�E�����;q$�5� �[ ��%oP��qq��{#�J�}�DT�Gk���T�x߱;�P�����b�����x�I��k���C�e"E�����%fT��tMGb趡Ah* ��H ł��V��&�ծ�p w�&��I"�{c!He}�W1����3�-��'61q�a~�E��v�b\�������R/�9Hjd����������=+;�;Z .��^39vz|����7)n��|�8W,]��?=�QC^�lK>{�������C%��Q�j�\�����*��A���NЬ&���.)�����+�&S�^[R0�~.�����2���jis����\G=o�cA�3�~gz"v�[Hnb��9�+˭-�C��`ϒUd�Ջ��*!�r"%\�P"Vz T��Y0wS˧�=�;��&N��j--$7�/���q��8,[�4������TM6��]����[�,\��ك@���K�������������� ��<L :�D8���ƪ -ٰK;�swۖ<Y� ���6�cm�G�Q��nk]�#14��&��\�t����&)<5h,(^��40�;�^�o��&�i��d_O��q������,d����n�IR;��C ::�3�����'������$�nm�t�_+�<�� ���uS�E<>�铿��4l���9��B�1��~*�*��O�(���V��x-�d��1�2��̂.b=�Ovqg��v���ŕ���dnj� @��"#�J����P?X�m��Q��8��'���܂���y���~���]K7MD^�� �Jfv�a�[K;R�:aR����xØvfX�o���k�����t^5�*��vE:�Zy����#)�S�����ౘ�]��3elTW˱����$̚���%��l��hf��,9����������!{w?�w����[^�Q-��Ƣ��} @�&���A����v\D+> �>3�����H�e��/����t�������9�����%�&]��9n��pO�S�"�JlGp��|E�nv�Ծ=1f�p�W��U=Z)�u�ϞO�"Hh�9;�HȞ�����z�x=���gE�k+{�k��=X�QF��J1�#9_8 Zr^�IvN��)��ҏT�d=�,��E\�/Ot`�C0���6�Gn���-Sa�cF��Z���0V����^���~�>�L9'[���8ox~+��)c�gSԋ���v�H;QYݼUI[����莊�� �cZ���2$�D� ���GM��_�b���+}�U�FF�i��dž���i��^fU��Wꢟv��A�m�6%UM�M�a��u�p�ܴ��Ɗ��m|x[���c�fQ��?�ON�1�7|��c�����c@��L���3��u�<G1�: z|n\��wS �īw|�2�й�:�����GZl�(n����x�3��3Da�����0�P����.�i�h�4J:�$?�!��f�!=ɺ�EC��N��t�z��Û� >u���yb�g��m��W)�51�x�G��n"2+Ro�Cf߬����;LuW��� l;�gg0�ϧ�8wJl�S�#%LK��>��`/����|�R������np�r�M(3C��w��!z�0��2Lڈd�-��$G~�����ҫ,��[��c�#�pAn\�b>���>�W��2:�g�hw�ƻ�$�B�g����<�6[B��B ��;UW��T�ʽy���YJ9�%�X���v��{�P�~��WmR��X��]�f�xo��u۶�ىۺ��A,�@��+���&�!� ����8mx$Ӊc��,߿��2˟ �&*M n`���|�+�t@-���kM�\�s[�N��ɲ�� �)5�G��=�b�t�}��l�u���I���(��l$�=�kr�����E�ɪ�p��|��������zv�������ς��c3��]�z�}�vJ�<��r�]�)5s��l���\�CK�&��k��-$c-$�Cl����P��t��H�W�u< �CI,���ZYM���P�S�������愣m6� ᧷N�p(��yr�����jA���xKæ%7]�RŜ@�X���DxR$��N�O_�Ǵ��,�er�ؼ49��q���s�����2�7� =�>M[U�[U3��\l-m�S�����j����W��}.Q'V��8�5�̚�`��D֍ ��5���A��U�^�ne���yu���� ��Y��<C�a4���_v�dg�XB"�}!l��e����k{%\�����'��L�t$��I�U�%P'v7&��A�f�g�z�����;�D��b�S������pZ��/��O���+��կ�<J^����P�8�dk<��9�,ҕ��s�^��"g��x�0��� ���FI�?��6-b/�b�Z������Ek�E6��+�����]b�35d��HR�F4q�[�־eu��k1430�8 �H�~��)�d\�� {�����ʈ��RCoN�W�#8�g2p���*��ǾW��s��0���+��O�ՖX���vg:��W���_J�ϋn������ۑ�$H�B ʀ�2/�)��ڠ���A =���G�<T�m�}V�צ��Zgz��,��:��`�S�[:�E�7���0������aS*��=}`gC*�ӈ�&�(��-:�]O~��T��VV��������N���s�`�~,7^�����%�~��7`&��� ߪ���c�Il,W0�^2��H���Au����]VT�<������sj��5M�$�,'Ԓb��8C�������q�I']�o�$�LM=��N����j��csV�a7 �|�#����W)�.��ej��#�m��i�Yj�U�!�|t�粮n��8�|���i��!�<`_�7q̿)g5L|��������Њ6UJp*�uBe�^���u������_4�|����`F{C!����t}]�Ф�1:�]MWp��a��% �Z8�C��DD�@)���K��^�]sq1lsjo���Z��WPd�x��s��u�MJ^7���Q�i�F�pmE"�oTb"�2�_AV�i�7L�#�#����@Q`Uy �P����%��}*2UD�8F�)�������i�r���G�4s�c;��
Behavioral task
behavioral1
Sample
c12c5ee98d1711821c3410c4110573e6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c12c5ee98d1711821c3410c4110573e6.exe
Resource
win10v2004-20240226-en
General
-
Target
c12c5ee98d1711821c3410c4110573e6
-
Size
8.1MB
-
MD5
c12c5ee98d1711821c3410c4110573e6
-
SHA1
efe65eef0bc0548070d2d885f14df67179dfbbcc
-
SHA256
e3286022faf54318cbfb1eaffea29ed11fa3a5573d7b15e7e267e5494dc3380a
-
SHA512
7ec5ba20ab39b021f28a4c3a6dd480009be5ee1c01ddc1787feeb360cbeb21f661b724185f641cadb6326d8d908c264cd373193b4c003b8be1d0002322ca03b4
-
SSDEEP
196608:jLyvM3FkagdXHQj8DyLChmkjpzTuDKpnQBPF/R:jLy0CagdA4DyLwmzuQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c12c5ee98d1711821c3410c4110573e6
Files
-
c12c5ee98d1711821c3410c4110573e6.exe windows:6 windows x64 arch:x64
91abc36cbf98b2942f57332a84546f65
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
OpenServiceA
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
xinput1_4
ord4
imm32
ImmSetCompositionWindow
ntdll
RtlLookupFunctionEntry
d3d9
Direct3DCreate9
userenv
UnloadUserProfile
winhttp
WinHttpReceiveResponse
rpcrt4
RpcStringFreeA
urlmon
URLDownloadToFileW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 797KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 395KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ