�el�Y ��f�l��n��C>�N�� �_�����dg�>�8N��b�8E��3Z'��\�KZXj/Q4����?m�Q�y��f��O��yJE���/�#��̇���1����ʏ�>�d�B���V Y�i4��&�y{5Q�����+R�(���E���K�Hf�����ThfR�����;�4}�Kc�����#7s����V!���ש��s�z��o�Ɏ)w���H��M����؎e;!�������s��Q}����N9�ҡ���g����wx��L�E,�J�І�,w��.�Tx�h1��iJ G��T��Nx�Q���3:���ȑ磄�� [����ڇ�L)PHhùT��A�LT�E��O�T<F-���A�;/���ۈ��Q~if�_��>�mғ�.�휁9����Y]�b5)��b$D�?�^E���5n�9<�I�#VԿ�&e��ڜb&�m]$d��&Q�w�#��Dz�ܠ���cz����4|ak�e����]�Q�ʮ���5ux��N��d#�Z��G؝�$FG���M���t6(�v� }]IӼՏt��<Tu_�P`6��W���2����|5��b�YI�������¸���*�s�t��b�3D���A��.��!�G2Ԓ��P�V�tWt���]X�c����mb��^R,���ď�yuA�;U_�@�7�j�p������ӳ:!l�$���r[b�,�,�˕i±Qhޣ~ʏ�?�p�*�;K(7������^b���|��˞r�}��i$��'�����B�n���X��*i#��^�4����Pʈ�q�B�������K��(�D5���-�X<w�\ �soZP.�{k���X�qa��y��~�_��b���Nεә�ŝ!sh�m�P�s�S�t�Sm<'&�֦q������Hq���%[&����lm��.,&O��v"�5��9@���"�3�N}.e���*���������L�\�w�N��$����ADu���R�=�s%�Y ,iL �/b-�>�=�L��]���1�\�\VK��$>ΞL���~��<k�gf���d�+���[��l�e����V-K���s��W{����$�֢ސ���;9���S�cG�dU�}��S^X����v&9Q���lV#�a�(!"A jޝ�F끎l��f�wU��L����E�>���a� �9��>��_�������6���~�����&8���Cˎ �61���W.�u��2%���/}Z���+��@�l��ԦkB �C���'(��� �/�T犌�7�{Y�X%Ys%b��`����!5�s@�9h�ʇ��U�U�7TF�(9~��q���/�� ,�i�C���Ɠ�u�� ����,=R�U��z� ��K��6g��GJ� I9t�2;*$In�+) G��E]ەq��>+���n��I��O��{����`��7e����M�gwfA��\�o<�����o�D��{�e�]��$d���/3}����I�%�Ϯ���XQ������W-�x�?��^��V������^ʭZ<]߿YN�c�+ew�q�i$�b��ǡ���ݨh*|+�$��d8�,��4���u�nS�8�Pȯ(�0+L��-b�Y.�T@-˝�T��Cwh�\��&^�G������?3S!��p�+s�a�D����Қk颊� �D����t>�l��n�Jy�.ƥ+��ޠۛԓⵈG餉��j������J�/� sv�e�t�0cQ����������%B������i��x���c%P��䈄�T����T�[yL��m賚F�n�@�kQ`8�����&|��f63sU-N�G�c=�f 2�0ӕ�(*d�]�v w' A~��[��tv� ����xD�� ��kd��u2��Ry�@���<ӛ�s�p���.�4��=�������F9>�D�u�m�>K��^��r�$o�=�9���ǚԲ;Qu���9S����1$�k7Ls�y��$'o���������Q:�&��I�&.���)���d7B�";��;@e��#��C�U�V�hcg������fO���_hAi��@�VN����T<��V��"TMAu� ��~5]��0])��0�ҴOl��_x#3�/���a� ����Ž7�D �[z�������/AX�_�p��Q��J��o�о_�[=4&e�'F�t"���*�8��E},�@&$�WL�͑�0��g�ӴQ���#H���W����j��o�ڰ��g���~g�ϝ�Lz�oi��`|7��qu�nd�ܮ�]&^^,5^�P���:�z���$Sm����˯G�G���-]���& N��$���/�,�|�n�](�I��f��zƳEe���qЉ�|l��3�Z�!W�����17;q��GQ�0�!�� D �2B~a�+$���H�29���)��x �Dҳ6��/K��(�5Xr�{�RS]��XL��Ʉ�9R�/�X{+coQk0���P�G�"�U�rc@��0?������o�3ÓV�����Rˢ ��N���6�!&�w埻�o�j�˵��9������]�1�O����L��rHR)TPi�J}4�(K�5s��'TrǗN�&Dq�G��@q�*���g���*`�BL_�� �^�I�ا8讞,��x���f� S*S��?� ��0��F�/�Vo�@$h]LM/�B ���_�Ɋ������^�.�'#G���B+\���jХy��幋{D�|xl�w}���S��OX>wr�R��M�h4����i3.!�*f�9���<�[�?�F������ �+��}�Ah��S�n #�V�Q�xv����bH��`���n�>ua+Ӝ�İ]�է�*��<Ц!bKv��w^F��㕃XB��@}���f@�������?-AF�) �o��y�8�i�DZ���nE�0�����u)Y�e9��@�����씷)��?����DN���o�)���ԍy��=���;'�#�.�BK���4xKu���yK��-B�kE�5Y�@I�\�vϱS�Vw6��*y�=��O}0Q2�8Λɿ����cM(y�Ƣ
Behavioral task
behavioral1
Sample
cd5a95319bce6868e7034ef3beb4148a.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cd5a95319bce6868e7034ef3beb4148a.exe
Resource
win10v2004-20240226-en
General
-
Target
cd5a95319bce6868e7034ef3beb4148a
-
Size
5.4MB
-
MD5
cd5a95319bce6868e7034ef3beb4148a
-
SHA1
ddee15368511a3b46ca8976ab26b54ba20e10ec5
-
SHA256
a964a701cb2ea36a824170fa6c24540d758b5d4d3ce611883fb53987c4e8de23
-
SHA512
1fcf673fde4f75ec685c211d698c3e9443e4cf9898931b5b9ec6ac2d910460f85883fb2e889217e14aa510f6300071ec35f9727fec9e59e571f86a3a3ef3864b
-
SSDEEP
98304:0zRqEWiKPo6fW8kEjYPm4lt98EiBF7cpljhOGxObDEjcHShhoLW9D4D7DPg/dtj:YRJWbtkqSm4lb8E87Sl5uuh+LCD4Hbm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd5a95319bce6868e7034ef3beb4148a
Files
-
cd5a95319bce6868e7034ef3beb4148a.exe windows:6 windows x64 arch:x64
892554a43d9840ba1595fbc6839cab1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winmm
timeBeginPeriod
kernel32
RtlCaptureContext
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsGUIThread
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
urlmon
URLDownloadToFileA
winhttp
WinHttpReadData
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-convert-l1-1-0
strtof
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ