�������3�������>�P��FK�p���3��Ȝ�WHNi(�\��fo3_�*E�"���:���."�6�PAJ�^h�6^���3QA0���=1a�|���0<��~H�����ʩ�̛������������41T��skKܯ�,��`�j�������K�*Q���Ē����"h[���°�v��������M]�ۈq�:���,���;��C�9e�����4 � �q���W��%å���9�sČ {`����f�(�ўTq_��yX�#�s��\�-�1��3EZ!B)YX�2������s��$o����iV�]��w���g��}fvO<E��O�^�.N{7��\Bp��'�����¸�xt�J�y.�Ak9����%��]�и�5��LM��hN�(>]�S ��Є�)>R&�<�b��������;s1U�#zj��b��S��Au:m��e��Ց&�U���H���3���&6{0��W����9B �(����O��1�K��<@���C����A�3�p�8������Ǯu�����"y�Pg��i������y��O���SE�/�����u���3�Ld�8�� BkQ8�����k1��C���>��p����U"]e���k����i�[g:-�� ����r1R��U,�XD�˗�h��{a3����H��j�~=,�t��N'^4���9�v�;���������ߴ�����]�5�F��-䋏�T����e�|��e�5B&�r��2ä ��.ܚ+Y6����Vb��� �au C ����I�.�� =�fa/>W��@��1���� ���?h%��Yn�N嶣��"���-jGv���_h�rd�\bY�����F"�t� !�^d�.�q��u���'�Q���f���i��vM]��i1r���R��u����8By�ռ(����]�4ATڈq�M�Q��N��Y�ۿ�<0��3�$}#��#v�6�Bx9��ᄐ���:� �����Ab�*-��=�c�T9Nv5��'����~��-��W�C���;jc��+��e�[o{���E.�92`�<�rv8#�9�:�ĸF���xp���\6�ѡ���<U�u� =1-� �H"�M}>~��;�"������ #hvl�p��FV�A�#Q���!}q�8r]��e5x���RH� gK�}}�c�r;�V���z}9'�I��y= }�}o;- ֏�2�x��U�J�XI���u�.��#�R�����"�cT�J������z�b�_�t&y�Q��y���qe#���7�as+�����"���|��84�Og�.f&6FҲ�M�_xh�C�@�8�/aW-�l���3����o8����� �g����y艖$� �����FߕzJ�� �����.��x@�8��g��Rs�)�1m26K��f�佂|X>eW<@���W�����qU���eF|���jhO����~�"�c%I�;s,>��#A�|%@1D��?±Y5��*�����r�>dI�+�Ԁ�5#,�[�m����.#s��5�K5\�]��!�d�m��9�8�N�U`Gz����p�'�b��MV���m��n��3�C�"Q��O���7B��f?��{���~So���f�J0V ��_XuJ5����i�l��ޱ==;Y�{����t��j� >�ۨ��UI�N#�m�����_����lIdIă,�G0��@�"�`��i��pȽ�)�7E]���Xj��ŖZւ�i���a���֡:�j�P�?E�c.%X�GZ��'��w�Rm/:�H�dV��S�gr@���8�C�<<�� N�=��v���g1I2���{��ʢ}������}4I9���"g�_��������1�Cޞ�U�3�a�h����,O�A��f���\>�q ��I����ޱ�.��{D���4�����h��AgKڿO\oV�����<����~1�7v:DPj�@����?��*�lviig���µ��-rP�I�甄�4�����/���>�-*݁b[>�w�8�}�A R��9���7&� ��^O���Q%�.�H�mS�����1H:[�_�At����χ ���=0�,��q&,@U�Fr�H+h�Ϝ>���n�MZ&-P(��p�@�퐿��Ll����LA 2���qŘ[�z�r �@f�W����ZZʕ�K�`v�:sM͡��m�:�v+,$�)ւ�_�]Ýo��k�jB�a��"�p����'�;����XAj�:8�� ������J�C��A���;��H&�E���11I��j����X�j� g`�a&n��6+��8���T7X�b`�E���I#�7�M0�%( �'���/���z]GgY9��A�����|����~��@ Գ�����H���1��$��nH��}P���^�-TS �N=��R)ƚ��ܮl̀>>�Xk2�w:K�?g}M+��mog><����~`��6FWX�f��))�ߋ�+�i"C��s�ugz�:���)�ڪ/=z�n�oO�*����77���BPl� S�.��#@�oU b�x �������8t��e`-Mb`�6�Y4WUS&�JCr��뢈C�r������Dŋь�VN�eS�P�������l�`��)�6:�2e9G��V��Gx�yP�����/�.6]⿎6p��ٳ4��<V���^�š�P���"��}\�Gl%��2�o?.+d�7 we��1�����ˉ�?_�ܤ�*e;���(�|��5Z�@j}f7��e8�ІR�4��n1�������Q���sC�X�O���iu�s�L9��1�g�ĸ ��^V����7��#��9Vo��[�'#��R��[���]6naW�q�j>MTe9}��mgг �x�LJ�Y�v�lftd���ߴ��ѷ�qc(T];(�c�b.��:�9l/��Dr�� /*1�0�Ƕ���������ip���p|d�Z4d����*��X(�r�u�;��>i-��`Ȇ��ʝ���������#������"�������T�R��$���A@��
Behavioral task
behavioral1
Sample
91369e059db37e8349861ef0f04650e94e39e9fe7e06a2bbe80cc06b3f71ae1f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
91369e059db37e8349861ef0f04650e94e39e9fe7e06a2bbe80cc06b3f71ae1f.exe
Resource
win10v2004-20240611-en
General
-
Target
91369e059db37e8349861ef0f04650e94e39e9fe7e06a2bbe80cc06b3f71ae1f
-
Size
5.5MB
-
MD5
e464ba1e5aa517460c93edecb11a70eb
-
SHA1
0db07281b644ab998cd0a0409f5be264ca7984f6
-
SHA256
91369e059db37e8349861ef0f04650e94e39e9fe7e06a2bbe80cc06b3f71ae1f
-
SHA512
bd97380bc5ae6759f7aafb328be952c867154c3bb0c99c12419fbcaaadb82f249c5f90ed43861d77c0a67f58bbe75d9b61c92ff919ad402fa78e84cf0e81f44b
-
SSDEEP
98304:ylJUu+5vFDnP1jM9q24Q9GnJpESs6152w+vSGW2qHzpTEtrdXn:duWvFRVhIOTOEdG5iTor
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 91369e059db37e8349861ef0f04650e94e39e9fe7e06a2bbe80cc06b3f71ae1f
Files
-
91369e059db37e8349861ef0f04650e94e39e9fe7e06a2bbe80cc06b3f71ae1f.exe windows:6 windows x64 arch:x64
3282faeb17141ec8ded57e3f0826d5c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowPos
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
xinput1_4
ord2
imm32
ImmSetCompositionWindow
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
wininet
InternetCheckConnectionA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ