�t\AE+�܉�D��H~�T;@A%R��6�a���̋x��'��MU)"C�O���>yP��ka(�SS�zf�yO��t������Z�*q3"�̘�rG��Y%�f(�o�#��mU �s���B���X��S ^�K�N��U�Y� A4+���V���5����u+o��o~s<��zS�t�A�K�Pɪ'�.��qX�Oo�D���I"�!�5��UI��r����9:��Պ�n��D�hn����:�4��$��zrbP�e4�*��h�[�!U���=u�����!��0�@��W�_���Wɪ��*N�oݬH�T}����$a��͈�e$Y�YD�����B�����m~X�O�Me��v�A�5?h�����0��=��f���P��� u�P�3-$N��@ִ�ueZ��Ƹ8a���O�$�S�mV7yC�%{߳�!z}g��7��>�b`�S�~��3$�蕁�ht��aL���ڢ<"��P���Q�={0��sA������K�P���)�5�5t��~�5��t��.���j�#���%vy#q4a �l�Ō�G��7)��vp,@蝝z��r���tbb�.�窲xX��ꇾ�����&�;a���]��ϮU؍��< �:�����hQ�����C+���d��WRP����l�n"�ܢ�֬�0�T�O���ed�H�1YY�{�'x]��/����s��>��|����pl��A<�)������3�Զ�߾�|/��l>������{C�@d#�O�T����@ &��}mPΌ�K�vy&c۬�������A���}~(C?�2՛M$+Cҭ���Rg$K�nt >�����B��7.F��>۞<���H�u��L3�uάN��e�jVż���4*�T�S�K�P�P651���bӏTUrN�E���ʸ`:�7������t���b��| ��Ð#���~g㪼B�A�iIЧ�$%y�6t��O�O�cl����tS����v}��ė�6�t�TL<�sD��Y�FO5����'I��vX��_v��$�Hl��7$�&�V`�Qq�������Q�D�5_v�xC�&r���D��8I�6[�B���b���IA}�٘S������D�<Xg$6d.���ʖ���r�̓��Ќ*���*"������8��4{�n�����ߣ�d�½O!*+Ѩ+�뷠Ӻpx�c(4����C�(���C:��;W��y���y���������B��K�4ߎ��T ����$��ǥ#���k�z�ǩTչ> tqɣk��zD�U@��f�'�Z����g�|B����d���R'����~(I����_��857�]kd���y��WcI-��TI�1����ѳ}n/ V��IO$h*X���<��R����b��h��K^徆�����M4�]�m�L]�����.��#ɇ����h�Iy·a~�Y5$xۃ��������!^�썜YbQO�R ˰!�1��������8~<Zf��nS��ۿ��`9�,2��"n�`F�.`=hhX&БaqN�=��.h�<fA�3�X�*�0����H�m��)1^��9�F��ⷪ����q�t@�g����A�Ȩ��Y��$�G�던�ܵ9#`bx2�;6;I�d{�'XR=(�o��:����������;�=vo����e�"b�����cͰZv]�H|�H��o�Yxs罰�-���1oͦ;c@�d8�KbW2�����_�����i*so��ť!�>���Pk���pF>��O�d�E�v���_=Ni~C�y���$OL��琉�tܮ w��P�ܮ�B��Qc��,O��&&�OF�yY��-z���~Tsv��(�I���� [�����E�pO���/*�J;�����2�a��N�h���I��r��t�q����~S� ��e��y�ps����`�����6��>�����|�6�M�����b���W�6C�`��*�q����[�ao �ab�|��?���V��0�\&rE�D�G��(�b�j"o��E�^$P���6� )��a5�5��K߱�LY\Ѥ�k%ڔND�`�q<�-��~�ױ��ࡤtN��`���/S{�4�~���/$L^�uȺh5ja3�ߍt�od���s�=5vK��77L���k�iϕcU?CA�g|�td��ʚ]�N#Ȼs�o�����' y2����{��U��� :���X��[��Q᛭t3����d'z����B�P�lD�7�Dr;~��g �W��=:v��e�����3���w;� �i�q8 q��t��<�����D�G�I�p���x��{�R_�6��� ,�]�#B��-��7���Wx�!{ ��uDݏ�7Y��ѐW{`[�Q�P�����tؕ�O��Y����px����������M��[1w]�}Y��/���( mx �����#�=2��6+���Wk��s^�}N�k����>�-����%mc��zW=��^>i��a܂����}�y>bW+ڹL�vdiZ #2��aK�l��a�c(Xv�ZO����w��Yr[��ŷ)��a���z�~�K-y2�h� ���s2�%g>Q�?T;Uo�W8�Ì�@Z111��3Z���T����t���pΝ͛��m���ڈc_W'U�8֪4>Ƥ(�T;0~�[e��&��Vr�%�GV�e|[L����P�d3�|� �D�MR���� �9��O�Đ�ke�oc��Bt��o��dğn�5�y �e�:�]�B����Ru`T3�?[���u�Z��4[��ݮ�3�DE)8�3��탐6���g)�����8$���#N��M[�Y� ��%�R�BX��IQ��ɟ��Di�dA�ItkI������M?ˠ<�#���bI�L�֞ùV-�S�fh��S-%pkF��x�H�e�v5jb�\�Q�.�ݍ]4n����a0q��Cݟo��r���s��=D�\���E��0 �k���B���&��m�b̐���.4��!�C}�� w�W1��Hr��$�t��~�o5����PK��Nzc]�ö,wv'y!?�%���Òz �2�a\���u��
Behavioral task
behavioral1
Sample
sample_protected.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample_protected.exe
Resource
win10v2004-20240226-en
General
-
Target
sample_protected.exe
-
Size
5.5MB
-
MD5
e5e6a58ba1cfbb63f8a61d02012c41c9
-
SHA1
cb13b22049bcbcfd2df45a475dee8a4306ff7575
-
SHA256
bd2047afbe10451709d67f81e1e822a5e2a36b0ae9f12167c2dbb325893f0b83
-
SHA512
b9427686d005c9c249ebed9e4552368f6b31bc58cca165c7e9fa2a85a8abd554730fbd213e6f2d175aa74f25593f6a2a460832ebb602ede938ddefa6f94219fe
-
SSDEEP
98304:iExGDL0ZIVPyOFR6LJ67LSK28kga9noiGr3NjwAMjvLha8um:iEwL0ZYHFfvSdgaJweZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sample_protected.exe
Files
-
sample_protected.exe.exe windows:6 windows x64 arch:x64
e701be325d8f36a575fd353465905c0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegEnumKeyExW
shell32
SHGetSpecialFolderPathW
ole32
CoUninitialize
oleaut32
VariantClear
msvcp140d
?_Xout_of_range@std@@YAXPEBD@Z
iphlpapi
GetAdaptersInfo
shlwapi
PathCombineW
mpr
WNetGetProviderNameW
vcruntime140d
__std_type_info_destroy_list
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
_callnewh
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.textbss Size: - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 595KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 373B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ