�yX5 �"'|(�CCF���O(W\a}B����u���q�5Bsѯ PI���jʘU'l�<� y�A�_��/(�Z��aQE;�X:{9[ev��.�1���-3��J�k˳1ϹD��UM��Iv����bĎ�5Svί}zq�ю|��ٲǭE�V��5�M�n�(�M��H�����ٔuG/]�����+���g��E�M@��~1��D��E���?�h�;�X�b�^&͐������'���n��`����z��jY'e����~�$_ض'.d��r��m�����K�#��`�&e� �ЃOKW(��h����s�V��*���S�I�k��F=?��6���4�ڎs��v�A-�q2t)4 �;Π�?\Y�z$q�_C���I���K�]�`V"���{�E�P<����2{C���r�d'�� ,V��I봳(��l-�� ��C��W��1d��`�h(�Ź���C�ϼ4Kl��K��i���� �˼�dn41�:��z�|�,��R��o9[�4Rp�<�#�bm�rT0�V��-�a2!����G3�r}���=��:ݽ����Mm*܁6���f�5�3�q�JC�x��=ξ�Lñ�5�H}��AH[-��i��7\�Q��q憿�re71�4�/O� �oZ�%�����8���i+[H3��^��=t+����>����ӄ����\릍F�;-���n���.ʓ���w�Ou �N�e��\k2#p�k�Q����G1�?!�>VK��(r^� U�sA�Dl��Y�vƢT8��(6X�̲�S���es�� v������T} <�X�m�N�"`���</E�v��z وN�o��{Pg�S��q��7��6-� �Ѧ��{��+�l��1�0L5֧iɱ�]?zi.�bx-�Y29��k?�Fگ�|y���Y�3w��~:/��R� [e ӕU|=��d`9�`Z $��WT�C�u�'{�a�c��T��'b��k��(q2ɢhf~8�WG����p0s���-A�&��2(/���z}�P�NIp�q��� �� �cƔV�&%S�֢��C���D��:�V�(}��*�4����*6a�(-��CVVu����V�~#�*��~�z\���W���*N�8�@%y�9t�_)��n�c�}7�y[G��ԛuӷ~�d�c�Dov'R5Ґ����:c*!�G��&�Ec]������晛��Q��h �� �$��ۧ�s���LA1��ޏqa9KV� ���V�\�6���fe�[p���А=��Q���w�4�^Y�Xw��E-����}���h8���8F�8����� ���˨����K4����QD.QF��k���}r��s�G�[�"H/�\��<tY~e��z,9�3e��_�q��O�Tr����jZb������1>/��tv�ԛtVܵ��� ���`�k���am�������@�������TCF��`8qf?�6fh7�SWz{/ç9.wu�X6�¸h�p4������<kG�����P!�� x@+G�A:Y�2U�(D_��C�Ej�����+�J�n��E��N(��>��J�QiH���(f�7b�{r�:�|���ʒفHWq4�5�f�$)�|D��Ӥ�Xq��� ����$������m �D� ҆^�l4��z����t=�5��4�X`|�OW��?z���R�^-Y���`#+�ɾ��sS�����]�iI�^����j�ߓ��ASZ�0)H�}�g,����+�����[.�������ʫ)P0C�G5�UIӤ�<��/�D�kq�(�Д�:,-Wxc�V:��H����؟n������� �Y��W6��9��v�(�����*^��-ݖ� ��5:���6Veg���L*��N:R��hV̸�e����+\؍?�˯��5%z]�b۫3~a؆ >����+��u�u��vQ����~C������nP���>����G*�:fk��#�A�!�ڽUA߰9ktXb���TN8� �+�4�\U�Z��H�䬰��=��;(-\ZyɁ%J|ʈt)+���=UD�鼡��CMi$��0�K���3���)\���㿦c�<ڊ��Qi���lQ�D&Ż<�4�AQ�j�4��|p?90d�^!2~=|�D�Y?������:���V�.�c|GL�mtM��3��@`C)�c�G4�^yW��M��[����@z>�SU���6<���/��.�(?�k �@'h�_[�,)�$���<ypv���5����SU���/˓�t � D�T�|M�#סwc�>9�k {��mnK��+�|e$,=������ H�U�Ӯ� 0;��!�l�xKU�|�KhM�+*�1�l������v�LAQD�2�hq�\����� �R�UX����Ү�ӁH��+�U_h�>C��Fn��ܞ� �k���;��{���ޗ��Ј.9��T�F��ti���\>�n�Qߦ���~��ZȄ����_L�P�+^����7]�/���J3[_�m���Gʱ'}�ǃ�'��Wt�*�m`��)�e���i�#�Ǩ@��8��l �E�E��&LEN��!hR�����w%�G4�T���,� x���Q�v���� 4m��e(�V�?m���J�� B�ʶTv�y{h}�,=*�X�e�gx��Tn}�G���bҩh����/*-��I2�!��!��F�*>�e��=��_�)�q�4>�I�1�URba��Heb�Z.��j�������7�Ui?���F#?�86� �?�j�[H\��1^n��Y����W�M�}ʬ?�Np��n&0��SI?mG�.����|�6��.`Vuf�E�U�bC�R�����xٰ�q<�;��&s¼0�~�߆��X![��6*D$���\�E�;na.����=��<ؖ��� ^lVE#����^\���ג�O��Y]�\��~�(�"b�4��U�NW���/5!F����T��NCN[�Y{���m�����p�� U�1y먑5�@Dݸ��j"b�㌷>n�D5w��?cy�,5������w"�^��|�!Rtf�����@&ƬSi�v?�n�`Ц�HH�TE������ZJ
Behavioral task
behavioral1
Sample
Injector.exe
Resource
win10-20240404-en
General
-
Target
Injector.exe
-
Size
6.0MB
-
MD5
f36ee5932a730027228fd5d283f57785
-
SHA1
3d007845d8384469a7dcacddf0756bfbaa766812
-
SHA256
1f1a077a14b1a86775ddf74413d454f033c8fcadf198fce4d421f096fd7decfb
-
SHA512
6c1fd7e826cae70ee47a3ffdfba8f76555a4194981ecedd02566d9fd508dbfd6ac317cb6737409433246bb2091d216e6267fa548875c1f47e20debdb3f4c6937
-
SSDEEP
196608:2UwyetYraZbrkIeh2UWed0osYbrIu20fiFYrxFj:27tRGI+2UpxbrjhtxF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Injector.exe
Files
-
Injector.exe.exe windows:6 windows x64 arch:x64
f26382e98ff8071d60a74baf55dac22c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
getnameinfo
kernel32
GlobalLock
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowScrollBar
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
SHGetKnownFolderPath
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
ntdll
RtlLookupFunctionEntry
bcrypt
BCryptDestroyHash
vcruntime140
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
cosh
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-filesystem-l1-1-0
_access_s
wldap32
ord211
normaliz
IdnToUnicode
crypt32
CertFindExtension
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ