�}�S6�bM�k��{ m���e���4��ZAz/�hl�/���9w יt8��Y����{D}:GY�w^��×�J��e�,�=���t���\����Y?˱�$�Ìi��J7b�컘�^�֟'����2�7����R��"�9u,}E2 �_1蜃��@�(��a�8?�Rq�_1�:�� �ٳ��.v�p,q���e�>���R��YO��u����B�Z���Ƿ��]/� �_��s���Vw���?E@>����E~ �xs2^�y��?�96�'d�X<�8�OmL�]�A�{�~���x��z�?��!��Q_L:�꩜�]J� �0s��{kK���ガs��DՋʢ��j�z��1�UJ���u��oN@1�������o���^�fctm�V�=�lW�Y��lJ`���3������L�<1������R̨BO�8�^dw��PZ�w�i;�{�c�`�.~�ŕ��.�g�����ceg�ZpŻ�ٷ�es��Я� ���Td��u�#n��&-+1��$T��G�ư5N�W��A�x|B���i�3b����e�r�B���5�X���, Ns��� 蜽@b��'�>Θ���3HM� ���S7p{Lr�HÔ���M40�^'w��xU���X�� ���,0I��T���#\�i�j�z-����u뻯e-K�W�T\���#� ka�7�BD��4����خ?�=���r��~/�+B�|2�1��� ݞ,���>�;���WŊ��B�-��0�����q$��Ix(Gc�5_sՌRj+�^^DqR�b�}~j{��<���]c�jl`e��D( *S�,#� I����Op�G);n"G�Äi5:(<9i+�0��l��i�$j�z��E�T����x��4�Y�|�x�o(�m~c7��!1���˥~I�A`�*������?b�j��s��(�I&�*��,k�l/`|k�%w<S͝��)���Lɍ��$1�x�"�/</#���$* �XE�tb�}�s�=��}�s��CQ������O^*��X����t�__��5��9Imy�mO��ӭ0��5�]����E���g`�&ք�L���o+�C�vsޛ<7�P�l���L&3��p� ��sz���~�{�c��,ʰ��� vH$JY����Y����+��+,��n:n?�l�&y�B�V�Z[�o=����>Ne%sT�;��$۬��6\~`�8��R�w���X� �m�:&�=.�s�ZS�<y$i#�?=��Ps�W;�!�4Y��<m����<��15�R�|��z�CA�������^7������ _t!��e�*���W,�hћ$*C_o�F͙חn������L���<�FMGj�h��C8ȣ��6I�cd^:�#� �ښe��ӡ��� ?H�8EЃ��u�rj-�����~A��X)5ī[�X�"�c{�џu� _~I�d�b����k��$a����� \���� s~�t�"[DfT���\"�]6�n�&3� z�u�m�%~R�D�W/G4N����*�@"+د�m��{#'.��'��r�J<5v��N���T�$�n3���J��"��F�w�O���i�;�g�gv1 m-W��O�2%hh���Jc�6�����f��4�Hz]��&^�ԫW�x��Z�$J���<�5W�3��y� ��jfU��(c)ݯ�.����ՙ�� ��/=�^�6��,�����]�ڽLo@�� K(1e�,�Z�rt"�8^�Z�����=s{�|fв*@�V�v&�4Z� >���q��~t� �f�����|̌ńx%�F�@�a�]��)!� S3::���1%�*��*'o�~a������O�/�.8:l�L�Pa�����e�VJ��')lf'� � �� �e/}1�*���6��H�ӈI�Q���~3σ�_l�%ʾ�e$���u��&I���2�6�pk� e�j�,삌Y����Ҹ{��mg�?21U��^�n�NJd%|U�D6Nُ�YHL�� ��g��_,J�A��H"���j��$~�bq/<\7��Q(���0L�3�s��w16��,-ev��.5 ��H9h�c� ;���L�TX�A�ޕ������ܵ~����J��XU������� ��K2#�۞L�nU��PX胐s���������Xkϱn"i]�D>����%j�Z�Wg�j��xD�)P��լ��f�������q�c4�h��.��s�_ࢎ�X��#��e�^�#T�=RT8��+8#=�f����5}4'�|�(�B`���l8s����b���`�3�'>��L�s�q�m�x���y��q�����sV�~CXMh$�|֓��yjN���bB�N;�f�����}!'�����[�q7,g��1�Ti����>��UUS���. \0�K�Fb8�IQ��Y��`�_�+¼�AC��t�XmS�l.�b��cn���ڥ逽ݨv�*( w��FG��T\{(�(�ϭzA�]�e���#����t�E �No��q��8m��`�;��ra�}0�·}9�D2�J��m��/�����Y7X��{lK�� ʂ=$͟5"!$ki�)e�|#���[P�y��x����B��X�� &E�b���)�`�0���h{T�lTo�nmfÐ{����������I��4o���&��~��"í�!��d�*�_m����qH��~��B|i�?���6��ݣ�g(�AAp��T(�s5�0'5'P�$E�))���k5�fvb�p���b%�!qT���QR״ �0�V� �>����:ݽ������H��W��������`��l�hA�\��){ J� !V+'k�����?�O0Pv�D ���,d�Q�ɼ6�3��$[5��P>���2�K؈:Ȼ�M���sl����&V����6 1��*��.�]�j1�[GUi&�Rg4���Ѿk���Ծ���!�G_K?��6AA�c������xZ�?.�b?«��K���yؤ"�p�5���3@cJ� ��Fr�XyȐ��b��l�����^>&���yKrF�R9S�EKb:-�1��YQ|k�Y�L��ԃ�@ٶx�r�i@@��Qk09#��G��V@7�o�
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20240221-en
General
-
Target
loader.exe
-
Size
7.9MB
-
MD5
8418f7c73e7fcea9fb8db7b3af1b0cf0
-
SHA1
0d694c538d2eda0703cd2238518ad95eed83b285
-
SHA256
aabbd5b7283513c7968bbc21d84e97cc9a2f3e84fe53762f4a2e7cbb5dda9681
-
SHA512
3eca91bd943ea2fbab47d199bbfb832fe7a550942d58ffc8169a663ab35463b6cb855c6f8f7ea4377f1a15f4d9e8db352809aed03246d1c1cb4eeb878cded927
-
SSDEEP
98304:f05yFuLVj3GtyCNfInyNWavaJpsUTCPw4aMF/ZJRZEtEcOCBN+AT4Nl24pE0NGdX:sT5jNM6yNCJuU+4kutEclDMN17ACW0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x64 arch:x64
cd1bfcc4b5bcfaaacc6979592aba549a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSACleanup
crypt32
CertCloseStore
kernel32
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptAcquireContextW
api-ms-win-crt-convert-l1-1-0
_strtod_l
api-ms-win-crt-filesystem-l1-1-0
_access_s
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-private-l1-1-0
memchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
_isctype_l
api-ms-win-crt-time-l1-1-0
__daylight
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-multibyte-l1-1-0
_mbtowc_l
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-environment-l1-1-0
__p__environ
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ