!~QL/?����ޏ������h��|.�+&c2�X>���B������RH�:!�ևb+M����0 f:^Ai�T���t��b^F�?v���VN�#8�� @DA��:���?U��K��^o�/\U����U>럽'�k�jn�����!�.UV� �������k����R�vm�B����@��.K��������[ɁD�vB��W�"�$�62��J}��A�;�p/�[$����x�����Mŗp=�WRh�� �O��'݅�TNt~)zL�뵴\�V�2��O�%��%z�?P��*[�k.Ձ��\Qc��řg3 J:�w5�m�� ���)F7�1��/cnݧ���=�p��AC�_m �V�����A+#�kůh�Fh�%'���&9� �ѻ��p ;���Wڠ��)�q >OT��������G��i���ay�I�3z� ��Uk�U�HD��P� �q�� `�;���g�����Dqp,��a ��fG��<�/-Y�AR��2�mS��"7z$&�H�����'����c8FE=����P*KeΜI$� wY�9q�SNX�{H�߄�9�[�x&��=����y�O�|(��t�g`cL<��*7 IK�TMV�i\'�*?��H��+�]�X�B�Lڅ�g%x�~�q_���|`�q����6�ib��~y��w{�����⇛�ޑc��CT���R8#+7ʜ���]���T�48�^��U�(�vW�lx��'�yu�ER5i���~�����"���ֲ��e�f��Pt��t��>�:���)��i��J�����+H�7����p� ���<;p��6]w�cs.?"1�t=X(� �Ii%�����ypf��R�gw�-��rZH_����8h.u2��"um_3m�.K��l[*�Q+ �� �c��:E����E�4.��� ����+��I�co��w��G-��/r����Y��1��(-�r̞Q>�)H2����O�m3���ϡ��ϰ�VR? &�U*cI��qm�㢭�\�J�͙�e.�.j�G����a0lˎ �0��Tfw��2���a�ё��%֠��a]G��c����TvH@�q 8f��5g�Z��v�:�L;�lȖ'ۿ����ǚ�Qbi�7r�T5�B�n%�e�`e��L�o@w���լY����$T(����:�z�� �Z6��Y� �v@[��n�Hƚ�f[����H/���;|$.�lk�I}�)r�� E�V�����w<��ǟ�k��s�����TD ���N�bs�{��Y�Bj�),�ym�H�M��'��N����B7;���~�_v7w�w�}(N��3?'e�� ���DR?-���1����lj4H1T��1���+]��$��5asNDc�'�F����X�ؤ�6 ���\-h`�Jb�.t>�o�,w�p[��J�M�hE�{���2�Hu;'��|�� �=z�W�0`�NR�VA����W��_��Y�|�n�J9j&���szg\��(�U�XF#l�䚿� �P��E<vo?K _���}�m���*ͫ������h#�����*2�j���Mr6۶+D��W���<�V��x��_��� �ԕ�E���#�����_u��G"�T���|Ѻ��}Bm~Ҁr�����d_��6⊎:I|6t>]��%�k��f�{;{wL�g|�?_�jI|�6��)ҹ����F�Bl&�k�̹i�ֶ��'>f�� �8(�R����(��$8�I2����>U��;�}���W�:{��fg�ϫF�̸��&�`�ޞK�>6!�D���Z�;,�24ɚ���fF.�6�l����d-�@l���DLx̏�!������Xr@d��5�Wq�>�:���EV7SVC�Z�_��K�%�j�QON�H���|���F^��;w6�*��n3����[�m�O� ű��'1\�h�%"���CM���Jrۧ�CkT&��*���7ɖWX$<aR����n,#2\���]S�9����b镌#_��� �4dW�oM���T����l��JC��v q���n�iQy�����O{تɹH���(!��mgE�P��՛Ce��� �J����Z��#R$�7�x˟'L���!j�;�Xx�����[��B���ܴ.L���Fa"��h���� �I�f�����_���sh"�*=�O���+f濗Qf�c���7,�?�aQ d�}4���9���!�Y�hU.g:��<b�ǿln����S`4�/���,dm���`��^DS�K�e�<��0��{�G$� N}�/S{�sj���( �i� b%/�7�~^?�^Y��n8j0c�tX��Җ�JZ1��,�%�Is��XK*mD��p�jw�_"ֵN-��,q`�����P��������4;�r^�^?��8��(� �Rr�揤tP@��V�)�g�����+���ɉ�'�g�a��nk�@���x{Pc=nx3%�Y"��kh��ϴ(g�$� F�S��Q߁a n����U�Ԛf+��鉦5��3}���y�f ��S�kuI�.H�|� �����T�g�cAl��r��(�)@�کa�������/����#0������)��;�]��E{���lztۧ�˩IRT�Ak��)�����V�|t�SR����c�S�5�W�՞���-R���s���;[E>��̡��\�gX�*�܁x����� �il�lj:�bZ�D��a��2��|mkNb3 ��0S#�� ��\�`V��k1 g����;�@_��_8��>r >�Ӟp��͜�*C���o����JC���2�$w�����yK0e�����x.C�{V�M?$U�"��և���0�uj��5*�`�k��mJ|��=��I��s�sE���� /A� paj%rZ�%!���|qr�$���y|���q*�8�Dt9��v����+[���� ���O����������U�3]$��taG��H�e%��P!Qd�|�XJr���_:��|��Y�l���]��D,�)�������m��CF��V��V۫���p��ο�r��\S-�����xNZ/u���#7�~�l|�b��
Behavioral task
behavioral1
Sample
trace non dh.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
trace non dh.exe
Resource
win10v2004-20240508-en
General
-
Target
trace non dh.exe
-
Size
9.8MB
-
MD5
b929398f352eb86256480b62c224282a
-
SHA1
bcc1f4cb1599fa41831618da0349f357d3561d3c
-
SHA256
fa764566930798b7d73bb23c81e0bf0712f7540f1ac48c337b90063ffff71c96
-
SHA512
318df863eb0a9e9cfd69a9f005ce304a30e45c243487ea1001d6b4f19d50ded50a5e2671345decbcee34911f128eff94c27f96f959af712488d8e10fcd701129
-
SSDEEP
196608:KqBaXHlA24d3dDVmZoJwwkTIDAjnzRck5OT8xvZmodm5:1WxmWD5r2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource trace non dh.exe
Files
-
trace non dh.exe.exe windows:6 windows x64 arch:x64
3c9e888affa43294e91766790a915e60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
RegCreateKeyW
shell32
SHGetFolderPathW
msvcp140
_Query_perf_frequency
ntdll
RtlLookupFunctionEntry
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_stricmp
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 595KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ