� ��ێr��#�l���:����G�g[-�Bi `*�' �* �{`�)�W1��G;<4aB�S z�i�5�ܷ�y����3�I� ���$.B�-WN�����&U�|͠��9FG�`��.� �D8��j&x� �X-��!ެ�:;��E�a�X|i�ω{�C�+6+�o�u� �4y+zg��v�Ga)?��Q����z��>�~���7z ��������@ޓ�b�ݖ��S������f*'�3�cߙ�y[�~I(9��綩�� ��|�Z���̿����6`A��,�����~���4�?.e��]�@���(����k&E���Y���$Mň�q��������r�M�I �TN_�����g]�!�$������A�O�L0;KEtr�A���P��[l4��c���J���[����,4�<�]����P�~X��������)��� ��pQ��������;�$Nd_�����,W���!���ϝ~�v�m�?i�XV�y��of9�mh���8�f��ɮ0��u$�I�1��m��.l����β�ų������?��^��rq�@g���b,��<2�'�y'����γ�āI������,?RK��qG6*iԷ@��tXɈ��d�+�;��V7g�`� 9T���D�[�"jH���Q�K���;�,��)BƧ��⨙y�O�,�t�g�c�x��ш�'1*{�S3FO���\zW*��\�� ���}�Trϰ�<эJ\Q$�dUR4��1Y���zo5O��)j����R|=�"���6+�J?�Tv�d�mu}3��X����a������ΖY�������<�U��w;psAao��Ğ0�:�8� I[��)�@� ��_���g����!��[<u v�xki�m����Uk}!Q��M�-� ~F���ݥ��2_������*ʴ �Y��e4P�/�^�n�ݨ�4���!����8���l��J��v��T@RP�T<��A�_J��N��HS���O��!�l�@ή��^���>G����k��Q2����3AXSp��Pe�p����֪~cmc�6Fg��4jH}�|�J5xA�����H�� ��o����(b$��K�����%��̈��)��o��Ƌ�1?�p��^�m-!VAn.�:���{)�V2�:�J�i\P��6�.����Qx �*�f��y�:o�</ϡ�E�Aˢ�����}�b9C�{��N�a'{���^ph�=݃Np�^8d�(��Fq��蒐�M�v;�:ۊ���i~v]�S�QN#�^AE���[���M��j�s�� �&��[s�K�3Q��5���!�S��C�=_��K�@M�ξV}�� ����14���'y358���c�:����/d��=[����4�˟ᴸ)Om2�K�=�yAD�z�DŽ�7!I�e�~G_��ղ�I�W�z�I���wT�F�3+��q�pq�bx��@��Q&p�U� G���-�^F�Y5:,�e,�gG^�5Zj$7����u9�ܻ�3�J��,��3Ox:k��t��G3�?��ݩ�DP`>�Q۵i�Q��u��4�&��ڛ�;�0�0��5D���!��zɍ�C��xBѦ@Q`�]��X)�Z*qU���5uB�M~a��+�=��US������v��~��%�J�\�`�i#�G^���B���&�wƓ2�b�n�;'��3^=�L5���e ���h�8�.Uq�?���>�t�L��%���[��]��O"���v"�'�����('�ɱz1ض>� Ź=o����a[��,���ag{t�onu�ZV@2��Uަ���������S�!K�N{x���6&>�!��3���6�Յ0��r���k��`�Q� �l�A����;TL�pdD}a}��|��'j���,��ں�q� MJ��V�_l9�-�B^u��}���T�_��<Đ"���rq����H6՝g� �`�� �/Y ��w%�4c�ݯ2Ϡ��K���1,<vO�gS7 �����nD8;�F~��(շ�_��~��D/&���缒Dˋe�@�k'8�r�����5�&��FB�+�9z��֓v�|t�To�<��:ᆚ���p��m��D�gŃ$Qr��J�i�wpZb��.�9HT;��K��.�n<좯>p���V�;�0X�89V0��j� %��T�45�+���kש�A����]���cʎb%��䞔�&���� �nP�c���Z���#�[EY�ďǗ���@�1hV�F�Q2i����X��{u�Е�n��7�6����Uk�B�̎lYq������ktm�T�~�1���Y�^���|�5 F�1���.ڋ鉊k� |���̔~�g�*F ٻ�� �_���CP���L� wn�սs�C�0cͭ���`"��s��\���9�аd��og�ʍ|ٍn{�������3���c�� v�e�sЍM����J�j;cGG�/��;G��u��gN��&�<̵ͣ��(3��8%����23���b��Zt��E���F���d�����+]C�sG~��I�:V�����1ؔ��oGSFj�em�C��ŧ�x����o.��"9�E�}�_G0��?�G����b�O=Կ7W���_KL�/�Z�hR����-r��?W���=E���&�b�i\Ο��N���əl;�� e#���hUl���Y�7S�|�����׳;\iW�]�w�!\��D����C)��?����J �2)�e^{��DY���ԸɯN��Ee5u���vG�mCrI��F��%�Z���N�\�,#<ޟM�K���5%��2�4��? �S�kh��tS�̟�6a����a��F�I��r���:H�\��p��KW�c5��]��zK�C�x�$5O�X,Ά\��_���Sx����^�6�چ��2�1fIpYR��b��4λQ�Ψ�#�'��g�/�u��PthSU���yA dz�x X��e����+��)-QP�;��vRT��}g3�n��VW�*>"�g��Y����J^�����'�Nϡ���*�"����R�H_l�1y��'�R�7(Cƴ����
General
-
Target
injector.exe
-
Size
5.6MB
-
MD5
ec6040028ed41d3ad5bef3095e7efa56
-
SHA1
439cd48bb1e83bbb38946638124cf7941dcf0835
-
SHA256
e30eed72bb6b3a7bb8627a45bb5d140cb25b6c77d33203e4162bfc2fcab3bd34
-
SHA512
794d53555707bf013ce192e040ffbe341bde2ccdda25959bedfe2531a48d4bd37731388181e8cd2ef2c79d235ea2f2929e920444b7860fe5517ea6e2cb592e8c
-
SSDEEP
98304:YYRWPYFqkRVzORD7nmSovJfEuCWoVVb09r5JXZbC/kkCGOCfDYH+/SmFRLlVFDWU:3QYF/O9mSoGVWVF59tVk/OwEH+tPW3k
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource injector.exe
Files
-
injector.exe.exe windows:6 windows x64 arch:x64
a89bdbb5ed415ad3d3ec6aed111c65bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
ntdll
RtlLookupFunctionEntry
urlmon
URLOpenBlockingStreamA
ws2_32
htons
mswsock
GetAcceptExSockaddrs
wininet
InternetOpenA
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
iscntrl
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
round
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 389KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ