��z��gǡ`Y�U���ell��G��?/zGK�ۄOx�0����Žz�{�I���7��/R�0M�ۏ����$��3��:�G�mZ�Cz��M�Q�mBP�h�9��W~�VkQ���y���t5l��.���8�z&w�$<�v�.���7<�G�&�9L���S�B4�M�?��a�5V���t��z��u-J}�_���n���^���6�1ω� �Y���--��'Xf2��Y�,�+s�"���zq�`����@��'5a� pU���f0_�V��`�G_�t)[qq���o�e�rɋ>}���,4������:�P�m������w�s�&�7�^H1u S)�5�����`f�s!lJ���T�(�7��k�����$ѣ��2�����P���������2��b��~������V�NDȑ� ˦���a*T��!s���u�Tyc�pŕw`H���U�Ӻ���I���֘(Ϊ��9�2��G.�q���HnEfT�X�ݑ�ي��2¦�E� �p���DG����p������\m�QW��v9o} ����oD��<2��&�*��C��&�|�0z�*�qv��V���a3��L���I��KC�k�A�7��jWHO��0������xB-Ü��3�ψJP��ےzOXY$-����D��0ħP�;�Z�J�����X�w��FYU4b�%'�� l�V�����.&�#���+�c�Dȥ#�x�\ �c�,q�2M=f��E����a����M�S� U�6��������c��t=_�h�"� H�]�+�6/�����7�����o�rG����Q]]^`��`ol �]�:�!�1����v���v�F!R��t`�qeQ#UD�|-N�����mf�Ԡ�nԻ���;&(�`M��T�>^�-R�R�,�������c5��]kk��z_�e%�z+�cE1��^T��.����@��yx���Nn��]�fo!��/cr��<H���au[7�+�[+b��CA��bxF������5i����)i��������N������ĸ?_t~�\N� k�#>��`2߰��=���w�4�����D��Yx�%��&���p@8Q(�:��|�Y�����|>?����*�r� ܮ�ۯ��2ņa���IF��p�0�H�J�#�"���Xib��r���]9�Q/�ʉ#ܲ��l���{��������l�(`p�P��E��0�c@��)���I>�F�������pj����V���2��jN��p��j(|Gk��{�6�}{�,i�۹�68��tЩ�RV����څ��y�k�o�,���� )�eL�� ��2��*��� $l{͚�����X`�����(Ĩ�)'i����1����m6n��1 �̷��#*��~��`UR�)�d1���"R���5�%��@�����5�7��8'�N��q���G�ь�6��:H��MNG��F�o֥�V:d��_�&�� �B��P�[�W*s`�:���6ֺ�ל��z��U�[��n��Ov�ќW���v-ksr�T����m���mO8ЈRB��H�8q�ɉ9>�5���U<��y�� ������)�^�|�@Oz*A�-��?��) *��ƥ,=)�����)���u�_��K��������X����[l|��'�z/D4?�ҊP�gx�f�D��g��o�__B�r7kR�1d=[���{��')��7hUƐ���Z�u�4��{ϐ��z��P���§v�����f��j����a���o��W��].xNA���]���v����I y�+f��� ~m}7 ���ڗ*��zV*�,Z}1�p�2h��/3������-�D�!��0�,ylm���[gh���{�a��`OD��v��:�����gP�I,����3 ]��زX��rT ,G�=����!YJ���[�dJ}$ꨴ�����wo��z9xe �d-9%_EG9����=�2�0�ɸe�f��E�J+r�*���%��u�&�+�w<�S �M�~�3s�bܗ�O�/��"Dm�t!`;m2�s���"=���;&.��1=̨ҹ�m�XxCْ�����c�[<=�~���F�nYK�!s��;�Y�p~��ʼ҄��,�W���&���>R5�� �9ɳ�� }��3cT�yD��Nd���˖�����j����rs ^��Iם��*�C^L��!$��%P>(���_���de�_���>��%�����>�b=k^����uʚ�n�h�s�V2T3I!NS����Y�#�S���K�׃t�"���-�i7�Ł��q1�A���u�#�0��/Ng�jY�8)c�OR��^2���o]Mz����t��m�aY"��r��M���&3"n�>{���f0��S�K%e��R����N2��Ӧ!� +���@��R,E��*m��y�d6QS�����z�˖#��X�TVp�S����f%���n��M?�A���F#!�B�C��\��s{[�|��@q�C��F1��k�'�� t�B[�N��'��`�C Ő�d���>� �E,���cM]p���!�(�=������l��%�ڙ���&���^�Ogb����M�p��@��F���k��M�[<-=����[�x�llDm�DfC� ]hAeK9 �B��e�1� B�2���\E�`�k�k� �����\W�R�Fa*ź��ş��F�0Ȅ��a���{ӭ@�>)���\V�O�0"�=|���KL�wx�.n=�#��$��=�!{�����V��� 8�i2cɵ�`��Cl�h� uh����$I;-v�i�q�/�V9�����秱�%� ��?��vujT����8��6�R4l�ܹL3"�i8Q�9C0���רS�G :V���~ۻq?�u1'��� >��.��+��-g^N�_?=����/����ߛf�x��xGڣ�N�q�ڸak�5 �#uxc�J���s{�nD�|�� ��!�_q ����[m^��t��{��K��.}J�$�fl��)o�Ѐr]�N�ă���z���7��Ҩ \>(C�5p����$��T�ڤ�8,�acIH� q�
Behavioral task
behavioral1
Sample
skuld.vmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
skuld.vmp.exe
Resource
win10v2004-20240426-en
General
-
Target
skuld.vmp.exe
-
Size
8.1MB
-
MD5
174569d67669c13d4b2409637121348b
-
SHA1
51d1052973bd61a9f5f471f2995ca06e4ba23058
-
SHA256
e8f030f26fca7438975e013e08a7b8b4350ecb3da2f2dd0899de9675b6674e89
-
SHA512
38aedaeaddfdffbfa037b6b05874cb2ffd8a41e4f5612de6265ece1cb6acf82ddfc5bdbc2e076be6c521fda1e608113fb6b1dc1274e1b39db4fe077aebc15569
-
SSDEEP
196608:se5x0vqKyqp9MjTM1XLmCmCN20+KHQ8/vDBum2gRoI:z70SKjnMjTUXCpI20g8DsZfI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource skuld.vmp.exe
Files
-
skuld.vmp.exe.exe windows:6 windows x64 arch:x64
d910780e43eb6473c6ca334d8a16a8af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ