qNvv�Q�KI̖��F�0�{c�f�G-�E ǔ�l�T<��H�7v�G��e*@_�yG PM͆��^�'Y�k �S�b��Zh��G/h�' �w��?:�s�x|I�����b�q���y>G,��C����B��20_�;vI���{t\b���'�l"���8 ���}��&���f�j]m�A�aKI����l��-C+���Y��Ho�E�G/�n�v ���F�G+��|4����t�k�"LYB����<��I�V���t�#�����_E[i��&�_c�N`��,@���K��?����9� \�O� �}ƣ��W�N ~T�k�=�M�-�k��u�q�r��E�5�� h��v�e��;��.� ~�=���������|ߏ����'՜ �gYn5��Q��(�J������*&48G�����*>�[�j_s[_/�R���v�~�æWZ�# �����%]�jT�c�`�3'���\x�����x����aݜ� �Bɮ��4����96��-����d�E��1���$slK�UG��W�.p�nT��Ƭ+��X=���r��L{wڲ�7�����&�N ����*����FO3z�^��OSZ0�_E�(��w�$��������k�]:z�=�%�������>�f)�_�3�U҄x��L)'��@J�z����]b����L�&�sf�\���#@�]lk��dS7�_���_}ˋ�Tؓ<���"f�L~8��O���a��3� ��)a�EFh2��P������'�|e��@�u�k����\�>M.�nx�}�렋�S���Yrfi+��*�J�v�ƟE���}���H�Y �ϖ���C����#���KE�����7|����ܟ�NC�ѻ&��e)�����{uq�h��"�D�HYl@ ��}�AA����D�TgLwQ���6)e�ل>�ݱ��J���_���Ԃ�o]��<���1��E��T����۔:^_�O{���~)��F�d��J��:�� o�����{7Q~�dJ���Z?ǐ�������-�X����Q���zB��i����e�Ȝ o�t]t��yj�>HZ&C��y�K����eu*��v�`=n�;�9�m2 ����d���j}�R�+M�zƛ�a}���̶�M6�pe�tu��TW�c[(H��A~ֳr�!�SJkȾzhn��QZJT��q�*?"�����X�Q�1�.2��=��E�h�9�*��Z�j~ʺeͩ9��Y\�~���$to�pf�Ǘ=Λ��S�Y��kw0p(�i��&a���_j}�O�lc�X�'��V�I�Ċ�ż�V�@Pˁ)k���Pw w���)SD�� ��ܳ�ϻ?�a��|�:̅bh%M._o8o���FC��XW|"��u�}����pF~`?�C$�z+v���9ͼپ5�a���x��>���P������U"�ψ���jmer��$������S���ox��f�ZgxP[7E��<\�m���hX�DMf�">��^��X*�]N���i�� ��S �X�������k,[���j�/U�5aEXcrm)Y �-�y�"S�S� �"���8���µ��� Gs��A�S�í%��gb�&������tS�S;�.��hZ�V_��ƭʉ�?�������]x[E�6�!v�s�M�Q�����x���|�n^��"�H�]G����l+%y�n���s@:z���\Ֆ�)�}�R��Sש�+���X>�VԑZ�G���A�Fi���L����~���M]pTT���8t�}+y)(4+<��`���E�` �Bo�q����^d���$�I�68�1H�W�[QiHdž)����A���*�8��t����&�Hm��k���'�-'�H��_}��N�/`�����*4��G��ufP�E邨/�l8���(w'�x���k+�}�v��&�Z���x?@�n�+^oh%&���˳���w%�3��/����N��ځI*e�E�=���;���ҟ�.�ꔢ�K��P#s�Y�W�z)���E� `K�d��.���l��~�� > M:�z^{����|�Z��+��|�� 9v��^�(t����h��/��o���(:P�R���C�=dUe �`M�����z/Q�QG��RZ ��:���>Y��M� ?2,��7�J��������+�J�-6����9�,���� ��1$TGUZ��r���3T���Z֍�� 4�����M�,-T�"#�G�-�~���FK�o0R���b�$c���Ym�Ωd�P*Ь��- �����������§C�kچ�b���̊ ��ZV �"�ެ@���h�=��~7@�?2��p�M�M�Mq�e7`4[)��4�?g����%�,��=�)��[UB^L-���ne1p��9R'u6d����xǹ?�G�؍0q��+�=�m�ɟ�K���Yi6�G"��e��iM��U)��{C&� >Cɰ���2�bkHWV���n���t;�-a:v/�Ɓb(�c�$��O<�0B:4�q�(l.����"����d��NRvq��i�io�K�I�py�v�Cꕗ�N��鴞U�����7U>¥Wo������zWvy����ʾ�#7)�[Έ��X�t�?�wqɟm��������t-]�{UFV�>�,N����ʾ����#���B����ڤ�� ^�~�#���'��j�����v���=�ȳlʇ:TXW��LQ�IE���o�8*+�{57D,1~ 2��S�����������ˣL�4��?�>*2q�Ⱔ��E>�!��ʅDd�.�Œ���`���pv���������\jU^~i����6_ �l����u/��6�d�\�s�Tn��I{�����r�������%��#'Ч ����[���h����B�E\o���Q� ����حR¼k�/��ך���y�̒'^��`����)��a�]/�``e�x>�\E���N����$��d�Ka �nF��-���������B�~����4)�ʆ"Fn�I,Љ�I|3i٢��[kkL�w��dx������f8�uݍ��x�T��%6
Behavioral task
behavioral1
Sample
asqwe23123aswds.exe
Resource
win10v2004-20240426-en
General
-
Target
asqwe23123aswds.exe
-
Size
5.3MB
-
MD5
9506af08f1c5f3929666a7afeaa8f43c
-
SHA1
0db6ffca9ed6dd81f047b2aa3559dc23f6bb129b
-
SHA256
bd01986fbce08588176c1dd632c1037fb2de20fd1629e8a3a1b905bb62660ead
-
SHA512
68376273a1573383eaa35471f538cac105656b44b7b0ec8aae3aad167ea10b1b8957f256cad9a9a08759525bccba1812bec130800c4b76a659ee6874190c2643
-
SSDEEP
98304:gewIpbLZv3Pt2NPRRfcHFdckY4ZbBzOYMxl6zNe0PJ3sUGuK:geLLh/sPR1udntZ1OPveDJ3Dm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource asqwe23123aswds.exe
Files
-
asqwe23123aswds.exe.exe windows:6 windows x64 arch:x64
5bcea7f70281794150cb8c2f08a94421
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTextAttribute
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteW
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
wininet
InternetOpenA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ