�>*�f�y�mô�h�4+G����x��` �7f�p���5n��G�u�.�������ú�xm�L>T�u��K5��a�47RW�����G?ۑT�Z8̋��#>�Gœ�M��!R}fC+j���Q1+9�S�m�y��,���^'s�k��_�aq�0��W��"_B8��k I&��� ���$��{����i�yQ���$��s����ۍ�>$M��>������c6�R�+�nM��c�ӷtB��>���W��)li�j9*ۖ�Q��n�a�X� �|�]ԙ���(" 6iŴp�_?��#{���>�NN��q1��Z�R�[���4���%A������E�02�jۋ��ҊQ��GZ�k .��w�\�7�S��G)�#���(��2��� T�,�aZ��)j1)������������a5L��"��;,8чkT�{��{Ҵ��Z1`��N��Ϣ�䱯cmb��˟[0o<��z~�=�ւ=�ț7�5 h��i̫�����@ܫ��� D�RSM�������0�ީfH���M>�������A�c�Zz�b�S]��ڸ�0�H:��\�w��e�������6�3Y1���.7c���efj`����H�o6��)��$F����I�4�RE�>D��<�<��t:k�v� E�Zϲ�(3)��v����/�}M��!� ��7��l�ne�~0� %�#��Q��f�bS{|�t^=� �;n���Eqg=�Y9���6�($��'W�q�0�E�� ��.�B�~{�-����9�u�+���'���@� *<R��=Z����=�Ed��#� �c�ꮒurC����N�����Ш������\��g����S�kDO��� �ͳ�oC���r��ߎv�d�^�����d̓������1��3�D�p� ��ώd��-d] �Z�E��O)�$E�6�Z>�h��O%Nx�L���Ee G�d�ޜ�5��V ���R<�hs���F��PcJ����� `���S��1�NJ�����Sh��u6Mk��I4r�8=�"%-3����Bs@B&wv��J�*�u��D��_F��C���o���3F� ��+��O���l@GeR:�c����M�\�`x���Pk�G,;�����8n�/)Z�� h7������C�#>��(��hJtCx�ǒDL6�m.[r�=\�v\���a�T�G���+�D�f�*�r�eЧ,An���7m'�rT��k���+9�R�@���7ƣ�74��Ӫ2(H���T���hږd���t�h :�)��������.���8R<w<6�B(�J���8�B��S�T��B x�q z/z\��c�����C���V4�"�Ñ�%QwX����vc YΓ�sc�"���fh<����>�b�.�)��5�ɿ5OP]��z����wck�Yr-�`�����C7�����,/��/ŘL 8�<'�W,WQ5G}�XY>�����c�$*e��Zf/b�� ���F����~��p"mF����(����T�O����}�}�k�>C�aBp����g��,�~!��±��B�Sl�=�o(wД/i����������mO�2����d�II����q���NQ��IΦ+]�F�{���y�<�pQ]�7Ib�%�J�� �[�a�����K��w"?_��Б�|W/�g���Q���ᅄ�+p�OA�/�kߩ��6Z�qU�!�ja�A�2!t�s��Xf�#�C�� v�BYI@������r]Eݐ�̭/3���W��V-c1A���l)��$�v�ż���L���Ƙ�q������A��yp� ^�/�)�o�6Fm�P�^= �u����������sZ86�Q�f�D�c���#$P��^�5���M�y�^t?�ڻHa/9�:Q����lo#F1ov��&�e�ݦ`\|�&�Z�� ���K����]��.�Uc�1���M�Z��x���RP��5:�jY�6qIӮ`��0�����n���lO-�Z+����{�����e H�n�����DW�W�h�y�Q�~`�4�gj�A�"n��&U��C��6�<8���$�<�7�O` �~��2v�s���W��&��2ܱ^J/�⠶qdR�&�W�z���XVT*��������&s%�+��� ��1�v@t��T��T�l'�$J�iFs�0����5^\�td��A��u�b���ʁ����{���G���sA�A)X��NtN�7[K�Bt_L3$'Խ�W�����Qe���"��@��wasR�y��NE_9 ���J��38��N�$�lj�v%�K�N\O<t���^�A�?�����v��|JCss�F��Oy"�'��J�e���H�@e��M�����<��v����h�����%�)Įѭ�;�]�3�"Ld`J�u�//�J���[ J����9�G+�S�����z���zӫ�%�V>���6��Ұ�`������.�� �� �8֔dyZ���㒒TY�m�Zb�NA�?Dډ������J��n�y^����[����A��e�n�H�>����ʭ�LW�]�e�?_X,��p�ߦ1�Q���KB�tm*q����j��Œ6]W�O�,���b�.�b��F�T��7_N������8b��?D�Ueu ���h`�JР<u�:Sx�&d�t��r��x�"Y��R���C�7������2� �n�f��I T�Q9#k�'+��!%�B�ǽ��d:�[#�dtW�r r�Z*+ŋ�zaW��D�c6�R����1Sc�8��ӌdN��Ƞ4I�^�P�Z�5�uy�i���/�C�QЕ!�v���з?7y��T�|\������Gk�E%�~���e�z���{/��ldhC+>mzS�����d?��/����\&Bt�B��N��l�iQ3�e�k �4�f�5���&}Q97�&�����Tu�vͦC^D�@�O����0��ӛ� 2�# �Q33<��1A,�Ձ�)�>��+���ʝ�D���!>��ݿ�%֧�&�"����{;-g[_�V�?�&X0Q�FK���ĿO�����=�d+���� J�����#�䛆z!��o
General
-
Target
o7Ro7AmC9Q.exe
-
Size
6.0MB
-
MD5
4efe4c0e03d27b07344d1aec17fc6859
-
SHA1
cdeb2da08dac9ea2186314344941c9d02ae0e229
-
SHA256
4b5d1f54527434214380d0864ab1fa20b533bab226ca8416737a1c72674251f1
-
SHA512
0c1f77985a076ea58356d975acd2830c8052bf7f00cc02308b16547655b8cfe95a537689c78b25ffc49614f2e4fcb9101d7c9f360110b002c494c2aaea9436e4
-
SSDEEP
196608:cPko1g5acv0umFUk+5CrkjtVHmr+HtvTVeX/7:c8KcbNcIfGrAVez
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource o7Ro7AmC9Q.exe
Files
-
o7Ro7AmC9Q.exe.exe windows:6 windows x64 arch:x64
00deab4a401577043e6f162911134405
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceFrequency
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnregisterClassA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
msvcp140
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
ntdll
RtlAdjustPrivilege
imm32
ImmGetContext
d3d9
Direct3DCreate9
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-stdio-l1-1-0
fputs
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
ceilf
normaliz
IdnToAscii
ws2_32
gethostname
wldap32
ord143
crypt32
CertGetCertificateChain
advapi32
CryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 814KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ