� ��f���) 7�~����X(�ތ��`�2�Ӎ�OB���������C����f���$����s!aݮ�Ѡ]��i�d���w���.��1�m�x��=��qŽ��8��x5���5�i٘6����Jp`����+�@����q���-lX�xɟs"H��[Ƈ��� �J�����w�g�jD~��L����tb�1�)��7����P˹S��}1��UF���a��� �Rq ;~��IY��WhՍ�J|��)������x`_ՙ��(x,t��yCY@þ��IpW���N�ī_�"�s�,@@� a�5��"=��NM<$(��phqm�X)�d���"v���6�0ݗ#��g��Z �c���9���عf.�m�h��V���>O�+tk>��R^��KO�w�LE@2�`�ϭ��v\������Ǹ�<�Ƃ6��ݶ���ؙo1G�"�A�RBH�AUW ?���'έ{ʆ����]S ����69ҟ�'y��F�[iR���Z�8S5-�&SO���������� ���K�q��Q5���GIr¥���]p~.�Ťr�J��0��Vz�� ��p#X�=����e��5j��T�-��`s��N�����q+�K4�]d��3;�A||�}n"K8ʐ�z]z��:��#��z�c}�a�Q�k�k�v�@�<�V�����(a8�>���d%�pE�8N�m�k��v����S��i �&�~���6��<�� S�,rτ���"�ջn�@Y��rļ�̛h���4auw���{��wQ%�ܽQ(ZWy�F!sZ�!�֘ͅ�j�4C5ֿ����t��gɋ/ѩ�qU� ?��8��t��\��/�L+�&�j�?��PU����e�P뉈��������G�~��m.�2�Fޒ1[gشD<�}�����8H y����(YB �E`���D�X-V�$t8��+Pu���ˉLj�:Qic�#3)�ꯛI��t��Zo�moS;S�wLK94�pڄ�bk�OǪ %����[놥��d������;fd�]�Φ���W�6�E�ʦ*����j�=.�c���`� �Z��Ȑ�:��[KX���+2� <�@���D)6%p�m�����g�XB���9�'��FwoP�!�vG/��AM���p��$��`1�q��M���חg��Šv?�����"�?T�/��'�~7/MR�2o�|�J,D�pڰg�cY�m�yR��m捣F���f =d�mT݄$���W� ��Խ h��]�3`|�X��[&�����x[O_q���*a��`:��ZyGz�?��`��_��F��rDJie�3rS�GA�ezz���P0�� âe�Nx��x�� ��\$�@���}�)ϓH�A�тm~�dӝ���W��y���#�o���+���YC�{iW̾��2 ��� ^bJj4�aY�|%��ȥ7�~��U:k$g��y3l�5H&�7����~��q�.w����О*GF��}*$�}x��Me\t�.Q�K��6��%.��ۨQ�n,gѠaVK�o���H�~�YH��8<�f�28|&n:����i���1퀷������G��F�% �VJ�o������&P���S��T4e��DvsL�嗟��?E*�V����T�d�ڮ�n�����f����Eߋ��/1E�BB���fV��cl8�lkz#��du�d�+:rG�ik�w5�u�±��'-\8�:��]�&F�Ț��!߃��[<��R�R\�s]]���o8<4��w���L+ �[�Ϣ�(�b{�8�A@h5-A*�3��d�5|�#(���Z[D��w��q� �^VOm�Ai�ё��3t � �+�� 7]D��� �}me,m���D���S+��:���2�މ�D��S������Т��� �m�n4� ����uI�)=�x��)}�ȔbH.�EQ��u����~d��?;��3+̔�MU��_v* �O�[e�,+u��e�B�ǭ�cGJ��3�!ߖ����a��iE�o(�H^f� Ɂ�ש���̒�qpB"愈�-�^�-���>qds$u1�ᜥ���GЋ�����x��UP<�|W���訨�~�����{����[(����7gw�ն�'Zh���p�~I����??��B���/����U��nJPÝiS��Ka}�����`8Y�4�n��IP�$UaFt*��1��i� 8��P����e*x�o�>��� as�'����Q�qR�#/m��]3��e$L�����@�oe���Y9�.7�l)�P��K����~wF����0 j!Nb���P!�EN��Sls%ݳ���o�3��M�U����P'P�����4��FX�>�0�Z��� \��Ku��.�Aq��>!ɉa�n� �T����:6�Xb��)��r|M��,3��(�#�|��e��Y�b«YC��r�R�H�_�����3 ��]��.q�F����#��|��l��D��Ky���A�X�ӱ���|�2F+��ya�Qph>���4�:1+4����2>���=�[N��wv-D�g��vz���@�n���%��a�l5���6�,�W��s������50*�Ro�Q�@yv=���J �l���d�%�r�=���BOY���j��`�� �+Q�Q���G��Ja"����V��~���~���1�Ɩ�����d�( Ů�tu�P� �`G�/x2���93sϙ�A{��: �@uv=?J���s�������d,� � +2��ۋ�Rt�-�]��X���8<Տ��º4�M{�"Ĺg�k��%_0о8,l�K���"�]7�i�c{���D�������?'�.������.�����O��a�u,�\|�>gA{wB�h��8���4�q4��9��� � =�[C�������Z��ťd����24L2�"��_2��� i�|Xa"���Jv���� ]#t�����@x.� �3Q��?��3ňs�ͦ'�W�Ql]��r=ј���rt�Z�O��馏��<'e�2ӿ���ʩoS���'I�Ui���kM�$&�
Behavioral task
behavioral1
Sample
fvZwhyC.exe
Resource
win10v2004-20240508-en
General
-
Target
fvZwhyC.exe
-
Size
5.2MB
-
MD5
b18b0895ef8328df9d20b236d411bf93
-
SHA1
0d80d330a80b36422fa3d9975ba59ffa5284e7a1
-
SHA256
798281b4ddeb59cd38c9d39805434e12af3c59b598eb733b46f7bc311623affb
-
SHA512
e48e920b6d4b79607a8165c8564bed8e5df2ab01034397905929ca909e963854b8f418f6f55a6b82e74e1b9b404f335e3cad2fb595aac99d06e58d63068499ac
-
SSDEEP
98304:Oxk/JE76vZ2/nLRczTaimKwHIcR6zgR+l1FJpffocb++ZLT:Oxi2/9cPaimSE6cR+l/JpfXZZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fvZwhyC.exe
Files
-
fvZwhyC.exe.exe windows:6 windows x64 arch:x64
dad2cce649bb2152112dbdc997f28263
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerifyVersionInfoA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnhookWindowsHookEx
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??1_Lockit@std@@QEAA@XZ
userenv
UnloadUserProfile
ntdll
RtlInitUnicodeString
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertCloseStore
ws2_32
select
rpcrt4
UuidCreate
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
_dclass
advapi32
CryptDestroyHash
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ