j ��Ӏ��X���b� �D����}��8!ɫ���I�^�'��Чd�mϩ�-�}�&�j�qv=b\yu`9�.���ݖ�N��w�������]5��W�Ox��1�;t�λ�x��Ү���^���M9�$� ���S�^3�}e?��T�1"Rx�Q�����a�wlH����:��R�x�܆�$�j������__M,�/�n_�����;��03�g�� ��9���i����p��tT#%U������-�:v��$Q��<�^��a�p�P���;}��9k�l�D� ��6���!8 ��uE�x�Ý�1܆���<��O/9L]������X1�=��i�VK�5�{�\mٌ����"����"(��-`P��o C��)Z�M��x�)�ee�r��O|�ݻ_��r5Ś��EA�x�0dٲz�4Bo*$&���'�.[��pYd����l������W�6�j�j�y2�C��2��K�F����ثKT1f�z�~�u��-�9w2�ߥ5�>^ť�^���� ��� O%��^<��W4c ��#�.x~�s�J��x� <��ڗT7>㙬��������Q-č����W�@?�$ � �����@��� ��5�9!K'�B����RB���4;�n���s0�YR�����%T��%(^Z"�%�=եR�N;����Z���z��1c�2p,Pk(x'�i���S��rְ��vo8�ākZ�����df���Sk%_g��b��*�A����}�#%[��2kTV��K{|)��}\��[x1����X+"5;���%�2�^^e�"i�Lk���\��o��[�H��zŸ�@�T��p�"^(9S�q{FX ��[l8��Vo��t�6@2��A���W1Ӯ�핹!��]�(�n�%���p�����\q¼��y1��'�_B��� %�����2���J�#H|0���Y�&����nPT�^�<kEEA%�i?8�����F�4\�(b��̷s�%�X8#>�){����?g{�*!<�T�~R����ރ�T�2'T]�z�476W�>� ��a��\࿉?������>�`˳fS-�G�0-��'|�^ \)�f�j:�~��g��H��j��rV��{N�&pM��#�2�c��[O�yiP!����M��k��&�?�m�� i� 0��r�T/�u�0����y�a�r��*,����d�Ho������A�j�~����D�|�u������x��O?���pP?B�ӗ4�ڽ�LV;�ڐ$t-i��j Ia=h�&�l�Ȓ{�A�����V�����k�?����[4����nն6ދ�o^,�{w��'�"��%� :��Éc���<٭����o�d�"/�Y��D��>w��k$��E��U ��h�� ���,k�r���ަH!�r�����Z|� �cU���}�")L��c%b�_��U��$�Z>�t�#�& }�������X�i��e�e�Ѵ������gAB�Qp{(~�S�Yo=l��=|O� ������\S_4(��S��Qs��,��>?��&�+yk U���������=Ėg�ѐd��U�D�qmv�N��h�=�g�`��h�Iv!�MKj���z�8|ɤL��F����>��54d��pDoIv���E�8t��|]��o|��X���S�ˤ���m�x�Q??�� *.�%�I��~k�c�Q���Z����`<ā�'H�!���#�$��Dd���6!�2�K�"s6�������˵]�T���*���O��� �'��֥C�p����~�gp����Ps�����q�����*K�����p氪Fۜ�� �പeJ�u]jU��J��OrɊ�;���1�S��Ȕ��������j���Z'r� ����;:O���B�����ұw���B��;��l�9��vp���Gbr�{� ��k�ۚ�˦���j�a �'�K����9�$E��S�����6_��8=ф�S����j��F�<�.#A�M�00C���Hh�(ah%�� o�� 77�@s�DM&�J� �V«�I���̽%�I�y[/MTk���/�6�� ve W�D�F˟�RA_M�"زI��z���iUq裳 -_�HjhArQ�l����f`�,����/˃�8�;bl�P�p�*�S�j�-���Mz�{��X�R8�=��!0�o=�/ـ��~,a-@'�GOrje�����ލ��roP*̙PG}V4�� \�Y�'Y(G�=��G>�Ed��F[�(�&�dD���cZ��a}~���}��T�$�Gt�=o������}�N�w�i��Q��u�&�n(��w�%�>B������+v�1���қ��;`68ٻ�NΚ����XAmE>��ˊl ��ɫYuW�`?��(VV]���ٴ�*����^Z�c\���:���b"l�U>x9eO:h#*w|�Qo6Cl��6��؟���{��n��������tB�b��n��N��>��.Ղ7CC2\lqd]9]��B}]�����u�Ӄ��R�ؙ�x�04lc��/ [��E �l�b�hV�Qvi��t?��u� r&њ0`��"X��K[�b\�\��ܟ�pxs+%ý!F]�Ҳ�l4RrL�(�*�$��4ц���p����=�н�T����:_� ����4(̜e�t�[ީ.��ϝ�w`��qc�J6M;K���Ϙ]7�7�D���-:w�������x�D�֗��iI��N��0������ύaod?z�����e����YI�MlL[��>F�z�Z���LwsV�'�~s��6�{E��/�3?+6�$��=P�����Lb��^J1�Rh��K��0`��c�N�����@� ���ʖߠ^U����/�� �D�@��AO#�o3 ��HTXr��Ձ�^ƻ�1�~���=)�MA�(���ț��z-u�7����g�s��.G��ZK�����H�]�v!k+YF\��6��6 �0"0)��`R�T��E���gxp��{��^�K?J�;�C��{���c ���|����-�������>��A�c]7�*�MɇW��*�_��9M�
Behavioral task
behavioral1
Sample
loader_1.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
loader_1.exe
Resource
win10v2004-20240426-en
General
-
Target
loader_1.exe
-
Size
7.9MB
-
MD5
24de694298ae84e094a3541d8476d39e
-
SHA1
8e0d994e73a6fa627c2823f042f0b5d376fb741c
-
SHA256
a9acc153470cbc7ed6bd9c978dabc0e1c2b8e7b2309fec2c54b8e9610bee5f69
-
SHA512
a9905b57f3b48153b0eadd10de34e41c9f3006cfbb8daa472cc7ff0612b216d08bd5d9dbb7ea535b3ea5bbfd9e51c5903adbe9d0087cd4ec18b0f6c6b3476ebd
-
SSDEEP
196608:PwLm5kVBnXOw4K4i4O8X2rqwSpp3K5fSe7JAh/ajih:PU0xK4Bx2WRvK5T7JAhS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader_1.exe
Files
-
loader_1.exe.exe windows:6 windows x64 arch:x64
cd1bfcc4b5bcfaaacc6979592aba549a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSACleanup
crypt32
CertCloseStore
kernel32
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptAcquireContextW
api-ms-win-crt-convert-l1-1-0
_strtod_l
api-ms-win-crt-filesystem-l1-1-0
_access_s
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-private-l1-1-0
memchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
_isctype_l
api-ms-win-crt-time-l1-1-0
__daylight
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-multibyte-l1-1-0
_mbtowc_l
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-environment-l1-1-0
__p__environ
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ