���՛~�e9�Cdy�����͚Vm�d� ��W�O��'��24z$�@ ��8���Ŕ)���zݓ�˶�Q�7�q�)|���m��S�����*�*�N4q���;�";7o~���������Y$�@'HȦ��K{�\a��eTP��z�?�`�V�ôm/�.�B;4������O�*�=M��-h���c���з�a��ĭ� ��r֓t<@?�]��1��W���HswK�d��pV���R)��E���l��x9U���iW�}��;f�|���~�9���*���kVV��'��Q�f�ϒ�b2�Oٝ$��d4Ћ4����-I�����3��+f��"���\�2�� X���70i�:S5v�"R�yg�nDEC���w뿾����f+3�����cw�c��r�o��ݝ��B�3��d"���W��JYZkq����h�_|:��u�,�zn�+3�i��#�Ia?|�A{x�_WA�@��Y&)�<�|˨�0��:O��\S��Y!�FN����B�N)^Pc�T�V+?��� Z���2��іp��@[00,��r���=Ah���ݺ�]A�UWR�q1��p4L����K�]�b�ѯ�r}fhdVHm����zH�hߠ{z2�*죓�Lu2�\!�bs�i� ���`������,���հ��7�H8J*�`��C������.�aLi5��=�8������*烓M� �q��^�s��9>a���_���$c:�G�'C�0#�ф�!�3O� ��c���F(-�PO����cJG��d��ÒcY�mlH�k'�{��*�X�y#K:��-3��h�O]J�TT��Y��f�V�V12s���զ��hH�M@����"���g�S�)��c�g$�p�q����5sHYT%����d��߸8:�]k=V�a��p��h01Dž +��꒗��7<�Ŧ�Y����{�c���9���Q��z���`��s)��B�Yk+���#��m�!���&1�]+Sl�ބ�!]z���.��L���-�K��w\[1Tބ!R[��"�`�V����R����H���<���&�9}TMs펣Og����L����9�6n�q����Mt"�pBi��6�� ���;�N�>�N�e{�XK��)�e��aK�âU~�og ��5L�#jI.;��h���I��d�f�yf&�}�`���Kk��Jꨆu��� /~��a�ڄ�@���+\��ɩa!�?|]l'Pp���PK��СW���]���+S���Ѹ5��ܽС7��.������`UHR/�Yy�x�N�Q�����G#���u�B�� S��\����wS3>�����1�ɢ����V�}�L�2������Q���'R����*�n���������6��Ж�ܔ��׃&��=���,MT��`��h� �� ��gsL� ����F�_f��]�y['��g{�=�)|bґ/������v��M��$P��ۮ3t\����Gܝu��a���̨p��J�3l�zK��g�ԃ��\��L��9�����ȡ���&��FXY��-㡈ғf��Cd"�)����Vlc�f���𬝏�x�,m���[t�t�{�$Xw���k�ݒWm��3E��5"���m�3��CFA󠄽8g�H�UȲ'��O��h~d�.̯�Hd����U������������^�����~z�s��Q���}�y�td#��S��@{S�|B��)��O����l�̰ͫ�34��8b~y���+�·�p��%�6���sH!� ��4��8�'�w�Dj�.�~�P"��e����x�ґ�:6�Q"%��p����_X�\җ|� ��U�.H��T�,3�&edp�*0��ϲ���ŗ�M<�,�79�m�q�5d�:��1-H���E���2�����Z�:v��ՐUv�Z�F3�9]���1Cg�"j�C�L'^��dw��/H�g�迼��,�9!\/Z�5�*]��}�;_Kܢ�M*�Ր��#~���]��*q�LE5����N���s��BAIƲ��蚉Q�,�s�����H!���aU/}u����D�^����0*"����Z&p�&��J����^����}��&�JqH��kެ^C�/��Ɛ ����M}��~w6i %�������n�J♩~�C��2�c�"� � Ҩ;���VK�I�4�ݴ�� r���5��,�Pm��!aÙ�%�Y�[o�(=X�-��c�iҴl䧋���u��o��A�E�]�k���;����Y��I�ԯ�����B�X�����&u<>�̀_xi��$�o���G B�Mæ���F���2��zS;�k��۰��t6��u�K�:���&���l���(�xugc��G)#~&��oi�e���q��c��<�B�ħ=�&E4��)B�������������1��l�'�UOk�=�q�KDЇI��z�/ǩ�!�U9��>I�Z��E~f��b�o&�I�d�fs���2[ühI6�CI�y>�ڦ���Ă��3X0�z|ծ" ���h�n�4���e�`���=���W�A�%xWN�2�ɥ#m��Ưw�,N���Vn� 4�.]"�5�����D� H����%�?��'Ψ���=6��z��PY����"]����4���pí.ye�= ��\����d�!�4[6C���ERA�.�ޠh��1u�AZ0U��c�27&�,X� �Y-��jXxeS�/�x��^Ž����3x��|[�=��ʋ�Ô�� �o�l�"�7�1 ���\[��M�&��y��+`���� �%�KN������zrK]C�H�hfMyQ{J�~s�hA��u � q�%�ȭ�&21m���İx���O�A4g|���z�0_O�>�|dqMf��?��l�bƅ4D`�EJ�^��-DZ�P��V��@�&=p��d��3���e}a_��^;ҰhFd�Nv�U�����h��O}�[�uh�Y۩��� F��WO\6�����W�:�V�>ag��O�Ƥp疟AQ���m��'��&��O��)�&����z��
Behavioral task
behavioral1
Sample
7c7bcfdfc7a49ba2336dc879e55f2353da32017e90884d4ec11cfcbf186ac0f7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7c7bcfdfc7a49ba2336dc879e55f2353da32017e90884d4ec11cfcbf186ac0f7.exe
Resource
win10v2004-20240226-en
General
-
Target
7c7bcfdfc7a49ba2336dc879e55f2353da32017e90884d4ec11cfcbf186ac0f7
-
Size
10.7MB
-
MD5
94bb3d23b9bedd351ab820e1a4582225
-
SHA1
8ec0804951edd731999ad43f609843cda1df0df8
-
SHA256
7c7bcfdfc7a49ba2336dc879e55f2353da32017e90884d4ec11cfcbf186ac0f7
-
SHA512
f34bbee445cb65cee800807ba4047dbab39fdea0b711b8ece25072463270d86bee12bca850ddb5ee5114d7c7fde38b9d6d4a7eff08c58481db0ead70032799e9
-
SSDEEP
196608:SbBVFQ+37J2uhBw8eashOfuX1ZSxwtbbGBHUFIP2qsqo030b9+nbVfhv7:SbvFj77A8fseeSwthIP22Oyfhv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7c7bcfdfc7a49ba2336dc879e55f2353da32017e90884d4ec11cfcbf186ac0f7
Files
-
7c7bcfdfc7a49ba2336dc879e55f2353da32017e90884d4ec11cfcbf186ac0f7.exe windows:5 windows x86 arch:x86
0895b701aaa07be5304d2462dbd4bce7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?qt_metacast@QParallelAnimationGroup@@UAEPAXPBD@Z
qt5gui
??0QColor@@QAE@W4GlobalColor@Qt@@@Z
qt5widgets
?metaObject@QFrame@@UBEPBUQMetaObject@@XZ
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
libeay32
ord492
hidapi
hid_init
msvcp120
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
msvcr120
_fmode
ws2_32
connect
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ