�-/ZWyI������Тx�&�[Ư�u��+����N��IDA�:�nVt-N�x���{~b7�HL�������<�1��Y ��R�+.��mH������N3�Wk��I}&9�_/��v&4��M�}�"G��0�ЋGO��Dy�;�3H��,�r�������o[L1����X����A]d3ui�Zn�֚�� _rhW�-P����3/sEe�p�$��P~��N w4�-�����=�v#��|p�;���h��q��CL9_ڷ����-��GRƞ��R�)��S�WE����~`�猷�� 7l�d;�䗵hg��~t�?���o���n�c��y&��(��z�D��\H\X;�Ml-W���x����m|.x�V2�������(���M�֑@P��Pb���P��l�C���s|~� E3N����џ�p��/3��%�2�{x9���#�Ai�P��lY�b�ܯ7��N!�O4�ߓg�b�I���|_;FACBۂ)0Ǖ:*#2KGq}H�R7���dw�u�/��=��59��:®��m�6|�;P7_)�J�?m�*��Lf�{ ӈ�Ӑ���aw|��\߷�q��ƻ�!}�k���#Z�^D ���CR5�����; e�;���b^�$�^� ����s����4)ܩ;��-�! `���}?��X�Qg�V@,����P$�a���h��;?�x���9Eب�M�G��W�͐m*jp�M�>Z*36y`��|���8�x��ܑ�ǖ��r��Vs��qv���>F?���O1�`6w֭��M��|$Ķ�W��R9� 0_[ǣt$b\���9:���K.����J���ʻ�2�6����8P�%�Q������%��5��w���>7����1]��i6XÉ{8�SV #���+��Iՠ=�b(H=����N`�P$>�!�<��Gë�?���v3�1t �]^���܉�u��kU��da-���)~���\�H�g��; F�n � k�F�E��J�L[��V�p�'"�ޠ� �Q��I��;͍V�ӷ>��e��ȶ�矹�ˑ�}�-I}o4��&��k���`g���$/Z�γH��2�f;���X[^4��C�ڛ�Y5?���'I��s���ሏ���#���`B##�o���у&�QVR����E�X~[�G�����v���5��Ki��?Q �^xp���w;��Cӯ}}G�}��G�k���Ӣ�B��ɤ"�hDO3���"A9Ü7�m���%-�)����6��6hTM#��;oM�E�G��B�Of�%c��ɝ4�ĵ;�5/BW�;Vw��1L�.3�T��_ ��4��b���G�8O��JN�����~�i�ώU{�ڃ�z�q�8�Eҩ�w���t�_���<��MCO.*H{+q�d02Y����R���k!"v���ͷ V~��Fj����r1Sַ���%6�Ӿ��������AzŁ��S���x�ka���;@#K(����}#�j��"��?�{\ݻ>`P��5KӀ�^:̴ ��v�E&�MƟ.��9Xj���w�,}�zC����|M+^��KN�{�\�Z]4��%��,����m'���K��{�T"t����S��n���"^���+��5,+�@#��`7/,2��w���(I���ƿ7'�����)�{�?��m{�����Z;o{�m���m_��3��<�)(�� 7Ǖ����h2�tg��,Q���jDk����|aDClf1�?wZ��F�:�aq�����!�i;�]X���(eAW$'���L%ϐ�g7�W� ��]�{��h8%��术e�q�[_B�8�e_��e���y�6MZ�� �*�$4g��& ������M�mG��e�I�=��s3�9�zc{�/�������2!9��W�����#a}�K���4< B�yׄ���/��y�YҼ|yf����BT��W��Ls)��H PfC�`��:DRX��Ujy��4���7�T5���A �n���΅ʷ���yr�-�0���,^���C/�J/r�|/�> �[��b�CUE���p��O`s�k���P�q�x�B�P� }�#c���(�@������i�L|�6�T`��n,]y��p,l��uxGb����Y݄:�;������j눨ez� �{��^�-Bz��;>W=���� dԼM3<.&�$/���ep��J/����%����+s���v�>��� ~�����҇�욖,R��O�ԁ��ࠈ��JXE��~hhPEqT�w�D܈>�f�Hz$%�!��#�NJ��f��*'��Z�Λ�_=�_2��:����ޖ�?���F D2Э��w���_��P$��kϏ~ӟ%����#��F� �� �A2u1������EC���%�1x��B-i�I46j�`j���&:6��5fo����.�V���&qqN��2B"Ef´X<����ꖒI�iT�_u�L�yVz{�ƒ���8o$/�vYg�0�H!����O-�]8��l��1ו�Dm�X�������R"M9���xy�C(���N���+��i��?w �#/Й�B�>���X�^ ���^:����]�+� ��I�������Y�`�� �XK�C�u�X����X��M�1�I�A��1,2�������|�J��jI�W�J���J� =� �.��H�����rQ֑��O���fK*+jG��k�a�`�q��+K-�xwW�B�SS�h��3pU6����f=���B½ ��D���W1��Z��f��c�ԙhcW=!kP����&��C�M@�<�sU�@�������:�^|���ƻ�Ik��[S��xnm� �*���@ ������[K+&1��;~��e0}��y�����j�����>1L�y 1o%ȅ�|چ�j�G���T#}:�] ���E�v�w��,�qnz�$�H�����8i�CGx��*s�&�;�Pn��<^O�K07Z�� '3���e��ih��!���4=�n{�~]�_��Z��J����6p���,�a�&�٧�ߍDR���Z���?K�g����Ic� G�D��b?n
General
-
Target
rz7j3fJks9Rm.exe
-
Size
11.8MB
-
MD5
10bc2941af7922967ccc956b3406c173
-
SHA1
18aa6af553344c6b19e050393deac7a6d76832ca
-
SHA256
75a05ec6efaa56dbde2c1fe08c16f3f9edfed9dd2e5b52183f29c0326ec80fdf
-
SHA512
1d0aaed356700a3bebbc4d0b1afca388fb7d415cc12112522968b996d7a1a83b35660f4e0bf66f3d0ce03afcda3379ad8232d368835fa9d8079a20874708b217
-
SSDEEP
196608:3oQ7NgDxhi39AYbZMCZgb7Hgtp30A3qvhjxRMI07O8m9VzAfxTdFwdm6KVn:3oQ7Ngdi9/F7gbop3/ejxRV0Jm9VzueW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rz7j3fJks9Rm.exe
Files
-
rz7j3fJks9Rm.exe.exe windows:6 windows x64 arch:x64
f2f6dfffb0bfa3ee30dfd076bcfdde5e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
UnhandledExceptionFilter
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SetBkColor
msvcp140
?_Xbad_function_call@std@@YAXXZ
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertEnumCertificatesInStore
ws2_32
listen
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
winhttp
WinHttpOpen
ntdll
RtlCaptureContext
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
_difftime64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-filesystem-l1-1-0
_fstat64
advapi32
RegCreateKeyExW
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ