,;!��y]��;@O��Q�LY�?��7�!��8�w��WTV�7B�ou��`�nFsW���ϐ�TǁC�GrQ�9=�[M�3-h�@��\�M�`Zٰ�_2 B���n'���������*r�-s���I8���Ѓ��m�9��v��Hs.��ȩ�p��ϛ��WR��ѓ&8�!P�Zj|_�ڦ�#�X�E�����G[���U+��$p]��l��� ���:�ڋۼ|C�eοز.t�9hJ� �J�,[��Kc�)�����d'Lr�u!�B'yE �z����8-m�\1?�L�L����j��6m��5������67톇��i�sV��� O���V����{E����� ����u�w���ɑ�!�t�B䰱ǩ��Ӎ�H�����N@tb�h��vj�7��h�gb�^��tw鞋c�mGR)��̬��d(�yl�ۆ =W�Кw|��_L��s>��^W�&�c��r�����e�2���!)� �tK�7²�L&qMZ����!c���[@Z�q���K�l�A�G�7������}��Z z���䑐D ~R��<<j��%��hrI�G�N��j���0��gN��l��$��ӕ ����"$n�u���珟�������l�� $Tb�78/����[?�4�-�s3ű��>���H���� _H�����pW7�͞!��R�Q2�~�q��c��\�y"�;F;�@q\ ���l��y[H?{���B��(�j��=�߄j�vey�Pd���I0��l��`E�p�������������5m�"� �*J�1$ |0�Y�6VT@ύ�<�D$��b��rq�G����6��pM&ka[mX��K���5O�`$ �*���TZ�#z������3KR�G����8b��?C�|*���Z�%��l)��Rl�WY�ך���O���篡�tbJU6qLj�F �h �~�u���)������%u0�JSnO��)��m�' ?f4�W��n~����i�9������7��;*^8�6ʈ���ȱ�*7Ս����ù�1%K�>���½�����b��+���xU���Br}���66��J�e�H���@��H��jm�C_ ��NsH�d�tr�1@>���+��38�s�]�:��pK4'6��g���f�J�}�]�������3���J��_��Ȓ��p=�YrR�F� k�&ç��sA���ExPq`�I����I��@c? Ih����sV@l��B\��C9)m������[[h���g���Z�w)�j�2��^�qU���J6��*@4vL�,z�x�W<���*���k,5�6!�X��H��b�%^T��Qߎˀ3~�e�J��%Q��)�t66&��x��|�Ǫ~K�.g��DQ�+��^��~u$�� y�X�(�xgT���ˆ����0D��3u�� H�q��̝�Ǘ�l7ᕧĔi�A�c�e�Ǫᷠ��a���+G��5N�� Go�,)ߎ(���,4"�Bb�˂0}�L�~X�RJ0GL%�L�P� �x`��Ei|��s���;��(�$�=���v�� ���H�V�ꄪ �M�w��9K�q�*� �ϹF 2��c��mfzX��E��R�E�����T:��d�ތ�N@8��5��+�m/ƈ��*2�{���9L�~A����e�-kxN�P�f�R�L2-y[�%�U���ٜ���Jp��NH�D���Pe�YP�Y[�ԡN�&�YO�^Y �Q|�S����jA�,QXK6*�RF�{)3�ߩ|)'�t���,)�w���s0�Y�kby�P[�-�1��o� Y�{�Q�uv։4����[�4U��.ʰ�Y%o}o]��M4�q�g:�`2��>j()P��[[�&��5�*��N�9�j�78�F�5�j������ؾV�����$�u�ׇ@|u�FC%�/��#x!p��R���0,���r��N��/T��GW��FV��TD���d9��D٬OHQV����;�ҵ�O���|�٣��]ث��.:�jAa����� սU��S�Ś�ӌN���lѴπQ; �,f�˄������&G�_ IXW��H 4\�ª� "M��._����8�� ��Z�ch��*���r��Y�l����e(�T��23�=㜧f�K�Ѫҷ��er�{�L�����������!Et���l�T@�P���A���}����!N��o�w��_vkC"�F-��?*�TN\���V��aEȧ&�6W �/sA�b#�_�f��+�@H퐁��\]��h|)�T�k��0Ib:���j�J_���x��(�k�5ɱ�ͣ_q<�N��L�k��ۍWՏ��q݆��;̥R��-x���(QKS�o��kY�%yX�xI�|�"-&���%*�䁒�/�JL&H+]_A)�jy��[�$�]�s�~�ߗ2oً��$���,�fZY� H2!�`��A������C��Ρ��J��K�i�<����z��(of� �sv�ρ�� �LyҠ�����zf��eջ4�}�F�QW�^��C��X��B�U�Ѱ�}Vca|��X�d�>�z���4���<�8��Pxâo91r�/=�aO3܅[�=�� ��1d��I3\���W5+.��?yQ/.˽w�3�{��ay��d��!m�C,�Т���U�O�As���8�R�+UCR� �c���Vg����������h<��7�����:�l{�_�*�F�f<#��<6EKVtݑ��ϙ7<n�W3-7�}8�/-���/�[V�7%�损y����e�G|���ޡ��}���qA���/��ᨇ�{OjZ�A�ot�"��$�����oy:+����:� F�ag�u?b����l��N��0���"A9�kaOi��'�z߀��jޙ諸sx5�:�����[��'��d@�kÒ>��nI�r\��R�����Xϓ��GhV(sYxa�/u���`%���(r�@F������zFgƫR��h���0wțb1�.�Xv� �66T`��s�/�:U���u��-��ݎƐ6o]7�E�ϼ��'l�1F y���L[���A
Behavioral task
behavioral1
Sample
195331d814157ef09ef176c8e960d550N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
195331d814157ef09ef176c8e960d550N.exe
Resource
win10v2004-20240802-en
General
-
Target
195331d814157ef09ef176c8e960d550N.exe
-
Size
5.0MB
-
MD5
195331d814157ef09ef176c8e960d550
-
SHA1
53eceb2d63167c5bfbf3801f4985473ed11dba49
-
SHA256
3daa94fff89c35b8c8d4b1d0ac74c428011fdda4a8d1d9ea91aabc204469f286
-
SHA512
80560f90d83f59c666b73a2ab66c4a493f776bbe3530c6e844eb6a58550ce7a433da2993f8feed08f5758c872cc99a53440e0c66f4dd5cc36dcb5334f26d5b26
-
SSDEEP
98304:GeLCY+vdbyST9e/Be2dYh83hwKj+Koa2ErVk3vECeILsTspIaiG:GeLCY+vdugaBIOhJSKolEZu1e4Iav
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 195331d814157ef09ef176c8e960d550N.exe
Files
-
195331d814157ef09ef176c8e960d550N.exe.exe windows:6 windows x64 arch:x64
cb5be78c3ffefd234717f55e04cad80e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
ws2_32
freeaddrinfo
bcrypt
BCryptOpenAlgorithmProvider
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 350KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ