a���v.L��E3olP�뻳��a���q&��jA������%�[�M(;;�����h8��F�ZG�U�4�-f��H5�F�b!)b��c*�+���5}�?��Pn�P.SF� �Cb����k8�ڴ�^1�W�2k�4�7�P���1���+0:���y�Kl��'�����(j,��Ͻҝ������fHaV��WwP~�����d}��\Lߌ��M$�@Ds��o�%���jP�.o/%�H�)�b��HA���� �8�ӻ8��ظi���Tһ}�K����ឝ ��#�b�!������D��<[��q���1�HM��6���*�� ��٘A7y���V�+AO[cЊ8��#vc#��ƅ�S^��Xd []I��%c�X�V�'gӸ���;a��T)�.rv2�,��p1ٓ&�<�Sq b�).T���b"�t���JR�H��Vٗ��&�_s���e���q��hU[N^��܊Dr#:*c`�U*�w�-q=����=��9|H�0��339��s%3E^�"?}�<e�|:�B���텏�?����f�Y�TSA���a���"�A�����[�p� ��W�εOQ}��˶�w�;� xaGb�����s���bJ�<���[�|)�={�ڔ-g���8��[��^&K�c���5�D��z�A����+��w��~��z��E�(��0bM\���O@䭑�5/aO���k��o��@dS�TF^WAxZ%)��G ��Hcݖ"+ߏ����ڧ���ƙ܌P����oQ���o���Cѧ`!�*U'��[;�S%�����������5hGz��~�.i���DĦލg%R��ץM ?���F�纍>>����m'+\�"&oK�3�$���և���!qҫI\l�� ���3�,@� i{�`��T2hշS7/ӡ�I?��6K$���V����y+D���kֲ��to�Q��DɁ,��b�z�KUL��㓈�Ec�ƟW��w�Fw��9��"3��ݥ2#r/j�_�*$5���]Xm�r�a��z?p8B�9���?v>x6�5���P`2�!�q^�F]a�[��ۋ�tE#�Wi�&�� �����f�UiM��2vЙ �+�hDM��D-�nn�����a�-������Ј�k�d��������[@���ݚ,��d������a4�3������=��S`)y+u������&Tn`��Q>��v��<_U�����ʔ�� �� �Y,�ʑ�����]�2'?s�K�1Kb����1x4m��X��j�^ɚ��hqQ5�K�<U�wY�+8b����Ҩ����C��� ��9���̅!/�c��%�x�Oz��H�qQ<�Ҏ�nk�s`�%�IL�6]��3/k�8���D[}Ж��5�ߧߔ������U�!{�����W���!���D8(�����+@r�(4UvױnO�\+O�i�S�R��jΧ�����#�T_�+^��.W���+�����ن���T)e�$sY��L���#�Y��O��`ײE$�>(�l�N��!���y�v^�7){R_���� �_��F��/r�V���R-u��D J�@��H9h�{�~��b��=*{i���/Җ3��3�T2��@d���g�?���kE�?>7�����.A��/�Z-o�ls����@�Z5��.4��1�]u�z�Z�Y{2��S�Ǿ�C�X(�6���K.[���"�ft�'S;߰8Ƿ��j������}}ѥcG�.�ߝ͂W�F�%�MNC;Sɫ�M��i~Ӣ��r!W��\�#���Ao�s���tҠ�M�U��L��i==��bH����7�m��쁠(�q�<8��ei5���7�l4�v��a��5���Ck�F��eW�G�*��þ=i�)L����IΌ�{0 �&��T��d��V� ���#ٺ��l�����oh��^t��$��q x�pP<Di�;��:����3�E�]{"�E�����o�Mo#e-z|oQ�@A@*4��;?.�W!��!8�T�vi ��M.a��,i�M]��r.t�R ?vF�:K�� ��K)�$��悑�W�ƍ��8�9 ���%@���+s�Q���Lȯj�4f��Z���T��TebnGo6�D�C2*��9�jNdRY�x�N�r]�Z8��?�5t x��F�K~]�� ��)eMD�\��7��I�TH>{v���8Ӓ�����˸�_����,`@-�n(����gс��.A�#Mɦ�b�ߗ&�Xۺ��W!3�M(p�c�c�EH%�%�/9)�÷�7����Y���g�y�EI���LC��jFmYꃸ�x���!�{��H⻑+�:K/Rp�%��@M�������ek�=O��Z��v~��/-��QR�9 �8�_�sxK�eF0�c��Z�����o }9Y^���X����C³\S6S� �̧�3�<SY�Π"��-,����/S0���r�Y�BI����Q�rd������FD"J��,�-�|-c�4���3����V�L:�~>%}��O�蔛�?u����O�K&GЩQ]�mI������rGǴ�*�@��s�4A?��|�R~6*�gU��Wą-0̀ aeFЃ1�/ ���/��v�.(���0�귔��c��UOrg~\���$�G˲�?`՜����^/������E�,g�#���7@g�X���p�����6��%�C���{�$���%䇱�WWE��V�����)/E#lꁆO�P��`��,���lڧ��`N�^$Rj��/wW�Co��um��~uc���Ǥ�t��6�=��� �>!h���D�ݎ�}�gM�T��m�����ARHh�����i�4/���Ç�<R����� ���H��P�t)Z��u�/.��IH�4��_����_�wSF�k)?��~_7����y���S�CF���Ă�w�zg��8z٢r����x���7�` �[HeaJ>A�ȗŶ��l����3�2�~�#~,��,��g�|X��a�w����b�yH���GW�Ʒv��.�dO��_��@u�mY���a���v���� �R��Sު{2~��ߺG�TE�V�Bs
Behavioral task
behavioral1
Sample
x64dbg.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
x64dbg.exe
Resource
win10v2004-20240802-en
General
-
Target
x64dbg.exe
-
Size
9.5MB
-
MD5
1beb05a98e438749fd8927c212c1f9f8
-
SHA1
9590909382dbf390032a55af3ec1bb266b04cde2
-
SHA256
4a12d49ec3561026c9d4b86f0315eae878d23d4cc10cd938f45fe3f7337dee54
-
SHA512
b30fb71e8cd772de79950a8b708af9c35c1858c6768caaf8f3bccb5a83f8508f9d5ada9afc235d034d80ec93463af6ca3cbe580712dc89ec7e7daa8da2647674
-
SSDEEP
196608:xeMhiHfeWKUQqBWC4/z0cQQXuuk3yGP0fLejJ9WxX/jYq:x/WJQnbjx+BOe3Wiq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource x64dbg.exe
Files
-
x64dbg.exe.exe windows:6 windows x64 arch:x64
0cd5f219e5885deb510805a722b8bade
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
LeaveCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
shell32
SHGetFolderPathA
d3dx11_43
D3DX11CreateShaderResourceViewFromFileW
imm32
ImmSetCompositionWindow
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
getsockopt
iphlpapi
GetAdaptersInfo
wininet
InternetOpenUrlA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
remove
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 620KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 863KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ