����o'`<D��_�kK`Ngp�j��z� �;;��^�5y��wO�c�����6���y�gFx�CyWzꛑ�ZߩڕW�/Z�D��m��=f'�֡.b���g���-�Ws�SaK#�*T�o2F}���m1q��~ـp�Y�!,��K���p��O�Z%��M����F �`br�N��Qf}Xf�t��;>�Q^qf���[~\���y��$H*�M.�h��5kǜb���x������1>+��鿖p���Nk�:arw��B�}���P��;J�*yɬ$;/�2�b�xy۱`f�@<Hr�������Z}+�� ���ok�B��gA7V�B���B�EG$���٘^o�� �籷�=Y�d?B����,���p���M��6eʺ[{_ιd �¬���/8��gYTv���YM���E&ߕ������Dvo��T���u�e��ν�f7M��e�1O`ֲ��t�5Z��|ii�_��)t�>�d��ш���̎�-۱9�I��n7ɭ��5��VYjˇw�L��2�};a�=x�:���4���6�^L� �%ދ37p�ci����<uZ�,W��锋�K�#��P��Q-��L��ψ�'�q�E���"����0?�U�ؽ� Ei2%W�s�#����Qљ%h����_���?�o��t��9������%\>2"kQ\v��Ĕ`@�G-��)qT�E�ɫ��n��ag��M�g�aUbȁyQU[�z�X��Et��Bn��Y}�sMz�\�����' �)j��~ �y��r��C������f�l��Պ5ߩ�C����q�U�_�����{/*��.�^�^!�U�p@��m�+��:3��W��h��4H-�z��6{hU��la{��Ёc���U5��"�Yk���BENh�Ǽ�)x��"�E���t �;� ��^Yh6���+ު>Y��}Єf��8�BD���)��ۗ�]��k����;^g��B�$���k���o#����Ħ�J�{�r������ь����e�_�H��9�ܧti�W.�M.7��K�Ԟ�� 3�.���YHj�'8�br*��; cq�q���h�/cXπTJu�;l�<\�Jft��iy����,t�o8��|)��4���''Q��֠POM�Y��8�WY��RB=�4���v��4���]i�l���^d������Z �Џ0���YU縔���"�L2��-d�)��,�<�ó�,��P j�.��=`nʊ�C�(Vz��s�x�1��t�H����O�_W;-6�����U"���]Z~�Q�D ��OOB:��o���j�5��j)�61�S?��cn�*��H�������s��P� %�7�0Q#���i�e�UW�po ���b�=&����'�WU$�r;;�e9�oi��.4��2@܃_@J��j>q�͙�Pw���~9'��=�N���֠͠t���S����+�?�GG�t3yRs����m�r7�����.��:������ Tܣ��=�Q%�b����ד���3��1zח�8�H��`��}I��98�C�Lc� M�o���W�`�WS*�� ���h�$�;"[*SΎ��?U]��R�/�&͑CWo��y��{����fэO�2���[��^������G��-")�i?7Piyp�D*�웨�R��ԯ��vt�.���/p�L���?�iL���\�c�s{�U����[�ә8t'%����]��3�#��*����8��I��Z�> ��f�v3$kO!��� $H*ߑ�p[�����Q!��b�К�%'Ms��6�����V�/��p����ʶL� g���{i�����ܴ�ȊV�=Sr���r�ﭐJ��'����;��v����]��K��Q�ߨ?�W��Ɉ�����J9�&��%S��&�+�r-�I�ޤ4����$�� �4�=��H ��(l�R�������*��2&a�I������D����q���d����_|B�ݾ���c�bT&����SE����+K�_#�c�D��Qʽ������|���)�<�l��X���Oɷs͢X�a�����n*?�:�*���]�u��Jk�x��M���j��ӱL��X�f��#�c����70iޤ��C����D���ꊭ���/w�7(�����N`Ʉ/,L�������J��~nn�2�+̐���N��|�Ԏ�/��9Qi݅]g��u�>��0�B�]dAN�Od��~^�t��O��j��c8ӏW��a�Yd\�#��;����<�VQ�'iI-Vw��y�O�5;��q|1����D�����x]\, vvrÎ��[��˷q�����=��2� �=�?��~Ƹ����R��J�Q�ׂ�j3�!���}��?:V�4)@:��x/t�� �T�����9��'|O��6���i������I�`��I�AN*E�ܧY����9d�%�10��� �i q�ryG��{��3�����,���N9���Ӝ<ǚ���߀����/Z�줆��oS,�To�/d��ԫ�=V}v��߃�aF"1���� �`�~k: 0��'ļ�F O��'�G�����vݚ� pZ�nu�3��B��V�]�U%Mb:p�A��|�s4�S���r��\I��U�� �ɲ�*d~O��Xu@�#{��:(�!�Sj��9�A�>k�ʔ��Ŀ7�W^�5�b,���Ǔ���[,G�DrPw��&G�F�y�/m��K�>� %�m���q*�E��~k_B�s���(����� �j��D��=���{��[������ߓ<⯬;)dz"S�F�u��6 �I��'����?@f�Éz:�Mrչ Z��"i�bֽ����S�/��>��~V�{��+����m>����q;�(O<��p�y�R��/X���#�`��;�j��Q,�%�f�'��>Le��� _���4D�������j�sf����:��7�[�c���6�YZ��ҏͧOXy�w�f>*fl3����V>��I|�,�����Ya`WO�T����.$�~"�ᇸf\q�� ���?��n���6��_�+%٤III��X�r5_0�t���B��K"�H��E�
Behavioral task
behavioral1
Sample
3f93ac947c5dfcf62f3c2353fe4eb7d4ef8b96a5b7dbc81e04d62dcb26de7a4b.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
3f93ac947c5dfcf62f3c2353fe4eb7d4ef8b96a5b7dbc81e04d62dcb26de7a4b.exe
Resource
win10v2004-20240611-en
General
-
Target
3f93ac947c5dfcf62f3c2353fe4eb7d4ef8b96a5b7dbc81e04d62dcb26de7a4b.exe
-
Size
7.3MB
-
MD5
5b2bc1912e6482f3bbb782ec5d3cab99
-
SHA1
532023794a680d4dbf88d3c4fee3f5c97d6c866f
-
SHA256
3f93ac947c5dfcf62f3c2353fe4eb7d4ef8b96a5b7dbc81e04d62dcb26de7a4b
-
SHA512
724216406c2cb84dc11ab22aad5b1cf4d4320fe42ead9ebed87d2878cbbf8dcd448c1bf723fae1ee3155d3525fdf73b1d14c4a8b5cf196b2b1d9bb7457933a30
-
SSDEEP
196608:YC1FkPEVvSOxIpYHUSNP3PJOG222ytcJUhb:YCeEVBx6YHr5fJh2AtyU9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f93ac947c5dfcf62f3c2353fe4eb7d4ef8b96a5b7dbc81e04d62dcb26de7a4b.exe
Files
-
3f93ac947c5dfcf62f3c2353fe4eb7d4ef8b96a5b7dbc81e04d62dcb26de7a4b.exe.exe windows:6 windows x64 arch:x64
15bfdc4362f652da994d5c8d7bf53495
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
LocalFree
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
ole32
CoInitialize
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
winmm
sndPlaySoundA
ntdll
NtResumeProcess
shlwapi
PathFileExistsA
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertGetNameStringA
ws2_32
ntohl
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
sqrtf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 350KB - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 715KB - Virtual size: 934KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ