���_%�Jot?D~,��r�yw���(���{L9A��X�� �l"yx峿^�ሟ1���不"��Y�,�� �F�scL��B���|W>NH�ٮ 2�t5*iF9�=*�=�t+8�5�n_Y:��V]�|�>���n�!�m�[��r!��GW� ���唺w)�o�' � �TdJj���,�H(��:l���6���&���G��H9um8���3��l͗�z�'X��|�; $o�5R�hk�")b^W:������3<�i4;'JôrS82�<� F=�U?���P�������~�7I�c�=��fW�I�)vR�`���1l����T�}J{�9�}bmһ�#>��Eu�h��Լ����Z�^Ȫ��R5nE4�K5�F]�4ap���W�+V��Ӄ5c������ڂ���ޱ-�킼�߇+f8O0$qI� {��&��R+���(�� u妺[[>��|=�4>0Թ��,�؍��i�F�\K�&X;�Fw}TqgG��#�L�u��|8��t�ä�VF��Uwa��H$�p�)��҅h���珢ix@cSjK��������K��i�j2��.���x����Y\Z��<IgN�;}l���۳������-,��� [�T"k�6$5�¤��}�%���$ �����X"e���9He��t��}���D�`z���h�,2���C�ҏ��Z�`�]���r��Zg_��F��U��j �X%�v�����g��v|H��t ��)���0F��%��,��x;��� ѶTLe��{����*�\l崳myEy'���ړ�sy�"����Pw���ͦv��"ps<���/�����+^���n�IЮԔ)��C#����@��=�3o��du� �_�YH�*�1oL��\ � Cй/ʡ���Ǽ�C"���4W�E0�s�8�=���L�fQ�wŹ ����������8�����g9���`JA�\Z�[ )>�l������K�C���((�N�H� ��\*�2&��#x{�W���.T<�Kh�OC�NBԲ���_���Zլ�s�_��P�ψ8��{��ǯ�T���z_UJ��w�(n �=��@����[�� ,�~�}8�Tg��+%oZ�ƃ�A�y5w�R�[�h�2K�G�������Y q(�?�n�;���*�C:��L��N�>`zqCډ�j��!�m� D"�c��e��f=��L�3m�ͣ�=R����YzC(f�h��m�o����Y�~�N%�;N)&<v� �D���+W��_�'�_��Ep4�T�Pv�j>�����L���T��3H�"�m�)��ǥ)�R�t���)5iԹ @L���I�ow}��x�M�T���w��d��������E¢~,���ͧ��<[�(�rP�ĥٟ-��O�Шɽr�o�lq���-U����D�q�:'e0=��x��j��h�Qa��#3/�܋\��>����Q���W�o.2�.�T�t5Iy^��*���_7�ut=?T�M'l�� ˂sZZ����A��������?���s�#���:LM�(�i�p8�@@3� /�����se��Q��fR�����q���Χ�:'���L�Ѽ/ H�iǷ���fb$�Db*�{Cc����4�j /��j����0�2앶LJkI��$������6� �$8�7�߱;�R儧��qO�J@�Ւ��v+N���V�ٵ�|��:,�Bᳬ�j����X����jtKn�"K��loA�\�L�4�;̤��R�E��䑮-��JX�*�|��G2���v�=��߇���hP���ΆR�v��ol �i���Y2\�&;� �.4�8��l� ,'6��U�i���?*se���!��i���Y3��/�0�6��MV�!uR�"�Lsgl���IE{�;A�M��a�G_����8=U�����<�J�H�����ﱛk��1��v�?`���Ia���3������{���Lz�\�X\u"<�T��x?���������c-�ۙ3���)��*H n������ �;*Q��K,�#_�B3�� � T�b�a�ԠV����,D ��p#�)Q���M,9g;Ў��l��o�O��ol*dq�7d�/������_��)^�|+繰��'���[,Q%�{ڜ��I;%�J3 �R*�6����&F��#��s�X|����Y�3͓e�ނ�@�g^R��9�|c��f=�}��I�������Cm��`�o�}D�wV?��=@��%���V/�8i�~ڰ:<MEB&��!E�.�Z���,-o)єڧ>RhSGZ�HD�F�jt�2��$������WNӧ_�Pq����C���R���jX�9���BOtV�I��*����´3��x/���9��A*;���lZ^��O����.X4[���Mm��E���rePd�Z��������k.+���"�j�*&Z��� e�]�%]%�߉�<�;��a#o&yn���6�C$ �hȘhVnQ�V��H��Kr�6��fɥR��v���"��E�O �"���x���~�Hz.�jϖ�7�2��0��;Xh��$�Hk�M�6`�����U7�e��}��Z���t�}�q�rW�����E���II��[։c.i&��O2�[FW�&\��JD��� �T�x��I �"������C�Z-�b�^\ "�baZg�=�S@v�|觛F�@Ä>��r[(-�hyj|����QT:�Ky����m�ٜ�S��?7��QF���@|A ����и�聶�cS�>?.�rDAl���!%��D��.���E��awP����O�����%�r�ƙ�EY��L�%t|��P��>i(�6Xl�n藺`��.�����}����X��"���������E.x�)::�� M�x\��oL�����Ηu�j�̣�P�����c/@K[��s~��Y�?����R�A�7Ɗ�����2�g� �1H�zE�`�w����K,�����+��B�-���������S�큃p�$�2�g���i?�?}�F7��_�#֮�%rr�Q����å\���Gt*Mޥ�
Behavioral task
behavioral1
Sample
2d169f66929b547f245ff8132bee0130N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d169f66929b547f245ff8132bee0130N.dll
Resource
win10v2004-20240709-en
General
-
Target
2d169f66929b547f245ff8132bee0130N.exe
-
Size
6.2MB
-
MD5
2d169f66929b547f245ff8132bee0130
-
SHA1
c35f81cbda2ccbdca48bab60eaac48940347145b
-
SHA256
6f478516263001a6e5ad83baf308a0be257846b6f3b1c9cffbbc6310c4a77828
-
SHA512
6d25c4c6c50d244eacf8d137c2c768fe31304834b1a210124646666e742748e49747c1af3e6af1f3d0126b3557fdad1283a5cee5af838512b2fb2b47a17b4c00
-
SSDEEP
98304:18xmjRToBsj6pz3hHlvNrFlecwRMOJN73dJcJeXE0JIAp+s41fMTSqY4ttBRz:Ox6Foi6p7ZlvNrFRqMOJ1dXN6fONYMR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d169f66929b547f245ff8132bee0130N.exe
Files
-
2d169f66929b547f245ff8132bee0130N.exe.dll windows:6 windows x64 arch:x64
16dc595d7e83bb737d2b971382ef9bf1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
libcurl
curl_easy_getinfo
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
QueryPerformanceCounter
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
shell32
ShellExecuteA
ole32
CoInitialize
glew32
__glewBlendFuncSeparate
opengl32
glDepthRange
windivert
WinDivertOpen
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
imm32
ImmSetCandidateWindow
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
wininet
InternetOpenUrlA
urlmon
URLDownloadToFileA
winmm
PlaySoundA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_wassert
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-math-l1-1-0
sinf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 334KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 409KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ