��5kX�n������մ������� f�ïR��2��g�J����x%��#[��F����%6[��Ft�8 W`��;I����R� XH�hgN �@ EN�(�������a!S%2Dg��E�@W�AcDl��0�i�R��h�����kI�H�pM "���bm1V���T!S���Q����F�m���c�� ��J�j%�8��|�+��7b���2�'%�TI淳y�R�苰9 ���3r�ztą7��P��H�*�@ YNS��x��3OwQ<�G��E,%��=)__ �c����PC�4Cq�jmP����� `�C� lL���q���u�S�����ok�<���a��4�1(�=Wr��2���+$��sxc�)wx$��� ��0er��tE�|�8�20#%c����y�XQ�nl�/��� �r�P���:rnl�Y����k� ��X��h���|U�;�E����UC���l����}9h %��d�E]�Z7�4�ɑu����o``xL�fLE��kV�Q�)#��X|2�:g�pr�6A��sC9���2X�4��J�U��ߟ����'��X{������� �h����d{4���漹F�*�t�� ���CB���rI?�<*��>��ia��g!��!u������@��|J����+1+22�.����y�yy9迠˯2��o|B�K}b���1�E��*~�%k2V��}mf֛U�Ӥ��Ao�~ ���Gh���.\���i:b��9kC�>��o�w3z�v�z�5��I�6p�����;�`�H��l�dR��6��e��aJ�=iw��f�I���ښ#\�,Y"y%t��7�� ��ud�vy[T���;>��wu���f����w�͕?ʷb��)�~4�fi��I�e\|����~��� ���~){�KvB7ۇS�x��˅�����7/����9w0k\ I�Fw~>�X\�7WcM��{W�j�B}^jH@#H�����' �~�4���Y���K�гqQ�4����;��z�"���!N���Z�3Z彁] ��lx0bEd���!�Z֣ ���E��f�������<�V��RO�-�7������u�c^# y��X�� �� �`��<߾�⌻��$ȨNJ��-Dư|J*��K�(��O�� f���UJ�_��_ ����-a"[�T�~�Ҏa�OtVX��C��U��a0�Ό��x���ʛ��A2�}E$��J��=�Q�ِ������Ĝ #S%�'!h5rd��^~��L��'�-���� �SS h@�7)d>X��z��?��mA�m����g�M�.y����8B6j�!ݲ\F��rV��u����u��7Ά��/mz��ʃ�<�}�T�,j�T�; ���\��K��ĸԋ�6d.Ē33Wk��S�Ï˥���ENU�Gb:��K^K���(�� ,b�V̫�2�����RܙY7m��,z���GfO1x���B�y�Cz����QfI��ǩ�?!E!��q=�E���f�v���ia�M&�`�)����#>[ P�L�J��D9�)T= H*LY*W�Ѓ���[�yV\D��,� Bf>�L�}�N=�~8Df�����~���_Nҙk��g� y���ݙ@A�dp'�M���S�����>1}�zT�� ��$���9�$:�4?�(���ʹ���y �B�f����gUv��A��7:^tQ!l\S40�_a�f���%��cW4���P�~�#_��#x �*������v�l.��ߛ(�\��=F�VskҔ}��a�s-fـDZ�5>���8L�E,� ���~x�J|^e�1w꩟u�bңP��*(�4�Hz�J�&2ƥ��DK4�~�� V���3���c;{3����m��:�L��|)��?6��;�U���]�0]�B��������f+��v����sGoc�E6~RT�'��ag���Az�3��Pn$��ңK,�N�{�ӷ6h����y�G���E�-�%�,|�=�~u�� ؤ�!��Ym���s{�v���ؖ��+ެ�M\ekrJ��la�:;�4X�#� t1dvљ��>8�W �]��@���~&3���-Z%��~� �������R�o�Dq�Yk�"�$��k�"�r���}U���?����*U�V��}Zmo��<���挡3��E�Q�K�����]5:�@@?y��L�� �DF9�X"�O�>6K-�P+�/;���WF�m(?����ޘ�P�m�^!���e�d����-bߕby�R��M|Hr�9���C�#"^���R���k��U���G��k��V|�E�^"�kT���ɴ�D�K���m�D���Y���*N�Xx��Yzb��#"�w�+��d������t��`�����������վ��Z�Ӻ}QJlZ�k�3dSI����0)_��m;��z.�W7�M V[��P�Y��ա:�=��ҞWF��h;g�#\U%U0���F"�H%��濯8�;HY�)�9Bs�0_��R;���~G-�������&gU��|���;<����T��L�/��_{�M��{j��u���<fI�z���Ҟ��쩃Ȳ��b;�*�g����n�7X���e ͷ�����T(L�m˟x����cd�s\������<Y��$�0^�l�6P]`�ȇ!4x����-�M?lS�*� �� ���^6����^�%��.�G��0��[��� 8v@�4�=�]�he�����*�D�������=N�%Y��1����?���h^5�2���G�qKh�5$�1'X��"A��\A^D�O@��O�>+je�PQ����WK��Մ��x(�fs,9����p$C|fe�$*������~�@��_l� os���V��%/0"����D���IgT�r�R6��2[u�]D��~����G ?����/�㷋��˳�Gܸ��-:��#�����.��Z�f��G����w��?��EO�E��P��$p����b��euׂ���f�r�jF��\��pס��^2K�"*k�`z������;����,|����}�8�$V��w˅F�jeI��Һ,��A��dˉ���
Behavioral task
behavioral1
Sample
dd6dea3fd78644982860e8a6fbbb8ee424171f64f80d045fe578d606884b65da.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dd6dea3fd78644982860e8a6fbbb8ee424171f64f80d045fe578d606884b65da.exe
Resource
win10v2004-20240426-en
General
-
Target
dd6dea3fd78644982860e8a6fbbb8ee424171f64f80d045fe578d606884b65da
-
Size
11.8MB
-
MD5
b3d1ca2e7d646949a4a36286673faae3
-
SHA1
352aba061728f70ffaa76382a059acf3dc5b3412
-
SHA256
dd6dea3fd78644982860e8a6fbbb8ee424171f64f80d045fe578d606884b65da
-
SHA512
06753e1ae7ac542f1290f2a864a96a5d91d8d10ea6c326d40f9016c4a5dca75340903ec2a45dca1319e87b3aa85b7cd8f5bc8c89158d587c13e0ff649c6f93db
-
SSDEEP
196608:crPJQQe4BqOBJDmTPDmTN+ohP/rv0/od8zKIWturOoLJ8XSMicvmAARTFF2VWrr3:crRowqOCPDmTN3r6oiWuXSlicvmJT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd6dea3fd78644982860e8a6fbbb8ee424171f64f80d045fe578d606884b65da
Files
-
dd6dea3fd78644982860e8a6fbbb8ee424171f64f80d045fe578d606884b65da.exe windows:5 windows x86 arch:x86
7319c94a71d275bd931439b6edcb40ba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRectRgnIndirect
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
ws2_32
WSAAsyncSelect
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 946KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.2MB - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 556KB - Virtual size: 552KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ