�>�o�+����*9$,U� g#� z��˯%�S�� �g�Թ��=�/'yz�oK�?�<A+�{��w h��D��M;�|��ch7�����k��!>I�y�Xny����=��m���N�^q'apW�exFϕ%�� 5f������XP���B#�[�]H �����pO�;��DĪ����R�es،NWokN�=�X�E6�'�����\�����H��Z��[�)�� ,�|re�jj|�:%.[����#�H�P�ϫ�q�>pU�H�s��boo����tn�V^WM\!��c���uX�)(yk��^} A���� ��~۹T|��M1����{Y���GB��+b�]���c�D���Jr�l�hC<B�+����A4�w�6�:r��2�M�]�1A����2��U���߭{r%ᙗ�'�ԉ���R"��b��x%������U�S�����z��65��AS:��r���r� �]P�l٥���Y+/,o; ;?�`�Es�䦯��K�Ɣ1�vF�U5|���(o!�A a uW���H�Љ�q�>K+������!)��OEj-�Og?���U�����Ro�XqI�7�*� L+YP~�I3\2c}�"il�7X�P����6��\�C��P��l�)��g����J <���<����`�T�q�� qU�b�)�ǯ UM���%v<w���~�IQ�Z�O�G�tEk��o�����}����`�vyu��E8���C��|C첞WY7�j �)���OU�s��}�uߖEY*$��h1^���_ЅtHR�T��-՝���p78��0������[�X�&�EZzm���uю.-���$�t��x���1{,�q:�w��)U#%|DE or���R�O �{(>���FC�Yb��'3�����t�����QGd�5��kAYsA.,�Q��Z�FUkN����dQ����DC���)���J�>�>�vE��3�R���(��O\��ӣ���M�,W|\ �bӑc��y��@����]��OKPcW�!�m���L��L#�>]�1����\���d�H�X隷�Y���+�i�f!i�]Yx3�X����rn�Xm�c?�~���2ߜ��m���Ͱ{�����w|~�o�w��36|$y�]���#b� ����|�X��#c 'z$pYt��E�Vȝa�`����� ����[��P.�C��Q���7���%��t`~H�g�\�7���yz�|e;��>O�6��/n��k/ȋm���7��3�h�0�*iw������5/Q��<�_>�_O��� <��Z(��$��}�mmV�:��Qe-xש�$[<v�+ S�Pj�59e�~w�(·i��7���2���"f�=_Ɓ/.p'$�O��Đ&1A�v�dFº1I�[��aW8X��T��O���k�.��B8�\Xi��hl���(ʬP�s���vL��Dt�zԚ�lܹVch $1M������ܞ<;�K�h߾���7�Tuq���8)"��Ľ�2D D�6o��W3Ã�(�<8�V��g��]���o��0$��I�(�DΔ?���G��'62��ؠI�oϪ6D�-�۬Ȓ����{aP��Zr��9[]z��F1���ۂ=k�Ɏ�wj�¯U7�h`���cV"�6P�0ꃷ���;�����ȃA��y�U��6�b��6U�������=Q�=���`�%�L}Š|O�ng���0�ך]y�nT���N8��m�c��t��}Y*�Ȟn�������cKJw��!IЏ��cn� �l����;����R�C��[���3���d�� ^�j~k���E&���%�B�s�~�6]�|6�81�b��`���5����0m��lcKj��Οi�U����&��Sf�4L�\�3���A���K�dQ�@7��N���O�!�<+�?���8%җ�N�S�C�z�o�f;�������:l� s��#���:$x �'����[[�)~��]Z�͓$4]���O��p��E�d �|��w6�Z��Y����ɔpb{+0إ���^����v �� �D?���1lXIvg{���u�"c��= ���u��-7<�:��!��T�rGRA+|��ܼ��\�����u�6��X��H��#�\��9�o�m'*��ʊ�̶3�O��R�<2R�GJ�t��!��TB�����ꅋ����dۘ��㵰�3���|/È����M����p�h �D����U2Kd��]�t�IsT�N��Jn��\�V��?[C'r�KC��,Nʑ>�e�e,Yh����@J��i�܁�؉Wއ^v��Sj#PǕ��j�]bX���6u=t �.1��� �o��%���6AZ�`�2��H_�|�G�c2��9�i[w�� �]?{����ղk�,��U�ܙw�£�>�kYz饏�N��@p ��u���!S����OS*ϼ�'[� |X�y��K�D�T�D�X��w�gY��|�)]���<����1c|�?�䖓��m��`Γ$���:q�W���� �lo���7�{f�i!��g��L���_��Y�6=�h<v����Ω;?�E�2�y����� ��M_�M,|�52^Y^�m6�,��]���'�mO�TӅW����P�gưC�^U1i}LI2H�N�+��DV��;��c��r`{�B=��1,w��qa?w17 ������ �}���c�fDO��O������k30�#-/ �ؿ�Tuej�5f�1O�������ܥ18Nj��`������:��+�kx�l+2�ˏ�0;�ȶ����4�oN�+��,��͘������"{f�5��{����ׯ�`_OHX�V$�;�iG�?���u��s|�G��F���{�qc��L�S�b���l�g�a%��d�q������y��dNa����-n�m��9j�ϙ���ւ�F���jF�ĉ�0�@�gí2�Ǭ���i�;dF�oL�L��lc�s<9>�()�,���N!{]��!��3�2�o��,�|��e\���\9�`��}�)7�%^�GO�ya�^��{�!�{�4� ��xe)).��Shf�dj*y��/(lkX���|X�V8v:��~�t�a�ʊ�|/�a�
Behavioral task
behavioral1
Sample
745ea7e9a1801e3aa8ee9b80bbdba245056204ae5be59f7aa88af9889ece6072.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
745ea7e9a1801e3aa8ee9b80bbdba245056204ae5be59f7aa88af9889ece6072.exe
Resource
win10v2004-20240709-en
General
-
Target
745ea7e9a1801e3aa8ee9b80bbdba245056204ae5be59f7aa88af9889ece6072.exe
-
Size
7.2MB
-
MD5
e0013a2842e8654384a10a5c0f981fa5
-
SHA1
7c2d848d89dadf40faae7f03ceef46db44fb80e5
-
SHA256
745ea7e9a1801e3aa8ee9b80bbdba245056204ae5be59f7aa88af9889ece6072
-
SHA512
c9e8a623d0f13b06419f2f5255eb2d8115aec98dc7a2da72d7c92e627b9c9ac51d16ebe40d547fdc415b17061ca4146126aa01a490b7d567a394825de52bd2b5
-
SSDEEP
98304:tMIArnIIUkPEfJSI/BDFMIaRyQjnPyALoyAMOerFCYRE7QDPEugxhHla:YIIUkPEPZFMIYcyserFCaEcDixH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 745ea7e9a1801e3aa8ee9b80bbdba245056204ae5be59f7aa88af9889ece6072.exe
Files
-
745ea7e9a1801e3aa8ee9b80bbdba245056204ae5be59f7aa88af9889ece6072.exe.exe windows:6 windows x64 arch:x64
ed95bdd6bc075a86d58699dd5df83cb2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
LocalFree
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
ole32
CoInitialize
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
winmm
sndPlaySoundA
ntdll
NtResumeProcess
shlwapi
PathFileExistsA
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertGetNameStringA
ws2_32
closesocket
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
sqrtf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 349KB - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 716KB - Virtual size: 934KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ