�+%��t��,X�2���rN���p���<�y��D��;7�������g�f��� ���!A`��\s�Y�~K��̷b�����?��ԅ3n�$)���;�T��]m���-�3����Z�q�R��q����Ar/a=!hY�Z������w�NWRD�����LÇ�h�}��N-X*�k�z-����Q�ÿ���<��}�֝�2�uǁ{@�f���$�&G$����;���m�l��1}3e�Zgl�����Խ�"<g�]ݦ.�6��4��9.�ej���E���w���Դ�#�lf&s_ �� (V�xO��5|�_KT��u�����l�$���$+���+�;�!�$����I�B�|'>\��I��B1]P������G�J��'A)��طI}�Tm&�u���8�p!Ny�{���p��@�r�tMȖ���G%dO�q|/,�Fٱ-;$���k��.s�Z����b�XG �^Th=q�R(�%��sS����|�ɪձ��J��<��L^[K�_��p�ĸ)PU�eW��/�1���"Un/ ��d�ɜ6Ud�xڙ�<N�>Rv\��A1^2�bJ>]m� i\s a�O�w��2�3���a�L �2���WH��`w=\��o������`t(�A��4���w�X�lW���T�Z��О)W0Ч ���1ڻ!�d�C."\�� .b�V~��nO��Gh������ #�/��ݷ�9�.l$����{��c���Z�<�9�w���}��@��.6�7bVؽrwԟ�k�z<8�ⴐ;���N�6r+�5X=_!�-dnV�1�1��H���n��9�=IZKW�ZQ .g�Nӊ@��~2U"��t��� �n.qT�� �{,��EβPz���ú����""z���g��ik;,�E7Fw�e��70���Z4�ߒ| � a��:��D;�K�K���J�Z�܂�����xte��FI���S�\ͦv���TvZ����_��^��A�M?=�,�R]?UЄ��dDO)ta|e�,!Б!d�Ԏ�8݁]�jף��X J/��/0 �Ȇ�x�#Nz{�~��$N��3��S�������rp�;�N�^��~t7Hp�����}�b�q��ҐuT���p�!C �1� �V(���f��O�Օ�&J�&�@�������0Sͪ�b��(Z!hTI��d�ʳ�M"+�n�R����OP�J�'{�'i���Y���6(��̗�Sk���c�� �c�%����؋�aR��e���Lb�ҖJ��� p�g¶P�^�������"����F�s<!<=����������6K1a��B��_&i�~kf��o����'פ`��LVov͙�Gש �������K׀��������[Zm؞��'3�<0��m (m�=��%[ �Y��&��J�k�����Ҍ��e���D>z�پdn�U��u?)³�}I����6eZ���Cp@�&���6�6k8d��T���_�$�캈����AgOs��@V�U�U��C���}Iw��R�u�m�;�Yo9XlY��l�.\,��q���@;����S5�ke�e��&��s�P��Zp!�J���/��K�'��ژ@��.P����:�#V� <�rS���^�����@51�AӰ;a|��hL�<Vz%+���|�9���A;��>��rg�m�5�j�Dc��j�P=�_Nƽ��M��ԁ���n l�K_���_�xky��@���*�����줒�Q��0�!���R�Я,`/�3�cr���(A�j��q:�O}��ɈL����*h�.}��zn�]�H�>9k���d�LF�0�eb*����C�uK����X��لH�Z������i6@�7~.r����5�E=��A���������d(��X>0s���>���/���fM3���fl���F��2�C�p�;����M[�!,/w,��Y�+�єm|Xl.�sF:�E�NwɆ�ݷ� �@�k�2�>�H�qT�*���p�4�k���=Dz��T�;!�����nD�~���``�;�?�S�@�[��r����� w95��!���������1����Vm��8�-�C���>]�'�8^tT!�`:���T��������ņ�?pg��O�����b�hF�]� ,'!����"�$Vi�[�Pr�����7"I���w�̆<�A�.�cKK���D��U��[���E�rt���������k8�y�n^��%>.#�)T�����������U��U�'n���ԏ����H�j�U��������� ����jL1���[7�C��TG)2<Sā�zv&������5=����0 �O�,jd�w3I��� H�%�"�#Dz=������.����fߘ�;�%�^뢽Ԝ��b�!�v� ��+y���I�<q>x����?������D�V�s�M��z5�(�ʵ�dV��JZ���)��L�rx����1����� M�A����1y������y���JJ����!��C�54{��� y�}��8z0�( ���R0��8��-`�;��B�QQ������n�u��|�.�ј��[�v� �x!�Ƨt��� j��� �fRu�r����i�mc'���|<����R��jK=rhf�l��w~9��G�G����s���)�`娵���s��/�a����)�Ew� �.�����핼��Z����l�� �4���0e�P���m���}�!�{���N�}��RW�oX�� B4C{"`{��H�o�z����b����v K��! ٪���&i�x�� �J�Vss7z�%}w��#S�2 %�!J�NXe�Bd �������+�]#.�aG@�3>x�Z��Bw5#e#�d��"U�Ek�'�߈n-%IA��%�?�r@d��`l%���Y����f��S�]E��LewG8����)�f ���ڈ" ���̜�4g��hWm! ��X�N���ݏ��gA�U�&J�2��I�c}�r"GLn��\a=(t�"��C����V��X�{���*�Dy��� ��IJ��}�~��!���n �<�n`s8� ��;}̍�Ң���;��DŽ{�
General
-
Target
Atomic.exe
-
Size
5.5MB
-
MD5
33761f9d4f3e3370e2fd3d765d73e972
-
SHA1
c3108445737936c08db84707a9634b2353e45b97
-
SHA256
29bc22a8145c11a8dc23684b45ef9616ba5b8b8bee1a10c1b90e31884c149a9e
-
SHA512
f147b164802ee1cb4e66674b7d8a0d94716f55a9b04740f7e73fe30c156761cf5192de439ab3890423d6c37e9a61f20781ff92fca8948300c295e22dc893eaec
-
SSDEEP
98304:nLdy7EZLpH/coQ0O8VeXWsSCPvoY7kOvRCS5CaQKHS+V8tR2eN+tFJG2wh/aSjtE:LdyALhkoQ0uXW3CXiOP53yS8e/MT5aSW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Atomic.exe
Files
-
Atomic.exe.exe windows:6 windows x64 arch:x64
944950ea832000bdc18d623a7c166c19
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptGenRandom
shell32
ShellExecuteA
msvcp140
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmReleaseContext
d3d9
Direct3DCreate9
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertFreeCertificateChain
ws2_32
WSAStartup
userenv
UnloadUserProfile
vcruntime140
strstr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 799KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ