���T˲�a�n��x0 ��� ������Vc�4�*�����r��[r^�}�Z�.��]#e,���g���@�V+"rsfo0���q�(<v�����bń�y�VX5�~k-p��#Q�ٱ�%X�Y� 2�a��������9���5; �@�]� �%�D �6n|�K�Ta7l�5).��`j���A��1Kwh��N�q�:"�7�L�0���A��rX�HX�9Dq��$F"R�+5����̏���!s[��"kW�T�=:GU�f6���o;����]�4�Ӯ~�*Sr�T��u����r��!{��i�e����@h��#����QU҈�J� qBt�� �M�����l"� ��@���N�g���0�<���cM �V����c|��7��u�J��,�`U}&���ij����^<�$oM�S���K�Պɯ"���q�g�h�81�2��' ��W�f� p�0b"e.��{P��d���'���Z�@�3����]4�`��~�Zѿ*d�YL2A�J��JiG�?»�p:ȦӗZ�ڎpC��vRD[&��(Ac��{�AV��H�c|�L��i.�J�0���{��ĢU����!ݩV����u�,[4_�:?ӆ8�0*�������D��y��ʱ�(��\�2��ձI�iM�M�]��}�l#8"=,lɸ�H��_��§������#����/"`EDk�������}o��:)|�:��#H��7��t�f!s �П/��uG��J�u�%�)z���,p�#����U��+_ ��s�b���1F�����HD�pF��Q�����'��ª�Vhw�pN�}��=�b!8����]�R9���c��f2рR��a����My(b ��Y�|B�.�X��Tw5'��l��0rWPl����E!��N�K`�����;x��&�G:in^��"}�P��l���"��D��}��n���'�V�R#�)Y�I��b��䱇Wf��Ez�0��Y�CL�j*�?D,[rgG��'z�~b�W����]B;"�c��4JmL���q#���Cw��bX��p�ӧ��*S14���2r�o�C��6Y�&���ő\<�c`��;�F�S�y�p�s�n�R%Զ����x��9�N��i2q �?��r�|?#sNq��e��Ӣ Z-�~�ح����]#��gJ%�0u�ߦ��Y����z0oNo�i�������g�!���$�����I����f� 7є�����}�1�#�E���-AM��p%���!��rQ�<6���6�_�����`�{�4˷E�I�P%����� =@i5�H 7��2$��:S�P�<��|�o)���;�s����%����)� �K����۴��xq� "�<���oF�nV���*I��^yf%M��AN0�Geh����k���5\s��_��L����/h�^��͈�@e�c��DlAL� hl�a���7É�D�"ÍE�^��P�囡 +{�l�Fa����*��]�1 +H�8�3��p1��^���y�qN�6�_b��,j��vJ�-[�����.(����ip�F�x�|� ��Xt�p�5OAD�C����7l$c�{GO���0�q-��aU��hD��! ��Nd3�Ko��[�r0� yS��RW�����B�-M�)˳g����uJ���M�Q�06�&đ�w�U~35������el�c���x�O����`�7��!���8�O�@}��ݴ�x֠�]k˻a��^��~"M�Ĺ�L��m4� ��\�f���5�J-�������V��#!�+����ǻ�$.�����w:�]��t[X��B�4w^[<�)s��U(�����k�%q*Nb(x�����8�_f��h��-�[<�dx?;�杨]_�E�L������y�Ff��/�ʁ+��)go�3�W�,Ll�'@n}6{29%K $Z���ާ��A�k�I� ���"�U�*~H����ˑ"�y+��J�O��f!ס�E�^��z�2�3ˡk�8�2h�����Dq��2�i���p ��G�37�=���_Q�^�Ey��l�#�m�+�\��a�(/;,���9~���?[���UT�V4���� s����a!}��m'���5�y�Lμ�.����%vl��3������'u� ��k�ɱS��cp�U�q@E��Y�7?�e������{>���F��&Oir�ȱ)��jw��L�]Ʊ�Z֏�?s���$Ȭ/l���|�-�ONtv#�Z���ʚK�Q�$�l���iFȱ����� ["R�d�WE ��D��ʪC����kIqor��IËd ��M��������-1b�\�@�?ʾ-%�)��ĝ��ZyƯR8 � �,�Py�����T����_WӈpG��:���'I_P���b��̸U)��� ��{Q�u��.e{�ẁ��W3,#�׀B�]������c�X(EћZ�r�q��6�?v��l�^�>�5���W /vf�Q#)��m� �c1��Cq���1��6�r���ϋ�$��Y�?!��$�J�'���a*ih��r�o�Nu��s�0��S���n��2D��$�� ngF�_w(*���)����zoB���߸��/Q��l$���U,�R�����lБ�~�ff剥0�]a���%���� Vh��,c�����f��אi���.���R�=�v���h��x&ﻋ�O�o��+"t ��j����ЗD`CK��[W�H�)\� Z5#!D�#�#3l6s������ՂAu��6ۦ{lb H�D��r?�[��� B��{5� ���b%3�b�uz�lrާ�?�q<�^ٱ�n{a3�s����ML��:�E�|�Ә� �������m�6����T}cf�Id�V�(mk?�d���M\W�\�Dv�����C��L8LY��e���7����F}Oki�.<yA�v8#���!xє���0�k�{cB��_vd]ѥ�Q��f����O�}���S莞���^�`>����AF�����Y�����}�M��ʴĩz!�$���4�T _�t;�`���\�����Bv�#�U|�B����������7Fm�U���^�S
General
-
Target
TZYWDTFNXU.exe
-
Size
6.1MB
-
MD5
71c35b604e5b45f7610d7f19519a1207
-
SHA1
15ddf6490946c127da82875a155970a3ea662fa6
-
SHA256
feb3d892e07f4bb891a08a9a5d5afb5b12aafeac3c1b13c239eb4fa1167c5020
-
SHA512
c5aeee11c2a06a77316a66a0088d20224028219e53fa8feb1d3bb8d68585ab132550c699bcf2e91c974a3d73e436fa1c5b966a45bcbeb705d385c867f97664f5
-
SSDEEP
196608:oHjWjvogmO65V6GGiYAM2DKpWzHuMsXny+2cyYZQIy:WjMv6b+pixM9YzHuTy+ZdKIy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TZYWDTFNXU.exe
Files
-
TZYWDTFNXU.exe.exe windows:6 windows x64 arch:x64
3346e2dd454410a9e6dfc0adb5f75a16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
closesocket
advapi32
ConvertSidToStringSidA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ntdll
RtlCaptureContext
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 532KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ