�:$OZ����<��lj?���a�i�b�u�tfBԯ��ٶh����ͬb�o`=//�@3�7�C�o���z���.��w�lC�_-��ڮ���r�6?��v���=��*��#v)� ���Q��B1/�S��!{��r� �`�rޕ�_'7Q��������x����`�����J�WCٜ�h3�̱��,K��)v�VQ��o���w���nyo\)X\`"Em��A��� /�/�������s?jnwm�7�8�LY}�} q[�����&#�U����1&�@ִ����� ����n���c�/t-�{���J��2[�z[ᒲs��w�lW��z���0�hY��D~͝��=��^�4w� ��ؾz;�9ܝ`6j��5�� �<��v����࣫X ��� ��V�-{➇L@;��y��#���K{h��!QOe�m G�RT� ��Jp}��Ja�xמ����"���Kh`��+ oSR?C�O�]^��9������ސ�����K���o��[�~��U5�Y<'�/��˄i/�2�� �n�-�^j�4ځ����X˺�s��B(�ѹӫ$��L��ʂH�\ľ�� ��-K��v&i�;'���i{Ih?�I�t���~vS/1)��ޥ����K T�������H�*乛�!�=T�7�֞�����H�rƎ�m��I2� Sq�;T۩�W���=O�P_�~R[�8�E�гFr(����~�'&��%�L+�څ9X�ɷ�tw���Kt�����[�Lp��y=�� �I�6���;���v��^�\+x��n��V���E�Y? 9�:���B� ���%6�B��d������q�|���@�����~�S��7éZEU.᷑���i!��(�o�VZ�5y�;ݔ)�1q��r���r��AR��#�H�k.�۶��_X���{Ĥ���A���h��58��Y�~+qKL�e4�z���aEg`�愗�.{���5��f�뤿GiF�N��wHR�I�]9��M�`::!P��h=�� ����yr�r��?[�=�l��w&����03��o�#o�鼟Zc�N�?��GSW&7E����b�����z�� �|�~_�����)���X#���Zې��S�nC<~1WQn�Jl�з��m��_���2#^t��S%�����uxQ:2��]ȻMֺms���R� �����&��-�N�.A=��GP�W�����MI+8I���/��-�TϦ i2�HU��z������J������T����)U�]� ������s`ͥ�sM�'��߸�h�`���a�$�� �4(��r/ҵ� �A�Ⱥ�ß2��/�%�=����>M ����ۣ�,[��ui��� L�B�+WMпA�x��B6/�}(&?�p��I��!V�r�*�2��8�'yrY;!.�?z��tv;����%��C���_nb�V�٫�i���!?��5U�+w��]Ԯ��#� �($���Q��1�4^9�c��:C�~�x�C�0���D�D�P��r]~|E�u�$M����I����(%�n4<i����T���Ս������A�-��m�kӔH��<�H�TdQ��%ȶ��"&�(@uև�����v����y-���K�c�gRi���g)��1�a����j즤n3y�y�v�+���M�J����"����]q� BDuzo�����0�TR�fl��*t��b�c�}�d� �ؠƬ����!��1��7�&����������놫�y��dQ+W��O�V�@����l[�M�� F���i}Il�Wp!��i�t���;-�,��P_������u�>WS����D���K�����Jgl����x'p��_2�2�C����F�-6ɶ#x6�K崙�̐ �5�i��N&�$����Y��;X�X�E� K},~䞋��q���YTtv�8������։�פ� ��m.c�&9Rɺ�]»�R<k&.D�Ăt�'�H�ߵo�"�G+p;���`4��]�XO����nZ~�bFʗ��K�>������:�6�ø��~loybA�U����6Ŗ��;��8�KW�'��k螏d�Ԏx�s�ὣ�Mg�y6��f��N�}%yM���m;U*}+Ui����I1W���eB����S� \I�[q����*���ҫ%�&���XLt�۳k��7�?;̥ٖV�02$iz;�� �M�X9W �:(�Pls�c�]h��1�>e�B���dJu���_ ��R��xl(w���E˰�:��S&*�ٷ_�� �z�����`�M@�G� J9^-}���T���!CӼ�cB&6\������"=��ie�ls���(l�M�N�HʔuȜ��L@���H��z�&M~l�*�n�d<��Ŕ�3�#��ݭ��_˛��O�~3��Y��+����e��n�Omk����f@3�p�����kG�Ł�� L_i���ϡB���dU˼b*gv/���&N����KӍE�M�ε���o��W�����v����$!�d�W���X��"�����w��,�{�JSn���� ���۪3-n��n ��EC��O����B�ϧdWe�������t�͙Mej?�h�̛��b�̇�i�~���W�(S����K�����$ID<*n���� =k -�=���IC�k�<sJ�7�W@q�\��_^5�g�A���s;viЀ�c2*���wt�g:q�d�䈀_ܔ,�%��K��o������rhB�<28��Q��<��R�*��R(���(89Y.%Gs R[B_�^[����`��c���B8�|J�,̜�!C�=@��xI�)�\��0-�����ǔ���Hw^�:�Bn���F�7�o�}��* ��ٯ;�4��B��&,��W�au��z��v� ���9g�TĚs�d�[��N�3W�xj����fֈ���۽� �>�)�=���������&�Wttn���|����ʓ������T|m*�G4�88���ԯ�0���g�JN[(А+�P&_ܰ���(���oUM�S���Q` "�W��<b̀������&�
General
-
Target
MECHANISM BYPASS V1.exe
-
Size
5.9MB
-
MD5
43d2ecd3be0050c90645d36d56db6b5c
-
SHA1
9b645eb3370a1b0d4d8e1943ac7fa188c2c31a8f
-
SHA256
7ff7466dff81d798f0180065a13b54ecdde6724d6f38377e0c076cc933208e9e
-
SHA512
657ed9ba33b16eda401e546d3c6e696f23d73deed3d29ca1f4e512c9870dc24294dd98752e57e62500cf1227a0ea2e3e12204cfe46df03d2a1fe8c52d213e5e2
-
SSDEEP
98304:4iqGguc/GY81NoGDgzCsMtFFynlALdR+BZFPYvvOrIJAmSvfX:4bGhcOPrEGFyn6LdEhPMOrIOjfX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MECHANISM BYPASS V1.exe
Files
-
MECHANISM BYPASS V1.exe.exe windows:6 windows x64 arch:x64
2117cbb796677de0fb9783041a6db407
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
AcquireSRWLockExclusive
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlCaptureContext
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord30
crypt32
CryptStringToBinaryA
ws2_32
gethostname
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_access
advapi32
CryptEncrypt
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 704KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 310KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ