�g�)��=��((�D=�d=��A�јxZx�7U]�p&��e��d�`�?T�l��-�(��8_m���RkC��� ��9P�������o���Y��5Hi�E$Vc�����`Cy ���`����� <� ~��TO�q��Q��G_�t���p(~e��l�[Z}��yE]�ca�Tg�Q���-�C�z⡤���!x�X;o9o�Lsv����ޔ�59B=Z*��eo�*�=!�ɛ46=u=Q�y�\u�j���*���f���V%;T��(�l=�Yy�.���^-��1g�D<��:�H�����'b�� +|F!bzݥM������C�����J�KM��97�R[q�&0�J�U���/����1����R.w���Cp(!�6r`.?������?C�5r� 3��������Q�8�����u�Ge������ّ�Ֆ7{�^��&�.)��K<b[�I���{e�R�s�kƒbi��݊i=����ME$�5=�f���)][�ޗ�"��"�m�om^�P����\�ń��h�[�F��(Z��A&ݢmkK�)-[��o|ݤ#�Y=O����7��3�;X=�Ы �A��CW�W �B��zM�枍=3����co��{ � ����q`%��r�;���;x�d:s25��.�#��ާ�- ��cl�R�Z�A�^�rw#���m�k��Jܤ����:��u��4�R3[�a�n����\�٦����\��J�D���M���&+#��bP�rAg��x�������'��s@�6�5�D�f���21��\8ފ��d�Z2m�/�=+��a 'q��پ��x"������@g�p����KM��$&�N'w�-U�5S��ބ�cҧx������țަE�\�dy��G���g����D���(�F3�����������/ e0 �!�R�ԦN�w��\��-8��Q��}�Ul�2�N��X��갉BR�O��V$�Gn�i�lHk�:��a�@�����b���lX�4|z���N]�b�X�Mc��R����v����^%I��p�X��2d�?��)�����>FA�žƷdb���m*����;zO`N�$٤8�K��ާCʲ��]�|X��Q�!�g�"f��\���@�-��{�:�C-60}� (d��8)Q�S��O���|y?����O[�Rνx���=M������ 86^�}�n����fQ6(lQzl6�(u$[8x���3 �]��Rw u (Fy:ZC�w��w���3�d�ƑJ��b��!SD��ͦ� ��I��Ƥ^Y�1��W�o�{�\B<�Q#M�.����-���7��<^|��7��z��i �&1'#��4�@�O�-�_w#,r� ��M������ Zvz2$�ut@���>�N�����)��m���� �x<���6�A�ǧso�r��FϽ>aF�Ŷ#�Or�s9��#��&G7��H���}���D~�)T����3�X�[n=�tٟ�"�\7���&'罁utk_� 4Z��Rx.��;��#i3q�5x����"sT������m�Q��m�^vt|��v�hǟ�d�L륏����~>j#�P��a:�~|���Jİr'0�G��}JT�a��k@����|���$�A���Io<����użTP87qFgg6���[5m:�++sO4�r:�{�g�`�����P�z��`�S�;}�*��q¨F%��΅m��f�ͬ���������Je�Ϳ�4Vo|��P�ЦaGN ��uqIS�r�������%��c���s��뚋k�A��36邘�.�;�SĒ�,`3��L��UKN:�����$mp�үT���a�Ul��~��5��AsG7�����!+BO&��M��ZF��' p�;d�s�6�|&�5��a8�X]l_����92-�*.�Su,z�֏Ϛw�g��ùAE$�d��Ai�6O��¾zA/���m����"n/i��m8�E��U�d��&=��b�V�Tk�"i���C.�v��Z'N�qC��%������ �>+m�K�����������\��c�E�> l�s�3���M�w�ܠ��ex�I�B���� �22|:�cX����#�Wt���X���BB��u��5C�?�@��F�8A4(��4d�<�f� ��(e1��p���je9�xYr�YN$�6%1�.��FHY�oKw"�*��D�r�o�Er^c�Lɍ=�O)�C��pR�`*��H�����W��Z��I:\o��-KR9�adB��9GN�^|��y֗�A��j�Ibi�y�+Pyw��`�m"��l��]-tؤ x�c�Z�q�`݇9�p�÷������rpi�YB���� �C|+Fl0{f\�%�W��ݯ��Q� �����Ī��M�Zݫ����0 y�z�%�v��p9�aw-�����Vb��D>����w��Ɂ�2ƟY��q���Jʔ�/�c��]���s?H��V�[o����B�*���h^kc��CX( �$�'�a[5���Zʇ�gc!���)�QJ=(zM�����2��";e��4���⩍A$��-x��l�O��+R��j����#t�L�@���V���� �'7)�ZDž}��d�����ߜWZds�~`x�ԥS�1f�:������I�4�$C���̶=s�y3O�;M�=Du~�|4��{�U">�Z�Nӈ�l�Lp֣���gf���ۀ�����n9E0n�_?�)hP��q���@��� S�3��?���PR#��>�@#����/��Tw/�deu�:�$����.s��R�N�h�����5E��]%fU?���g���_$0�[��)^*i��}�|���j���(Eu"9TsC�5{Hׁɸ�H���l�l��S�i ��(��<pn�����-�b�������*�W��ɒ� E̻��t8��r'���ej�`����^���<EqW\}��l4Y/�E�=r;���E�D)�Z����tBsA̱��}�@QazkTS���(�X���i[Si��e]Tq�w��J�+�����,��]�T5KG�V8��h]�ANv]u��JAs�
Behavioral task
behavioral1
Sample
89db04c7066a3e4e55fc60d5532dbe20N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
89db04c7066a3e4e55fc60d5532dbe20N.exe
Resource
win10v2004-20240709-en
General
-
Target
89db04c7066a3e4e55fc60d5532dbe20N.exe
-
Size
9.4MB
-
MD5
89db04c7066a3e4e55fc60d5532dbe20
-
SHA1
635541e5f5f7463f38d108979c72233485e880e5
-
SHA256
63936d0a1713a1ce65cd8fa746d989184326b30e7021d2333a5f7e66a5523f6b
-
SHA512
a40ce19bb85ce7057e0483150975ec8b3409cce567a1083e3c423e0b561f1394512278a31d7d79a7192e32e416f16331e51576db6d5c927f6f80d14d27c3cc5a
-
SSDEEP
196608:3vL6x5lzGPjybReTYtaXGjBLpc7pkE70dRa7UU+oiMdk3JIgfSr5Fbe:365gPjybRDc7phgrRUl4JK1F6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89db04c7066a3e4e55fc60d5532dbe20N.exe
Files
-
89db04c7066a3e4e55fc60d5532dbe20N.exe.exe windows:6 windows x64 arch:x64
9541d33add34a7888dc85c11ea993e0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
IsValidSid
shell32
ShellExecuteW
d3dx11_43
D3DX11CreateShaderResourceViewFromFileW
imm32
ImmSetCompositionWindow
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
WSACleanup
userenv
UnloadUserProfile
wininet
InternetOpenA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 630KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 359KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 863KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.4MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ