95�'��;��X9pu훔X@�^& ��p��/I��n�Bz������@��0-�^:���Q�����'��� ���s�����j��r���c�oQfn�E�ȃ����.�%��0�=;�k�YT�!�۾E2ծ%�7*��o��o� ��&�U7�(�����9�3�y�k��t��F�iƓ�58cڬ�@݆�g,Kf�#q�-R��`��7Pz�~C=yv�OsSR�]ږ�ܑ`�~/��g���'w������A:��-K�����y�89��HD$���YZP����ǏU��J⮮��b������.B'�V�k�����8v%�^\�$���b�{V:P�H��~�9�����4w���/n�T�Xs�����O��g����#4���Cp�XB�*�����Pi�\��h���A{�-2�³9���3+f,�zU�M���T�!屄� vbd�q[gɪ��XT0r ˝�>z�T3�V��� >�)��PeH�p{;�mF�uQ+8Ph�E �fR�WV�M���;$��"�й�!= RL�FR�eC��E,)��ȫ� �\��iБ�aE��O�i���)���fV�03��%�;M�{�6����QYoN�7S6�G��������NwC�T��]����ye����^R�(��l�H�N�h|��ǩM��|��M�4i�������9�Ab)(鳋��c�*�?��U1�K�t�`T�s�2`W�-�z��]���m�7�X@X;縒nt� ��u�a�erI���U�9*��!a$7�#�+J�7�Ns2h���%ш�?���Z�PI�m�9 �[�]� ����~ٶ-��qOK�3�:��Zכ�֢v�@+[�R��B�����w�a���8�,���g�w�>zd�vy)i���� �#��T��M2@�ZA0���)\��+��Ц����D}��n-�y�g��(S�B)�l�+"eQ8���$����a�H61h(� �+@,���`ky�u�a�M��c0~��L4GY<K%��y��q�'Ȟh�=�扽��u���j��؟�%/��o�2�ş�x3���PQI�Co�Q�Fs�V�X8E�Y���^#�:=����b`�Un< Yb�ٷ#`��N���3sv�!+�_a�>&���m�)Y��q� 0�~s�b�Hc�l*��Ov'�4-�f��4��,��L{+����$9����Rh��*+������ަ��,jF�?�ߕ|}��}A��_5'7Y0��7T�M?A�e�zU.��0>BR��H'���M���6���i�/J-P��:���!�Io�@rl az����c����D�N�������#��v#EG4�a1jFP%{��T�� #�$���F2ƕz��qd�$��)[q�V$xث���,���|�R>�!����@��@>�}����iV��/�Hh��$������ P�O���.�>[ɞ��to�Q$&=L[0�Gr��^ԩu�D���!>sG�:����>(\��p�����3�﹃��hT=��ǣEL������-M_�t��b���e���ć ��C8�"������^pM+��tO�� xp�+�r�u3���U�����p��z��>���Y�k)��LQ��ր�<��T��$3*��Пq�r�O��*̗�O���|!���I?�i��E���~��ƭq'h��B�2�7�-��X��f��[�����p�2�����B1W��4��.��z��pO$8lJ����S/����߅w#`�_tm�@p���.̑��9]��ء*���ac�Ɇ놫=��.3$��Fo��d�笯5�4����'��߳�s�#Z�A�s0}v�Los��������^kH�|5tY���`���%?��{�5�q�m�>��<����w%���p\�Qc�2`��AB&H��;�A�Kʫy����g*3��l� �ʄ�+|�Ѵt�;��Rڀ��2S�j^-�vF�nK}�x@%(/E�;�w�c���;�BYz�y[C���:x �g��qg2w:K�T��7�~����=���ܭ>l�%�ՠ�1�����9Џ�s-Eޛ���`��(����IqS�f� 9+��0ʇɆC|�Iu�IGסǭ6�g�N�q����~`��,%�j�I@ES��Q���C!�Ԣ��o�����g7�F��E�,DVu6���A���`�$������<�~X�o��P�S�M��і�g�cc�y�."��a���3����A著��|[��+�& )k���2Febjސ� `M����Up�V���M���q�'���q�<X)�-� n�-gzd�X67�p������~��5O�L27������_,�Vק����A���]:�cF�"8¨ |7���mB�G���#�Z�x⦼�2��Hn+�l�/�B��3�����`o�HV�c�p�x�ak9o�sٚ0���G��V%S �d5��,zB�X�x��kw{N����^�����昴c�uN;%���B��'�V�fK�Z����I����x{_�����w\�3qlTe �S�"�;)lS�"R����*-�"і���0�WN�Յ��� �q��K�m#c������B!뽸0�n!���q���]$��!�����5��6�o�d"8uU���SŜf^�������X����e�X��yZT��b����V#4������d^�\�t;�~}7��o�d�`o��1'��@���J�l!f�J�;w*��sS��zff3�%V�ܛ��.;{�qvi�mꂤ�7n�}�p��4=��xY�ׯ���]���ү�������FS-�z�,B�ƍl���&%I��l����$y+���&��r���NZ���8u��<��G�u�u(Ǖ�As��">� f��ڙ��ɚ� �N��Y���lMo�@6�S :��!�g!l�8堀SJ�$y=,eL�x�Ն3��>:gk\t�0�|�K�����|���h� y}$���Ӽ���+nA ��|�)Ss�Y���_v�k;v"�'D�R��H���:�+��f�m:���1��s�/k�$�|h�xW�r��%��R�� �
Behavioral task
behavioral1
Sample
build.vmp.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
build.vmp.exe
Resource
win10v2004-20240709-en
General
-
Target
build.vmp.exe
-
Size
9.7MB
-
MD5
973dbf044c376ca82b5ef06c0d68b02a
-
SHA1
04b26faa9f63fc3c3be186135b95758bed91bc4b
-
SHA256
2506d864b046f7c0cacfaeb7e638c03d2664b3834d5ed5a2513c415720c6bad1
-
SHA512
64da883f4bb787c0b5886673b3d532c0f54bb60f5e007174ee41afc0b375d8773a576e8c1e6e0b4235a38d747de5b4035b28e0fd3d2b0a1de405e291ac88a2b3
-
SSDEEP
196608:40tYbXx5S0atGFwuP4MsC6R4Vqq7NtHUUsrydoL5C4Ic7mX1AEfYIGhjI:tKqju9szR4AhLC4LyeKpGR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource build.vmp.exe
Files
-
build.vmp.exe.exe windows:6 windows x64 arch:x64
99ad014892fb86befa716db7ab350b85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetStdHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
RegCreateKeyW
shell32
ShellExecuteA
msvcp140
?widen@?$ctype@_W@std@@QEBA_WD@Z
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
ntdll
RtlCaptureContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 679KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ