A��i6�ʋV���'����R�^�_'�d@�;-u�ǂt�WE�ڹJ�<�a��p"w�&.�T1я�^���rgj7(�1�˻)��A_�!�����L �T��8"���G�z�S�#grn$6���դ�/J�`�P���7�=�h����k�,�% ~/BX�¬q�>w[CP��G7��*�<��e0Cd�M*@#S���_Ŀ�ӡ�J�I#Z�Eύ���,7Ƿ���U:��iWC����J�ͱ���� ˴DQ[<8_� �¬����L�1��*���<�AWÍj������EQ��g�n��icw+����>������T2�����,{�Bϝ6��u����&i��������6�2dA��T8� ʊ� ���`I��a��adL��"g]��cg���gḞ�{�}�XMkH�+�[�v�����N��)�*����}�����{%��&���h&�ƶd�hy1���vck��^^2�Ҥ� �6�o����iu�������j�~c�ԯ�^-c��VA�H����6�mw���tn#gD�pgL�bل�H%"�M��s����Q�U}b��3�L�B|�.��Lj�C�I ���u����?N�&憰��Y��ƧӠ����{eS���J�M� ����ʟR��LKq0�����m(Hq#aڊE+�w�"}�>�%f�r&`I�^�d�Sp���[J���,f]�i�c��X�zV�#>g\K�j��~�u杽!4c���µA���D%"��L#��"����_�!ܙQ��`�w}���6S#�p"���?pgk��*8�o�TE f� �� ?U�����jo-��W�S�ً��� h?���Rkv�m��PoR�X�I>�fC����-�����(+�e��/<�l2����xݨ����Lc�����J}!�>K����Iwa7�əfr�����}[�W��� �K���$\~A'$;S�l��#A@��0X�§�K�n�Y�|6��£D�EO���� XhnW������2K������=ّ�?2���������g���݉�ϷRD6�����&[��t�2���0ZGZ[��.c�x]ȣ�豿H�%/�����nk���?���׳̜�Mq������ʲ\��/.���^"a�.x��&ݏ C+��E�����0���( ������"�p״��6�m��3��6R�p{'�4H�D���On����y�F���}z?�j�Q�B/}BQl�ӄ�Q���Ə>6����#l$|�+\`��P�^��;Q�+����9��5�'�-��h��z�� ��=-'x)<���LP�?Q^9���p����̌%��&��E����IHL�/t���L;�y���MJ�ڛ]��>��3f�`B�`Y �B`�!�q@;/~��Ax>����c�6Jh ���^�L.�c�XJ- ���x߭��T���F+��7��Vp0��N���M�Da�4:�.��6���i6����ք�'�x��t�oP8�c�h.lJ�iq*�������3��;*.� {�V�nI��j�IX���h~Q�U�꧍݆�@.r"i��&S��EQ>�B O�H�l��h����EU����>Ot����n$��υғAm|���}��mʭ�J�L����~��SM�<5�����Y\� @�]"�l��j�[�!��Q��#����=l*�8%!�˴��0��Z ���~w �ls�湽<�R�pɴv+[����l��u�1E�UY�K�{S�}��cD)�oo�� �� u J�;q�N���"�}%mG�+�i�'�$S�!�\W~df�z��i�E�@h� ����f�����n����>+kb,�^���Eݝ�C2�!q��Bn�/x�~�)ӟ�eJ0�ܑ>=�T|�����7r��6�6r$���_�F���|G��*V֚����-�~����&��Nd�"6�v��ҩ9������X�1 WB��L���ЬnT�{�i�|r�cóK29z�6�lB?i�dh�e�=�]m:@�΄lx��1��S�ڭ5A'J�i��oD~[;�}#���[�'+4>õ�)��8����4�V�x�'���Q�2��+�&~��0�7�`u�������=�<'�EZ/w�; t�iIԲI��V��6����A��y��@��e6����;��>�a� ��%�Ǹ[M����vzj�j�u�d�=����=�F�s�C�`5m*�ϼ���#�0:S� D��wP�P����u�35iE��F( �W�@@s�!��q��A��^���A�NG��}�5d�/��jj<Y�H��)�(V�A`����|���`d?��|��]٪��Qy�N1���Ւ�.���@������&P��m�ól�i�RL,.���ނ_��rS/C��A�ԓã�3�t���a�4j T� V�ͰM&��l��n ��4P���Z���Wp���NE��z��=�z��A�g����톍x��7.{�fL����^N�8�aQ��.`�wn"Ӿ�q�y�מn#�~��"(��l�#�8�3:���ǜ��������%7#����DI�j1`S���8ʸ���\����p��5�Z�ա-Ԋ�5f�8�-=�j���G�Niu����Գ�@q���&:\$+a��V�����`�e�X�� �XE?!�I�%� ���d�XL51�~�� �: ��Fdy�`(|�F��H��.8�o^{|�{ҰS���w��&��7��pS��{7�f;q�XQ7;��/X,��ʝ�_C��JM;s�tp�Rg��N���'5�>2�S���D��C6Z���xO8q�0E!�а�y ~�Z�!v�Q�8w%<�*�_��+��w�{�������+H%�A���e�3��,op�{�����W���]s�l���P�s+�>������] Jv�Ez1�R Q��٨Ԣ���tQT�Y��r� ����XI�kڰ4{��:kZ�n��� q�DJ!�C�4#)=(D�|��&��'�NƠg��]R%`�ϊ~�&9�He ��X���Oi2��ݺ�}��n5�P6Qa3%�D��\�۰�AT��3���U2�Sm��k)�����qB syW}R.
Behavioral task
behavioral1
Sample
AR_External0207.exe
Resource
win11-20240221-en
General
-
Target
AR_External0207.exe
-
Size
5.2MB
-
MD5
10262f632aeca6176df01e0da2c27c90
-
SHA1
bc2abc232207569622016d074d2541ba83115471
-
SHA256
7783a99af4485ce797c32cc1b6d4cd475be9c527d231fe588c14339ee5785da4
-
SHA512
d248ee86fdbe2c7e90278edd0608d493848da60cdb7de862bbc0bab7df23b9e54197d2d8c7c2692ec4c4972afecf1dfa0d80836b1fa61d737d11db77bd3bdd75
-
SSDEEP
98304:LeEmzd1dxd2LOLyGleSDC1vEztL9ThzUhUx/vLI:LeH51sJGkSDlpN93xn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AR_External0207.exe
Files
-
AR_External0207.exe.exe windows:6 windows x64 arch:x64
24627d8e9982b0a7cb34ca38f0dc230c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteW
msvcp140
_Query_perf_frequency
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sinf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 527KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ