�):��vY����y�Ь�=���Ǟ��0^86��զin�Y�����ݏ��u��g�fذ�Q!�f"��ց��n*�2������ؓ���V����r�F<�N���#~��tYq6��_� �����a�����|���L�~ח>y^� d����Xpn��$`:�\ǭ\W���M�s�d)߹ؼ:2l�h�"���g��|.���Q���PM�#�9��s������ke�'���;DThMr�}�(M�^p2�q��2E�o�ü�c��J�$ �z�I��-������B*��f~��B��D�(� l�]���+l���p�~z�6Դ�o�aҌ�}��x� ���V �ܵ|}��զ���ō'ˁ�γL��sŧG�x���Wt�Bs8�6��u5q�J�}��I �l�ߐ�7ZM7j� rSh �W(Kfp�R�,9��0���4c���-OѯW ��O3" �vi���G;g�kX�x����p���C6]���\���_2boh������:`wUCG��9k���4*-�'�A��H�9/YTf��Q���:��Dr�#h�c���j�$Ap��.=!�vpݘ���f��=ψ������å<����p��z�@r��^�ȫ7WK�pq�%q��4�Z�������T�?�*�mn!Be���IB7�eb��p�[8�d��ܙ�pP�b�Rw�sV�CR�31Cqj'�[����`5��33�u�b��R��� c�=�lJR� ��0Px�3�mlp��k�CקF^��~��}i��%�okKy�J�7�y:;��F̤4{U�%K5�#\����xlvg�g+x-��t��C�d&F/�ʹ+�(U�%�a?[��4V54$7_��f���x���7Ux��0�OlN5m��Jk�p�S�m��7��Z1z���X�=Z�\��~������#�jH{ r�f�T�;���7��u6���2.|��ߧ�b���+]eW����0J`<\{�Q.LE��'��w��Y�j��g��Sh��.'�rs=v���R�f��b�i��c��I�d}z�r��6� 3&2���������P���a�|�D�l^�o���A���hx��E��)Բ�V�s[ܯސWR%~�dDvN�~����Z�P��/i�lMKM�RIVOڒ__�����9��pP�y������ԳZ9|��sc��)���o1��Ua�F��� �0 n���ݬqT<���6���-,�ȧ�vSpB�KZ��/� P]r�������$B�C�b�T�X�<��e�Z������QP�gq�SH�ֺsf Q�� x��s!̯>���U:O�ؐ��=��B�[aʃ�B�y�̖�qij}GX�X@�[."�\�.��L!���Z�g�m�v���,��E�}��Ϗ�Oqӄ�3�i����X�h���-dP֜�4V[�wB킎��^��θ2��}Qf�[yD����4�TÄ�� R�Y�|�?|�{�k�Oȥ����!�l��i���� :�U���Ѡ�C��E�~x�T�en�dqV)2P�A�`O�]�)`]qۆ�2�Z�(�E�UgQ�6��/4�D�@s[�z���w&?�{�G"���٬�6tsZ��.@�)�)�_+gxV!���4ij�:���,>�.6^0�B-H�X�U�N_���Ej��Q�[��ɘ'Nԯ{A�ӯ�|o,ƒ��t��L����w�\IJ�����!p�h_���6r@ >�od�+���1/��4�$��j4|0���Fsэ�t4[�T��k]Y�}ţ����r�7-[Y�hz���e��+j%6Fq8<F���O�����^�~3_y��qTS9�%;�Ig!?� [�u���ɖVۙZ5��9�%��=pɔ�VT4Z�w�t]-E���;��'��ͣ�����N*Ձ��9��I��#��VL�"��g�P�Z���l�$��?��_\��X�P�.��`I��b��sC��:����n&-�s�`~bZ4 �t���g������}�%`2n$��r��u+IoBT��E'Ci��f����Z�4��ƄѺ'�J�O��b'$UZ�!X)�*Xʟ ~����u��=� ,'HA:t3����Ը��]�m��^c�(Y�أ�_<xX y�:P����G��D������B��_��5���ݳ��Y���'��]Fq� ��H�]9������8҂����dP[qH,Qx�n��L���?/�dK�p�Z1�/���Pkl�l��s�:�R���[ ,��hW�]�L�Д~cK�����v����'�����#��Ԝp�K�2Cx��Hǵ'm����#ZD������ß(���2�k!fc��}Q!��>�F��HFIwi�I���K:&��x�$!�w� ��{��u��L��ܣ���j'�^[\�c*,�'A��q��QO��AVP,>'�Y�`��������SZ^٘K&�<GKн��ú�S5��C�;��^|y��N�_E��!4���]��gl:�p@�������7��ji ۶;q�������>��B;����-��~X� ����r�@�q����Z�e�k��V�� �`%-�IjۚׄI�A��"��Zh�K�M�B�lS|$_]p�s���4?q$��6����n���{�e_���k�φ�,�%�q��&��֗<5|��#�����?G����4�T;�5�.{%������΄1B�UX���竛jqҖ����k_��WB�x㢷]�g��Ȧ c��r�����m�����v�t�)1�C�ܨ��QPu#�8x�$4��1�N��K9bk�zBl�}��ջ��|��n��*!U#�����$�y<DŽda�6:_�I���ж�%���RB��=Z�>;���(���O����So�w�U�t^�O�ra�V�כ�g\��� d3��l��j�1�<ӵ�y�ڌ=T��ؽL��ǿqr��qtz��dTY �t ����R��1�����/��v�h3:H����X���p�%�P�^�ۮ�E ��/l[^Q|' ~6=���Ln(�?�v���P5�ʃ}�ߟ�;'��Tu��"N��!v#P�������,�-�lL�Q%Q���+�9�����hφsJ���_'�Ә�<�U�
Behavioral task
behavioral1
Sample
844d78d6b4d6c4a5b526f4dbaa9c017750e17c63b7898d4a4eae3cecf7d142b8.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
844d78d6b4d6c4a5b526f4dbaa9c017750e17c63b7898d4a4eae3cecf7d142b8.exe
Resource
win10v2004-20240802-en
General
-
Target
844d78d6b4d6c4a5b526f4dbaa9c017750e17c63b7898d4a4eae3cecf7d142b8
-
Size
6.3MB
-
MD5
d08bce6deebf3487be49e6c75cd8c54b
-
SHA1
097f4565f9777674adff7bc195cd1068833aa87b
-
SHA256
844d78d6b4d6c4a5b526f4dbaa9c017750e17c63b7898d4a4eae3cecf7d142b8
-
SHA512
38b9f8966b9c54f178ec5d92066806512b291164bcb87e3f55640a60dac1d2bd3085136be46ae59696dfcdfa68801779d9a9d65ce58fceb4a28c754d3b08b350
-
SSDEEP
98304:+7koqj7aEm9wWCct73dgkK0g+rOPoKB8oZNG39FPPlatFjnrmYp2HRRQit6Ey:ToqXaEm9FxNDXKNC3rEthmYOMEy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 844d78d6b4d6c4a5b526f4dbaa9c017750e17c63b7898d4a4eae3cecf7d142b8
Files
-
844d78d6b4d6c4a5b526f4dbaa9c017750e17c63b7898d4a4eae3cecf7d142b8.exe windows:6 windows x86 arch:x86
90d60b9d217b9dc1927963d2ed37c4d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EndPaint
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CreateProcessAsUserW
shell32
ShellExecuteExW
ole32
CoCreateGuid
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
bugsplat
??0MiniDmpSender@@QAE@PB_W000K@Z
libcurl
curl_slist_free_all
softwarelog
DestroyExportObj
wininet
InternetSetOptionW
winmm
timeGetTime
libeay32
ord493
libcrypto-1_1
OPENSSL_init_crypto
version
VerQueryValueW
iphlpapi
GetAdaptersInfo
winhttp
WinHttpGetIEProxyConfigForCurrentUser
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-utility-l1-1-0
rand
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 245KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ