��le���\����Zy� ؘ-������w��/R� 9AG�ʋ��p��5�R�L�9�<�!�2x������U%6걝g��f./�ת6�؞E�G�&bv�Ε4�J�k��U�<0L:�R����|�9.�nc�p]�����o�V�Lh�J���Bf0��.����.Ș�lG7=ݶ�s^����l]��Qޕ�n _+����8>�鐆o|?���n~8s�Su�C�G�Pґ��`�k]��3����}����R��E����gMѥ��k�i�E4�91��I�U�Vǀc4#�4���S�.Lѭ�$�z�� %t��,��Ndൃ^�zo3XȈ�-cQ"���BaB��u���@HH�d�Fy~�F�e���ȴ�� ��pp$��[}����t/��J��MEXiE����\/Tϫ�=�G�L�<� �\1��d��܃f�u#�d�r:��HЂ�����$vʶ7��) �����-d�5j=�G}��T��n˨��:�%Q��2�Ғ(9Ww$��T� P�ٮr�2�>�L�7C�cE�r��02tUj����8���4�&[�;d�uv ����4[�� ��4y'G�l��!Ǭ���]��oޡ 6&J��Ņ�W���+��Z��qx�9{�+'�s� �eO2���ɬ�F.��8�,��I����H��^�T��kd�A��F�\��G(��r���4PQk6�˥�Pr�~�x#�C�PU� ��dOJ�Yb:�[0,�����$�D���J&,սK9F?OK�kQ#j�|M�|5��EY8�'o}{9v���ic����-������`��J ��ru�mt�.Ԯ��*\�H�{����Ѩ�ve <.EL�v�lx�w�yx��[�,�c�,l`����;�~��kD4� '�1�i:&&��c��f{F��,���E�s`���� �"��Wl�f�5�? ��z�tk��"{7�v�k2����9��|��0��&M!53�!�M��aEL[3��ye�LN,��\�Ԡ�T���ҟ}���J�Y�#Q�9P����ݪ<j��k����G�2�N�y�����Aqhh���p��j��A��K[���TC5���,~���$������p��_8�o��FT��N�Ow%���� ����!'p��-̿Z���C��:����<xx-7 �H�v���w����7 ��mO�)���p�nX� ��7����\����lz��XK��ۘ����L�D� ���,^ C4Wқ��~�{M��]��vkq��S!>K�B���5�S:���xKEa5���d��̤���)��.9�m�z�¤�54� ވd]��6~P��� U�tK�i��@E�r*м(��lu�q�^�P��a�O�{�fE�Q�2�D��~�˧��b��%�g�� tIiO�� �Sz��'e�B����MJ��!�?����o|��Y��8i ���w�;�'������6���|$�����G;sr��,��"�ц�_�n?#|��1Kߚ���ɓ��g�� !�&�l-,�k�o�d��s�f4 �>��N�������L��?��,��(7>H��b7�{%��s��4���Vӳ|^� l�=�+zS�wT� �rk�rua ����0��.m*�N���F�J=��{z���7ֿJ̺FG�j����Td:@��#���l"��h}�6�-Z��F�,�$��1�9�I��|�{>L����A���cd���!����0�4B⧎�Ujv$�{����S�!�s����!vk��,���'>�o¶腷� �>$��J2�V�><T�~�t�?��=�_̑h��\i��k���[�GLs�@9�Tĺ����rX���d;����C� ����e7s�e�"����Mp�0�5�0�&��0]����G�\^�)���q���E�:���ُ��c���_����jp��ƛm��b�[�E��4x�*�kΧ��ǖ�2Tx�MJ�2�X���68��Ν�BRe�#�!ߗ��� �!Bʰzb�����|�&B�w��Y$g���WDD;Oˇtax�0�*Z�WPҴr�p������_��'Re]�c]4b���,A����L9��[���F�nQ��(��L����%|���=Cp�[����"�u0x��Ӝ�Y��L,>:ݾ�������N`����n�M�(U(1]�hYߎ���Y揶�M����8?�z�/~kh��$���������n=q� ��TK�ޙ5py7ݯ�"D<��>?�ʿ)&��Je<�w�2w��a5�oL��n��yb�����{��c���d��&]f�W57F��4M��E���ɝ��G���hI"X���� �� ��X1����x�E�̠����X^�)�!Xi;q��G������N�FyR%���x�q�A �)*��u&p�f��͎�i_�jb�W4�� ARX��������$Ή`�� w[���3pKQ����E���82%��b�LU8���#���t�I����n�sⴋ�����2O>v�N�CC*�e?SEܞ�յF vNjՌ WZ^P1^��J��\�^Z�ӇQ{�^f�i����w�=o>����yI�ݓ��T{���j�6��{�l�!7���^L������T���������G�N^�w|�9�8J�^�i��Ä��~i#�u�w$����'�g�"8�Xjk���Q���W ���.���[o}K;�f��,�{r�exye;�)��,���X�P�e�V���Q�2��w۵��8��Y�S��#�`h��|�4\�K�{�.L0Os�?�/D��*ø�:ZI��r����S:x�ĠUX�U����^�-��C}�.�Ϥ� e�&���lM��{��E�nm5� a8�)�����M�����"�l8m��[n�/�Bgؼ����8�(e�na7(���s��G��rn];�/\E�M�2�& �A�����XU�4hW#�X�!\��!��ڱ�9��P1�4}��N�MC�BI{��X q��0��i��rq��>�&WaY����8v�٥��DG_�@�N�;��d,RT�����~����r7
Behavioral task
behavioral1
Sample
0b8a6c9bd57f6e7650f4616e515750e169b95627300fe54e15572a486d67ccb0.exe
Resource
win7-20240508-en
General
-
Target
0b8a6c9bd57f6e7650f4616e515750e169b95627300fe54e15572a486d67ccb0.exe
-
Size
6.9MB
-
MD5
054edf8a53f34b8806e4d586812146e2
-
SHA1
ec6212a9101909daeb995f91eed912d49b338f82
-
SHA256
0b8a6c9bd57f6e7650f4616e515750e169b95627300fe54e15572a486d67ccb0
-
SHA512
da9e8bda2941e7d05c8998d087394617b066568b2b96a015883cea7035daee717f8ca2bb260242a7cccd966c4db5b76fc211d782980618b7e8bb3c54b22c8451
-
SSDEEP
196608:PuTTpUVsX7tT6p2xGSnFA+mqJFRpc6XyhUA6s:WT+SX7cp2xGqFxm+A6s
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b8a6c9bd57f6e7650f4616e515750e169b95627300fe54e15572a486d67ccb0.exe
Files
-
0b8a6c9bd57f6e7650f4616e515750e169b95627300fe54e15572a486d67ccb0.exe.exe windows:6 windows x64 arch:x64
b28d41944682f4b8ba3c14f73cdd7da4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
bind
wldap32
ord46
crypt32
CryptQueryObject
advapi32
CryptEnumProvidersW
kernel32
InterlockedPushEntrySList
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ