�������\����S�Z�u{'������0�$"A ���iM��Jq�c^�::��0��H�J/�>��uA�����Z�C�i!������FA"W7܍��$���G��U�/Y���MJ���(�����̞v�y��u����$K�Ŏf�~�eϠ��kE�H�����sH�{,d��le�>�����C��c�ta���i����W����g*�8v�+�SW3q�]7eH3�ҝp��rJ�\f��;�{���v�n\�� {��3��iQ>_���E�Y�9��;���r{{��K;����qA�}zu���5%�V� g�N.�LZsl�ae�S�m�>)��dJ1��g�G��C����! ޝ��4��~�v�� �ݿ�;/�$"*Ӂ����>ϐ�pHGL��À����O,k�vYe�jDMݝikg�uO�D��j�Ϡ�S����x 4GOQ�ƴ�*HrX_8j\��r� ����9�a��RS�*�yc�!j�0S�3�q7v��|,�`�]1�Y������}��@[�2m�b�#�p�4������d�s����8CO{��}g��$=��/�,#��~����X�[�}��p��#���g�n8�Z�ɒ���g����*S�����XjM��������p������_�tve�-|�_�ꚫU��0>�^b%6�D\Y��m[�yMԅ���x�wJI<X HJ�M��n�t�m��*��� N�y�U�+���*��c&ÕH���b�+�"Ǧ+QF��&=K�ܘR�1��Sso�ۦ�Oձ[��|��ҐF{��5b�ٸ��u�C��=�9_� Y'Q�`�5�R�����BA����B�ڿ]�+oX��("��ch������FF���2�ʕ��z��@�TP�_��q��=��q�1�v��^�T��TZgx��T(����k��^���{́����z�4"u����(sh%���ALr����V�X�1o���0�'US#���nQ(��=�aӵ3'\XW�k� �i��\ȏ�?������k��4D N��ՙ�l���ꌄ�v�r�~��U*r�w�������DCoc�ڊ � ��ʒ������M��g,�~TX턷��N�頔�]�;�@��Q������X��3�v�����6���&�OD3(C ��]������G�s�V/n!���Hox��T��"C���߶���r�9�:~D3p�>�nW�ȥez���A�7 X�k��Z's���, ��Iߩ_�#��D���3�*y���z߫-��_)G�ȴ�f��B���i�:0ۚd�ԞoD0�Rx�Èq�Z] �� �+�l]9q����͇�Pp�J������!C�J:�S�EݥH"�s=YWYDÇ<�BZ��>`́���q\ꐮ���Q�|�����Q���N�H�6$u0"�-��e�㭅i�#m����u��k�U�z�(��6��c�t/��%0�C���� �������f�++��e6���J��U���2�ID<v�C�Y���-9n_A��:q�ي���V_��9"���"��rI!R�S�̖�:����x������t���]4.��0qFj��o�������|�[��yBS�������S����- Z*�ÌM����dq������H��*�G(]+�)Om�ic@��)$��+ڦ��}$̮(������3���&�,�ۋ��dJV�)�C���O ���u8��C�,�@���P�g��&�H�1x'nA"P�#5�_�k2����łq`O�e��^�ȁ5&��|��`��ӷ��3mc�~�:&._�0pe�_�z�Zxj-�s� (���/�$�U��>OQ1 ��'zjd��D$_��%��.��`^9��,���}2��2z����3)��C�˴���)w}�Y��/s}�0I�_�L�����$<%J'�V��+�+W��;�l%����L�wA�,�al,C���k5��Š��t��0����>�)�Σsp`�vL��X����':Y�G��T_��k���[d)��nI]�@L>Dw�Do��Y��uv�De�qʋ2^)���oI�k��\��a4^s��D����ib����������(���gRoȗ�=/|s]����om��[����}S�n����:$��X����<e��'����I�;(�>m ��&�, �Uш�Gk��Ĵ�����H���z���wLM�w�`e�������K8�W���)��(M�e� T88'�;�r�X��Ϝ:OX���qo�C�����8�z���R�������^qL�T`����-�]�o~B��US�W�,*��q{ID���=�$ �R{kE��������h;�=E}���O1�}�B�H�?�?�<ZTt�y��O�]��oor�<��u�k��P�p��&��\ Dq��t�h�����]*-&Ó�f������9_Ѐ�ptHp &9S���H���Z��ؒ���be�TJ1뾇��{���8��U4���]���:�e���!���c�p5��ya��MX�n�ꪝppg�ӹ�3��LlkA�oGZ�+$2�%O�����U1��:����pL~���`VF�P�
General
-
Target
a.exe
-
Size
6.1MB
-
MD5
718de0d64f2af33691a29932f6c48e05
-
SHA1
0bd319759743d06617f75035a9116dd3fc77d031
-
SHA256
c9f58078835f2f2171b1e8b4ffd8ea882ca4172bc325f5de713deef24c44cef6
-
SHA512
866ccf9b0f76905b9a87dd9bd4f4035bda8ae0607450fb6b8710da4f8d2c00bba917f5aa4ca075cae1d9c8e7dc73f4ecbb43cd74e0ea1da4f253781afcf397bd
-
SSDEEP
98304:7WqJz3BhimfOkknAfcF8UY2KsE3nDCxpFzoH7RqJq1x2u0BqlWl7HnBxwSHBgrpQ:7RvGZAff/RsRx7oH94qiPqlWlDcIiu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a.exe
Files
-
a.exe.exe windows:6 windows x64 arch:x64
8e0184b63f2b4ac2ba36846b7d4094dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
VirtualProtect
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
advapi32
InitializeAcl
shell32
ShellExecuteA
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
ntdll
NtQuerySystemInformation
imm32
ImmGetContext
d3d9
Direct3DCreate9Ex
normaliz
IdnToAscii
wldap32
ord46
crypt32
PFXImportCertStore
ws2_32
getaddrinfo
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 973KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ