Rp�O*�����y���I��?oTɨ/1+IlmIvG���tCL��IZ^h9�e�p���[��W���L�u椾��,�����@@�,�y�Y�Ɍ��#d�;��g���J �`!z�/�oK�}�TGV��]YZ)��k¯�����rs��''+G"G,��27��`�[����b���]�=)��ř$xت�A:���m�1:u�d{�>C-�g��j�:y�ę����;��O[욶]a_J�ĽL" _���N�T>����28���DQ;���+���/&D��5R�7sj��k�ރ����t� 7&!MLn��H�ΖzY��Q�ڬ�>�`K�9^2o��ߣ�`k�l� L�ԗ�� # y�9v`!�0.-���7���J�q@����3]����<��F+�$M�6?���5����!V4Xˮ��И��E���� :r�3��:�~��n����ڐ��Μ�K��O����f�Thg�b�VBgJ�`2C%!��g�D8�ҟ7J�ǻ6?M[����~͓q�����H4U냎�2������*��x�T,�Y C rŚh���ʸ�����<80�T?�dK��:��Y{>����W�Ԝ�+�-��e�ߒ����Qh��j �T�wKt&�v(#�z!\g`��U�����܈|3+:����Q�Mբ� �y4�>C��lAvZ3��̈́+Z�E3�u�]͞B��\����Ui���q|��o�.�X����)�q{\��({ڋ�eK��Rv�l�uw:���t�Ŋ�j �(�w���ar����"\1�_܂�+�g�VDKȽ���Զ��Ɋ��������~¹�騮���%��"/������$�]d� Zb�{�7m}S��ܭ��a�݁X�RR~�u��3���F���d{�l��4% B$4�vv��#�K�D0i��!4=��z2�;"<D���[=[��2��^S�/u ���������D���N$�O�u&�W �_~�Z��Y)�������g�4fG�VGsF%,c��Z�ȉŔ��wX6b�縊����L�Z@�?ݯ}����[����Ǣ�i�Yta���&���=ie^oڢ= ��4�����#�+B[��P�g<�4>��Q��W"D�V���]�%WJ~�� h;��kUO&� t7|в�N +�>������w��������� �TN;0�B�c�XR)*Rנ"�SL)��|'��bܴW�N�|y�Va���?���AY�"a0�ү���<���;�����:��>���բ��l:�{!��p.}��M�����e�ЭR �t��O���)L͕���:��7��;���v��ߔ�GDǙ�^ Żo�K�`�v�4�Cc�Y��蟙,,s1������ւ��������5b!���egr� [��@� X/�e����1R����;��mL������g����}�J^Ȟu�O�lI6u:h�#�v�����&���\��&3Ď��z��5G��:p3��}YM�� ��沑�Q��"r�g���C��{_�P�e���]EK�l�����=h����3P��D�z_W�d��M�4���T*sX�%W����C�q����`3��:���t����း��LVN�3�@�O!��Kf������t�G�pa�5�n�gݛ!>����W�F�;86���6�<{�kA�C�.d���n��@��0~(!x��r������g�;���Za�X�vD�b97�Ȥ)Ri�q������;_�#;s��v~������'W�cX��8�� M�v'曾+Ȓ�e�p<,0�x-�ӹ: ��g��tG�ꮿJ=5UQ�'b�-5_[sL@�O����w�&��vOu�� $G�b��ף�����/f!��K.V�����{�"Rs&x��'��j�ŀc~iť����uJOt���9�:hx|��Lh� �2��*BKG��6P���<iM�+� �5HV��$r��8L �tt�r�k(N���k�4��$�<��Xi'�wA�0[��BT�ټp���7�����<Wa���¶ȓ�m*��X˂��V �'��P��c!04�-xI���^ݧA[��2�s.~�Q�A� T7����`���k��oC��$�J��0�����:����8��;"�+.+�z�'��Zb�ǜ;(c_�B��I4g�N�'n�2�*��!E+o�q�����d",о$�tf��U��X�"���˴�?6���k��$A�E�j7�=G�]����>���R�ث�7)��E�<}��&H;�1��r01;|<H����g�S¦.1�a��p�q�!<x;��4����+~h�>��2�"=15���w������)��q@X&بx������z��� q�(���7 w�4�U�>�F�.Q�,z^��ui0��s�Km3x=�N=�n�RIIƓ��n��J T��y��X7�Өꛮ�m���*�d�1��� h�*W.��UI�������E!(A���n��[��k�w���ҙ_y��9���F� �"��y��������\�1'W�zQ�;>?�LPx���Z��)/��(ZS?�{-^���Л`\(o��T�9��Z$�t57ghQ�a�Ӌ˻�^���^�,(��3C~��$v������%�v{�G��,lZ%�u&S�j �)*i{̠~k3��¯��*�6��g��F����.VKnN,c(?���0�^ m����F�S�����꫱��*����+NH5Т?�cZ�Ķ9f�����T�d����pY�#������#�:Ɯ*�Hy=��1�f�>s��u%���?��f�ݨh!E�=W��a�y��7���˖�W���+�ez�'ȝ ��A�s� E�!��t��Ջ�Կ}䨵�f~�t�y9� ����%�/�����࢟�Ya���1�V��:��G���B�u��bO�ғ����*�^K�$Ί��"�ޢ���é��PxO�$��� j2����>C����S��1��w���z �VP���W7�=#���r�)������m�P�;Pݮ�����Á�;��/(OE�Le�[�TK�Q5儆����z������/�X�G��ę�6&{�Ϗ��>Uz�����m���,�aGY���
Behavioral task
behavioral1
Sample
$R0XDI0B.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
$R0XDI0B.exe
Resource
win10v2004-20240221-en
General
-
Target
$R0XDI0B.exe
-
Size
10.2MB
-
MD5
8dc3d50041fec9f2b5a088a024f8aad7
-
SHA1
626f782029e436cc8dabdcdbcf546442da217b06
-
SHA256
a75ee9934da7387d5d0f6fc5eaf930938c2aa258db9eefbddce1f11b40a60e69
-
SHA512
cdebac2ada7ee127852121c75dd2a0537e55fbae0441fbc5496d486043d44c6276151f1373a4c323bd178217e195c4a1deb35fbf09c27b69bb7238d100884867
-
SSDEEP
196608:WYkIedLxN2ZD8iBE32cFl0xDiJ9jLR3BqoldRukhQ1ySFQze6CnH9coJdK46JU:WYKz2ZD8ocFl0xDu9ZBqlrMze6YHts4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource $R0XDI0B.exe
Files
-
$R0XDI0B.exe.exe windows:6 windows x64 arch:x64
Password: Password123x!x
44187cbcd9d40bbf72dfc77a73d3a8a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
AdjustWindowRectEx
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
RegCloseKey
shell32
ShellExecuteA
msvcp140
_Thrd_join
ntdll
RtlVirtualUnwind
ws2_32
shutdown
crypt32
CertCloseStore
imm32
ImmSetCompositionWindow
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
isdigit
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
sqrtf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 619KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ