��X��o���>'k���E|��U�,ߛ�m���%USճ�B������b�冹��� Ip*6��};8^��f���7��LMd�z�JP�&)�5��B�N�&��$U�v��0����!��>kPY�j08�I�� �J���4k�9/<��rl����(�C�7��$�>�+��t�M+T��f�?c�M�U��ӛ���*%���ҙ$���A8���3Z�jģ��������W����T_8N����߂���nu�i���Zoڕ:���1L>����^��p�).S�]7�{�xH������^������C������ #p;�a `���?�P�D�]��㾞�~Wk��i͂r���3a��9��=�鰱�7�X��>1�奃����~ ��B�Fv� ˨ ��e�0m�tj�K�l�Wߎo�Rh�Ǿ��Ŝ���ŭ9Z�8; J���{F'B��}�$�29A4�T;�P ЇJ��_NvC�a{�J��YuG"�bɦ@�߸l�0<�J�T���{��(%�n�|츫�_�<G��T���ه���4��K�E� �������/D,Q v�I�HlR��I3�� ����do�s>ie]8N1���S�oN��/s�j���J�8�����f3Q���G�'AlaE<��c5��o,���������&���wE`�ı�8� x�����*��_쎥����ܧرK�9�OlϜ*_6W�7?]�ypMr���"�0��G�k���S����:�������FК�`�D�ڰ�^|�?<?���N�� ����Xy�ٽ���$�_�y���Qpޮ2K��1�u:p�Zj���#D ��m pHo�ʾ�9�+��0��s�7��Zn��E)ƪ+K��=�&tt?�6��ɉ3�QL2j�C�OX�n���p4�|x�v���\J��_���%B2q����r������H�����K�O�]q�kZ�Qe`�~}��r���<��yl4�-1҂��A��5_>]����ʗ��꙽��P�H���Pl�q�N3$J+!u���薱�4o2�K�g�A~-���7!��x��.Ƃ/��ܘD.�o���1����Z�A��@)��� q][�����t���ȇ�u�{����w����@^�M nW�\�?�N���C�>�b�L�8s�OXQ��q�������t~�2Ʉ�̾�{5Bͱ��@=��%�/v�G�Y���e�k40q7�{e4��8 ůN��jW*�0~�-/�u,���L�8��;����`�5�Gk�K�*��mP)��Yl���Ŕݦ�q �@Y�4�-4��}pv���2�Pz��$�u�wp���,.�r=��]�n7/��:z%2F��cH"�X7�W�j��V��GP��U��iB~�}e�NsU��j��S� �c��sr���'g��Ű��Ytf }R�BYw��'�!X������;l��a$��ik�05�݃;vI�j z�)D#��E�>N����/��U{a�s93�(��坔.�AAp4�Y�M�L�X�kSd�O��l`(Kq�C���K�n�[vGaC�ƣ?�cJ�v�"�k����?l��VUm6C6�9U��$���.`��z5�����qa���pz��l���h�3I�q�`,a���s���K���«��$�n�"�����Eֹ���8�lm�H��b������@�ݎ<����\�5e��mTv�0qG�g�N�np�d���x�HTSj��[l#�L�G"���F��4���ѹ}$�D�TAF�������"�����|����VR��]<�����k=q�OkG���!�G�k��e:G�C�Z���br��ݚ��g��]p.�3C��L����ݒ�\�:~�*iU{�Y �K�Z0AR��h���8,�BLQϏ&룙y�Yps)�� ������0���,�6��HOH������7ax��Z)T���C�����ud��/�p�X*���M���A0z�F��"|I<B8� S��;��l?4�խ�st:�s�ι����aS4-,�$��z�������X��n ��T����n3��� "S~�]K8}����M�½:�̲g�����]���`D�r}����̴��<\��%@N�� ��9�@��l4�ǐ��[x�+3�ݭ7RF�����Qm�?�0�ezb���5PA�J��kV5giU��-[�ړ�_�9ۨ�����*A#�U���02i �ߏ�@J�ϒ+�4:v����8��eP�pԋQ���_o�X�sW�j�&B��ҧ�u6��5�AS����,���4ZiƘ~+|rlj�������UJ�MDqk��E��A Ak�3�� $ɦ�C��|x�h.(k��B�l^)�;g,������ PR�ggF0C�ե/�{�q]זd���ұ%/�V��,D�oZ��m�py�ҧv�D�x��ܻX�%$Ch<V��ֆ��*���sq�Mެ��Pz�y ����-�M[�?k�%\���.ͯ�*�Q8�mSf����zAV�Aï{џ.����j���B8\W�X�Ќp�������=�:���Zik�_%3<�M�1�*�����U�A{U�q(#�Z�?��'�Uj�~E�������"��.���"�%�:,>X<T|(�)�se@S���i�~M��>����n��AmƸ�X%��u�u��#/�T)���%����u�T�9�N>T�Ƕf�T�FJd{Eֻ�����z��-�5���f� ��j!�E�#�E18��Q�D'���P�>�������ͷc�oZ��i���݊�y����H��cv�N<R�譂�e�N��u�%���&�@�9�:R�Q�S)E�T��lI=+�I��p�Ї�����5�h\.�� Ѧ~����ڲE_-��_>'����+�9�JZ&�7��A0fW� �*�'��4���k����=��1f�? ��[[_��l�.���ajq�a��L;�t�}*]<�����Wӣ-���%9��5tٴg���g�m+$�Nߒ×g���.٦\�����617�)[P>�YQ����L��,�cG;%kOx[�
Behavioral task
behavioral1
Sample
8aa4dbe9daba71905e0900dcc98e47e0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8aa4dbe9daba71905e0900dcc98e47e0N.exe
Resource
win10v2004-20240802-en
General
-
Target
8aa4dbe9daba71905e0900dcc98e47e0N.exe
-
Size
5.9MB
-
MD5
8aa4dbe9daba71905e0900dcc98e47e0
-
SHA1
6311054d971635ef450edc14d2b151aaf34af8b1
-
SHA256
9cc603218dd6b04e7b1534b9db41afb33600de597f32eed50eb37f00c3d98599
-
SHA512
e8a589521b104962488fcc468c3327611d13df785643de60d52c13c90d061d0415342dfdafe85d2202275312c0a2a055861660e3751408557defc26a64c0dc16
-
SSDEEP
98304:liXroMI2Se5wTOf6JNCtH1FU6a4mmnoPZ9xZoy+0H5TOIMiH9lldfsCCvY:Eboly5wTM6JAE6LmmnaxZoy+0HVnMCCw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8aa4dbe9daba71905e0900dcc98e47e0N.exe
Files
-
8aa4dbe9daba71905e0900dcc98e47e0N.exe.exe windows:6 windows x64 arch:x64
09bb07f9b2345af3824ae6681ee3a9c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
ole32
CoInitialize
kernel32
SetFileInformationByHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRoundRectRgn
advapi32
CryptReleaseContext
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
ZwReadVirtualMemory
shlwapi
PathFileExistsA
normaliz
IdnToAscii
wldap32
ord143
crypt32
PFXImportCertStore
ws2_32
WSACleanup
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_stat64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 714KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ