/]��D�y�n��(Jo��*�ִlj���v�y�g'�5�m�����~[�[٠B�QS�fKm�w������Sv� Sɇ�b�A��D�{���W����B��/��K}Qj�k�T�L����vO�P�z�����)���4�Br�σ>[_t������Ľjq��[������; �?d��E���v����$��u;�;#�]��TS�D�L�:��.����춀66S��=�I);��%�;`t}hN���y���n�����Xjނ�jdj��*d��)'�,\J�X}x���*�#�M���W�@.��J��V��p�v�U�h�T�*�5٘�F��[��kx�\B,�粑�:��5����J�:M� �¶QS\J�s<6�{J��i���1�$Yއ��{�(����e��>՞:X�G�,�_P'a]t��-/w����ҡ����`��3k�2�����)^��B"[F���8��㻔��,���s�5�������e �aU��mɧ����MY��+����!���S�� A���-��Gy�%~�+gwI��#^7�3+iP�Ӓ� �-��*LJ�Y�:;A;���ИJ S�oi\f��>����Ϟ����-}�X��K���c��.� ������_�$<3�B�� k˰,��T��y��e4B�.���\�����'!I�1(�#�@X%�ݏ{�IVv�YwV�iN�5W�h�3G�}�h�Ņ���%S9H�';B��|I�6K�"�;V_ƚ�LO��8W�����+�WL?�F������´�Z�,�s�8$�Rh��'�m�KGEbH��K%���I�G�R��̓�q�㴓�e"��y��+E3��BN'��G>���1��3/Jn֖������Ҍ�u�����uav��H�DZ )�=0��_�+�%��[�H2q�҈�����G�QL�&�9xr?aD�1�M����|�3���f�ĵo[� ��j_�hch�k��t<ajK����� Z��!G'�p�U�~����X6�q�4��idInQ�_#�"rpn�|� _����t<�yci��_��))l� �k��g,|�`�FcV�5�70D�^oht�r�E��������@v�h�6�x�9��{t��3c[6�^(���93��G��F��W}�������$���/K/!ڍ���j�J�կ�����N�;���E)��qBr�C�@&�Z]Mh�lR��Z`����T��oE%տ��HBJlq��t� ,����fN�,yg�O���`x؍�>|W�e�R-���o��Ю��� vp���s�~ �;zj�yH��5��n_;�������,2�mE�t��b��7M"�+jw����6�KP02��;�:�k�,���[e�vm����;�褐���7���;��A'��$��. �� uVǻ2����1��)�PI9� �Q��!q���z�J�W���[j�j�n�kؓ[�����4�c��g�����ۅ�¬<>����+��)_��g��E�����ۉ�5��uE��_N���yWk ���9��}o�w ���d{b}���zᖗI�y��O:��u���9��˼Zv��כ@L��/�}�l�Z}�yo���* ���{���|�֜j���??7x]��N���KSAn#=�[�l]�)�0u�~��6��k0�K�ᅣ��)���~ʀ�NU�*B����S _��=py�j�+j(�v��A�x�B�D�ĸc�c�W����2h/����on������[� ���f0�1��?D9+��>�?�.��К��vH��ׂW伇i�J,C�f9甚���Ӳ�F������A%~\������H��ou�D2Y#�l��b$OXѺ�(#�=�!X�8g+��&TaG���L��u���V��1���0o�����b�n����26��ٍ��A�ڠ{�\P9|�mI��]�Yt/�yp�Z07�HQjle3����̴�;1��B�"G�X��Kt��T�"T$�oc�~�K����V@Ud��Tn�<ZHhR�W�K��B�9^��#p^�4����'z�{6����V"c:���s�lH����cM�þ�@$��ۆ�]ؙ�:�8˄���,��_4ynG���?���[����)��QM��!&ث��\*TR���yh�V�O+e�x��7r���{P�2��At+˺��қ�'B��7���a��mhE���fЖ\�M��肱��O�Ғ8E�����b��������ԓ7���0�m�]�l�:1u7��3j ~����怜B�c&����q� �-S��T����Q��{�&9��># ۰m�nI��n:! d����E4ղjbB�ed����7^�[$?79��GU�Q��V�GV N�T��w�)>�2Y�}���\��;!�@E���$'��b7����V+q� y�D�b�l`~9�m��aV���iLP�$�&aBN5�X�����$,������� �I �F�����?lI�G�3�KY��u]vs��S챭��<W��"�OҴ�I�B�A|���K����� !T���i,"G�+�峎�(!ڐ��%�:6��e H��+��U��rb �8���un���2Q ~���f���;+`���㸕�d����z��@O�Ÿp�z�~C�ˢf�{K���~�xe��Dk��%��iօ���h��G� �^����y�4��GW�W�*��;c%�®����z߅ -L�hn����+q�7�[�d6�:*���h=_��-����o�����g�}�|7`�J%�Z&��� $8'1ÕtԅR�6��t�M<M'��,��.G����L�o��! }O�0H����������&8��o*�s���y�33WYD��h����d����K�I=����~[1�A ��HR��7ԑ�|RI5����- �_�c�L-����@o��GǶ4R�)��=oj�vR�+�m�3M����at$�Q@R�a(Y��2uN�[�@a�^�44�Άv���Z/@7�3�0��ʬ5=���Yp�*��x�F̨^�M|SM��w4`�cc(h%7���`(l��
Behavioral task
behavioral1
Sample
b58ae7597cafbce215c5528a627053d55106017db56d2fd10beae4b9f5bd3c9d.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b58ae7597cafbce215c5528a627053d55106017db56d2fd10beae4b9f5bd3c9d.exe
Resource
win10v2004-20240802-en
General
-
Target
b58ae7597cafbce215c5528a627053d55106017db56d2fd10beae4b9f5bd3c9d
-
Size
11.7MB
-
MD5
946056a76f2d24c37419b7a6c57d8949
-
SHA1
05f8e954ad773f579e5aea742eaea3875a8b5cf4
-
SHA256
b58ae7597cafbce215c5528a627053d55106017db56d2fd10beae4b9f5bd3c9d
-
SHA512
e144b874fb45ea060f7c32e5324a3ebec67050991de92f8b2900e3b4c1d1b45a9a01264fff7483aa257eba71cf0e459f411958c309ea4a6d1cc3c8cfb7299567
-
SSDEEP
196608:gyzTmBgIBXQh52jxa0SHALhZbYISVpsejxqDt9NecSTCFVLRtB3lhqLpG:RzTmBNgh5UL19JYbbeZzecj9XqLpG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b58ae7597cafbce215c5528a627053d55106017db56d2fd10beae4b9f5bd3c9d
Files
-
b58ae7597cafbce215c5528a627053d55106017db56d2fd10beae4b9f5bd3c9d.exe windows:5 windows x86 arch:x86
843a920e7579749b304c4b219564f4d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
??0QVariant@@QAE@ABVQByteArray@@@Z
libeay32
ord342
qt5widgets
?inputMethodQuery@QWidget@@UBE?AVQVariant@@W4InputMethodQuery@Qt@@@Z
qt5gui
?qt_metacall@QMovie@@UAEHW4Call@QMetaObject@@HPAPAX@Z
qt5sql
??0QSqlDatabase@@QAE@XZ
kernel32
GetModuleHandleW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsWindowVisible
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegOpenKeyExW
hidapi
hid_enumerate
msvcr120
_initterm
msvcp120
?_Syserror_map@std@@YAPBDH@Z
shell32
CommandLineToArgvW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.6MB - Virtual size: 11.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ