ո��p��"�_E��[ �j� � �85 A*n�..�]�}i�5D��|�������{Y���Mm��M߾�a�n/�W)ZʿZpΜݸ�5��p"g���G�����H�y%�.��^�N�U6�f�ue���^��Oa�y�JC�;���2We-�������BڔI����g���M������^˗M��+��I�ɺwJ^���`1�!�FL��C��%����Tw��`�D�����5�����Q�B\O�V�/���s����ǃ��` �J(��=Y��'�^��������dд�Z��AD�"��{��fǎ8D:,-`(d��/���g*��JS���O�r����$�p��!�#� ���8���6�<�C6����~�#C#��Y�#��c���ƅC���ֱ����b(�w�xU���?�C���I���9��[]�g'TQlGD�T3S1Ĕ��`��jj�~1�+?oȺU+��V �;g��J�������uj�,놆B�����ߴ�������� ��v�`��f��c[Km�JݨY�N)�]����s��Z�'sKfGo6�����������Z��L^T@���β8� ����=i��ny��>�6���K��/,q������_�N�����O֠S9��v��fG�B�+5�X|����3N��g~7 t���M�cF0u�f��[��J'<��'�v�ڻ���G�>��h��X��g@�R�)�oe�`�|�_�������Ť!�v�U\�,�kx@F�b�i��N-�;����j��۫�ͥʳ����������oاQ�%� ��Z���u���A���w�@���B��>���'��12����^�b �o���Z��������L�M?\��ԧ��4�����k6ӌߊv����ۤ�i�[ׯ���Dn�Ԛ��ĥ��U����Øh K�uRG|�XZ��p�)e��]�}e%��Q<��tX����/iy���r�<���3)CmO�ך��[6O&(}a�a�9!Y܂'J��ܛ�&�B*��8��+���e8h�ڑ����o�4�Q`��_��Cx��d���L[�/�����UN�J�!�ۮ������}֏� V���x�J k��&1�'�S�RH�~#m,��4��epm��i����pY�8�Q����>��!�}V�.��Yo��xb����]/5L���Ё��������;T�^���I��{hj�����bH�)����j 5������'=�ˢE����6��_U:� 76ӷ�7���3�3B젇C#E���7^�گ�{B��H�x��]�O�}��!����l�EH����Ɍ'KX���'0����1��� �ȼY�2��1�����]YX���}yh{U��od��Yw��P�+2��-�j�f��*tˣ��`ři��83��I^J,��`H�2T5f��/EoL�������R��h���I� ��2�j��r�G �n63�i��r��D,�g���g1˵�6�耎T54h)�i���l�W��by=D+Rm���l˷p�X��<���؏��(���䭓����dfP��p���_e�ab���g�^��2�I���X��EA�Pg��q�>{v ;DqJ/C�w���ة9+7fI�D�Z!����q�*��&�����pJ fk�҂�;�^�\c���6�qj�b�y�P�&�|��"�5d�BF����'d�0�(<���� N̵ׅ���| ���m��$��ɡs宧�촨�G�6�H��e�)���\�<�"3A/��6��ut}�4R�ߴ -��#C������C5��vx�[۟� ��"�VƆ�P"BVӳHm��t$�� �=����-t��<��<ؙ��X籛��t�(�^AVn'l �N��hI8B2�3!�˜:UKj���]�ߨv��N��tޑ+nC�6���| ��� �"�����8l�u6�̒�iPO���I�i8K�җ��}�S/9Qꑷe� ���nNC� a��]+����v�0n��%��W��u�i�2�So:be��g^�C���H�h-#F?�x�\���4�xm���iœ����f[�8\����� q���ӎ����d]��O�!`�l��|���J������z �V�1ɚ �j�ת��iF�{��S�Q��%�#�����"� iӧ�W���$���ml�$�Kc8�x��;��z1�m���B���6�a�EB���31�L��-Q#5]����A��:T���ʐ���,F��Ðf?D��(0;�F�8�C}�1X�!k�t&�<&����i�����H�$��1��ڎ�!��-�2`C5/0Yޢ�ydS��oq�0�M%�'R�]�g�Ԣ���3w��b ���C��~�+cc*�mf�bR�On/`��9T�X�_'��g�St�}j�m���� _�-yل���y"�ɍ8\��ގ�������i� Gr�5˾�c�\.H&A���C��Z0��ifE��G�ٍv~�kn-TY�ba��)wT�%����7��~lbZQ���cdS�Et�(�V�[^y$<���6>"K@ �\l� �Q_���L�v�{u���3��D�ۮ3RD��mJ"f4P�����r\$4Ms�ښ>�����wӲ3&DW�ٚ����* ��rPJϝ�MR)E�M��A��@�AU�uɨ� �~��s��o�r�ɦ��pO�G���V��N���!hX�}G��~SHN����Pf���|������Τ9���~��_fOt�I��瓬%gf ���g ��)��X%pT�[=�������|G�R���4o� �.��a���'����'8�� �2Cp�W��������[�$8��\�$��]�]��ȼS��4��O8��Rmn�|+Ύ��KV�c�vʗ����Tǜ}�7|,1z�ՌVv� ��~��ٔ��mkh;k5�d?W"!��|�[���l�BcbS��Bt��%6���a�f1����q��!�� 1�.B����y���N���C�8�9�y}R�K��̧����3y��� Cas�� T�!�Ѩ���&ʪ��O�GB���U���-ץ��no©m�]v����!��D
Behavioral task
behavioral1
Sample
PackedHelper.exe
Resource
win10v2004-20240226-en
General
-
Target
PackedHelper.exe
-
Size
5.4MB
-
MD5
b189c7f449f572937fef0fc7bdc32262
-
SHA1
172ce9460a1bb4630bbd628a4dee1f7cfce8ef94
-
SHA256
dfab43124a69f794d2e1746639d387d9798f6b2d021b9556fd48231e0f278ffc
-
SHA512
56d9a92babf661f8565f80a1fdb4eadc92c2a3058d6524dd99d7cd77a0ef12454e2e02c66c5aca429692c80fc5b8a1963a33ca3610f9c7a9be9dc5d11f65ac4c
-
SSDEEP
98304:z8hnVpFLupDho8O5agcfxT16ZSkjvGj7nnSJm93VjT7t8/yxeNJkK:zmnVpButucfxgZhvGjrdX7tIioJk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PackedHelper.exe
Files
-
PackedHelper.exe.exe windows:6 windows x64 arch:x64
25713f1bcf37e17cb54cb526148384e0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ExitProcess
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 272KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ