̙FF&O��1���['twt�mg���?Y��K�6�'���"O+H�>��6��3mg�;X+` O�j�WF��Oo�yI������y�M"����Fr��y M�(�Ŋ5\�m�#OY�pt�jw��p�N2�ζ��x���R�ֻ��ФY�-<����>oΦ��4N� w93�e�bTq��K�H���j��9{X���v�P��|X�T�Zx��_I�̶�!����6[�-��N��J�[L5q ��w�6-�aY�m x���?Jۇ;F�(i��c;�<-�,}���D���f������8���Q0삒�8#�p<h���F���>Ġ���T���͟������x�8���8���NF�^sV�s؈&,�߿)�.R�����V�F�^�Ͱ%�\R����ཞ{m(�H�`���Q�[dA�D�'���c���h?69�gF�aʝ�c���ǿ����'Β�{�c��ZR �zr�cH��o�ʽ�v;�����T��DCu:us4�t��d_� Hm���E�j��� \��Z9O_�a*'��R��Y�}���;U~��ȁ���#h8���svr�<YGi�$�G(�b~�-Z���3LO�0��;?�����ottoݻ( e�w�y�|�3�L�Z��?�6�#�ޙ�KR;s"�4Wo� ���T'uc��p<�*�;����$��M:��bc�d��70�����馆As���͋4 �^YQP�T��qr�p/�7<�/[�{h� /?1�4�|��wՋ���1���{KSi �? R�,�ClDHH]���V�_�$�8g_�l���#7��>�F��� � �̸����]�������Ƃ���.qq�C�'F��0)y��d_��NoIs�$Tǚ!8��Tǐ�lJ�>â`Y������NG�B|>��m��f��Ľ�������Kз+#������C�����%M+����M�kpF�j֍�?�eÛ�&��`�~d�D�⌜xM=��4����WM��}�zډdd��Gِk����掀�^46�.�Qu^��EM꽡�����Pv7���X��� ?Ǹ[�c]��yr(-d���+���QuZ9j�m�����I�m�/<l���@aza�!(�G��`k�W�>�yq��AY��tq�|f�f���a��q�j ���V�.e����&�xo<;!�N*�a�XW�sO�2JM��\�v�S(�4���*�3a�mod�)���8��7�]�ۗ�F��ES�l��5��=��/��&���L=%`��1my����qN��]#&$��$�X_x8��"wKf���'���!����篳xJ������fV��,bmde�/�_�=G^ ���y��JCK֚k|i�ߚH��E��,�2^m0��o�1QNr;�j�Òy.�]C���.f�y�z��*� E{-��T��E�=�;�����aȓq�G��')N�����i�T�j�4W6��H�G~H��芶8-�����9 C�Sv�ѕ?��g�[L�d,���G�x;�&��{�&m�PP�8&�����y��_����~���Zco�*�Us�)����� �@a ��qڤiź�#8����h���}�h%j��Mk��ӍKW����p�ͩQ�Fʖ5쉰*�)��>?J�������Q��F��|���2��}l�ltt�H��f���ލx����ˀ P#��WHr3O��ѿL���k�Ԑ�)�ap_�CT�2%�ϻ�o�n���]�R��O��g5�;� G��}��V��������������o�u�EL�Ǔ��-#�~����#��m}cN�T{""����p���r<\W+%6e�M�N$� w�-TAo!�?9������o=��8��~핏fd�{LE�b"�Y�iyr����qL4O8�y�Q峥|�Q��E��x��?Gta+�0�]Ju8�a^� X*���{f��+Y5��z�aе|oӨW�tH��8_X�D��J�{&'{<IΥ`�=�JK1f� ���s�w~��ѓ%�u���-�_�aD�{�]5�oD�q�bõŰ"���B��#������L�mm����V����Syo�Z�U�����+�-0=UӖ +vmnQ_9���P EQ�/ �e��d}'��%�F�@��ua����霅݈Z�"@�Ōýkǒ��ރ��`Ǝ�VI��U�G~F!H�g�pe�K�P�5��@��>�a�Z�GF�L�1ߥ�^wpOO�����_�.��!�s�f��v6_w��*�o����m�ya]^��Z��ej��ļr�����������!��_}金id�����9�/���0wMx�0)�J�=|.@���$,"PpNgu8s�B{�sҁ�.�Ȏjא�"0]�}�W��w��E����2�;o��TU�B�����:U9�_G�L�F�8��8���iU�oV^��-,R�Z��+ua��q"��:�H�m�h���3���wS�D�-^`t�3��-�% �#D�g��;5t�[έ�h&L�DvV�yS*;���6e�S�Fy�w)�|��6��1���b�Ե��ᾠ�Q$�tZ:a���D�ft��S��aj(�{��-N�`����@-��m����g����t�m1ZfD�gU�� ԃ=��C��B�Z�Tdo��fn[��ρ"Z��G\��%�rђi���}S|�uB�3t��G��%�K�9-2����-Wɱ(P/b�0 @*����2� ����i���3+��x���8h��k�#FР��r4�˴TQ0�tt�?�� �{�P)^�W룡m�\B8P�nI���G7�zw*�Be`c�Gd��� Q%�qn3SW[��WpW瘁(���A��o^IR��j��u�3��Q� g�>�/>� <� �|h �v����Hx�̂>��lJFUz3$��6,�Tz�x츋';�RQ�?�)<'�W��{��D]���|�Z���3�87��y�N�wF�q[_�At����B0�cpU]���$X���4��W2^k��+J�ojd�u�Ti}w����1����B��?���B�H���Ȓ�6�U|1kڒ��c����
Behavioral task
behavioral1
Sample
7206d4443497a4bc7fd0cff0fe622e5b7037ea4947f1c2f313ef98eb755e99fc.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7206d4443497a4bc7fd0cff0fe622e5b7037ea4947f1c2f313ef98eb755e99fc.exe
Resource
win10v2004-20240709-en
General
-
Target
7206d4443497a4bc7fd0cff0fe622e5b7037ea4947f1c2f313ef98eb755e99fc.exe
-
Size
3.9MB
-
MD5
1a23985dadc6831a82e0595728023980
-
SHA1
a3e8ec7d8f8d7accb522245445dc8159c0b94d12
-
SHA256
7206d4443497a4bc7fd0cff0fe622e5b7037ea4947f1c2f313ef98eb755e99fc
-
SHA512
17daf3895ce90820ae289a10ecc97459199b70c3c08dae9c4284b202c319e400a95f31e53caa8bc0aca0fbb5c95424c4e27a56898b9aa551c0ea832c5bb117ac
-
SSDEEP
98304:QL4fhqBZfj5dzCIZdmH1eYmxDrnAwvOTVoC2FCBazNoI:Qnfj5dCIZdmH1CvaA/zN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7206d4443497a4bc7fd0cff0fe622e5b7037ea4947f1c2f313ef98eb755e99fc.exe
Files
-
7206d4443497a4bc7fd0cff0fe622e5b7037ea4947f1c2f313ef98eb755e99fc.exe.exe windows:6 windows x64 arch:x64
759a583e26c79230c2c829f7f86ebec2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcess
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
gdi32
GetObjectA
advapi32
GetTokenInformation
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
ws2_32
send
winmm
PlaySoundA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 299KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ