ta5 k�HBZ.�ǰ|$j��g�~����������m>� 4~�E*����.����}u��m�Y�R�Nx�qN�e��ZK.�W�s0 �J�V&�K�s@����T�Ѱ��@WV=�FG��������� �0��#�J+���p�gņ [N��q�N�i-0br�!�B�7aJ����� ��!��3�7�-��*J�[��~��@��X��1a88H�����Ԧ��.�[��/��,X�6�toG0�/����p���������O,���ta�������rI����x#8�n���m�Ff����{��[!w�C�MG(j+���/�+��|8�@ߝ��f��Ő�5�Nf$��[�^+8�=v M�A>��5l~�� ���%\Cq��m��dXޑ�S�6������ ��� ����K�M�]��J%B�a���%A�w��B���Y����а�DB~!��0BSC�\�w�=#f���Z?��e ��\'G�)6�F��w*U@H�.YSp�$�8��AW��J�2Om��<�hM����<����(����nb���������/V���0���G��)� �a��0VM���l��+�nn· �)B!-UbFv�.�za����j��$�4�;�F2x���(�� O�cU�c�徕�mq7B�k+E��.�����5pX}l#X�[IY0}gM#�&.JN&\���{�L���M �ǝ�W!F�2�מ����nե��9�����zɆ��=ܔ��_������Q$w���c�V2�N�i,���:[�3*~��0�$c0[H��ȷӇ]O�|���@x�ZߘR���|A"�r�J�����������/����!�}"� f;�3���Iv���Х�m�+��I��췏�a�u ]�ُжVq��!A�t�9��d�a�y8�F}��ܥ��m�]Ĕ|�,��HO=�+�z��̽��IJC���~T�������Y��Ϋ�z/aͻ�.K����Mއ�7���,��2��A��r�M)�q[�mF�����$�'��j��X�&�V��ޟM�B��[}b��?���r����;7�0����Q����E���{r�iJ�#+yt�py��Qh*�f�N(�y�m��O(`�&6�v�=��c6���+�)�[�#m��ԗ�����kS������עT�'��B�sy�|���f��?�o����gJWzA��[N��߽��)D�rl��#]�w J Ma���ȓC�1K�A�GYD��;��4n�{�Ĺ�(ٺ�ʼ�m~+j�zx�G��ӣi�2���v��n�D�aK��?ק�I +��Ӭ\{I�@[�Z �t���h�`Y!�Fizl�+[J(HGE۸��]�?R������H!�bc�iH�t��pu� Ԕ��|�����ܭQv�\8�O� �qlNA 7U����;��5�O��c��띌�#?�a�=��9�6j���u�K�ݾ#ϫ\���o�6�+윀���}s�WB�N�����A_�����n��k�r��5��0�������na����3��Pq�ǬF@���g:@ ���F��$�UIn�4O�й��%醭S���O�4� ���xR���U��oY,��[Ѳt��|�ΡF�5�<.4AY�9��W�3���H��a"G#��<]!�N#��+4/�]���� �+�hm#���u���%Zh�#E�>if���I�Z?����(�1"e]b@�%�33�5�Z4OX-�<�Żz��M-5���-�|���dʹj�q�62TI�7K�����u�vPI1 S7!�g%�1���%�Ku�RY�|iK ��J�lX�����ҵ�����a!Q>H���WYhᒹ�Oy�@Y/e�\׳�5�#���9�/����4��v|�`S��b����NV��!nP��c�o,ڎu��c��{���7,�w��D��{]�b;U^�����IC�`ӄ��e�|}Qyj��0�`t9an��?�3"E�y�)��ko �4*l� �OݗuҺ�����̏��q��E���<�!�|��5���;A�|��>.�g70� �d�gI�V���D���Ṉ�2x���xTId,� ev*�_h�q�_�$��L�뻃>���!ǎ&�g��[r�H��#Z��z�s��9�/�61XtBN���b�3V��y��G��#.��ӯ��O�-�����~�쵽l�̤ޮs4%�d7�����Dx��d���q)G�+��������Ҟ#إ����Bk5�]����^�Qa�㟮̐"���}k�ν�m�07�,n��Ň[�#$�ܱk�_ؘ<:�Я:��� �!��S��D�=�m��)w��`�ɜP�$b�`��d�ϰ*}� �C�Z��i�`ut�$8��(�^F+��U�z��� D��b���b��C��58�KO���Ƹ֛4^��n��a�B�8$����T�S�X�o�G�����l�`�L.�\bz�iV��* ���O KpH!��$��*��0����[o���oq��9�ͱ��>�ڠJ�"[�g1������ �ᴊ�Di3�NE��8_n�z���6 �&�����a�u���2Ls�emJ��A8���������fBi�δ4�*��O�k�������xeόn���N��N���ۣ�^��u�j���='l���s'�)�D���*(��n��1y���� �����]Ɍ���m}�w5n��(c�>����0�{�C��+4��)�x�@J���[�4�;�k~:�`R�V�U�QK�����\[�e!�JdZ=浸��hkl�}E??����%j.C�Ă��#��H!՝�i����m�G�~������������k+�����0��|���������Y-�1 5�ȳ�2���@��-�[N�N���}�jJ�3���QE)�jkP.oڃ������E�j�^�:6�T]*ă6Eԉv����4a��<\@*M����� ƚ�LX����nJ���c���$=Y%��d��Ԫ ���ɫck�q��ɐ*���_1��P3n��S�)�5R˾�3���՚ދE���tf�*JPeZ,C�
Behavioral task
behavioral1
Sample
bf1eb661749c59c8626519705088395b1240d9a7d71e51ec8ef36e17de8dc669.exe
Resource
win7-20240708-en
General
-
Target
bf1eb661749c59c8626519705088395b1240d9a7d71e51ec8ef36e17de8dc669
-
Size
9.4MB
-
MD5
9c252ef90f7681cf939b0a6ed1a20e6a
-
SHA1
287840be092a2e2e3e37e1ac6fb0a019f2d83951
-
SHA256
bf1eb661749c59c8626519705088395b1240d9a7d71e51ec8ef36e17de8dc669
-
SHA512
5602e28fbb3481dd738cd74993212a6fef2386d10b498fcbe0c45fff94ef3f67c97cf35198a806cf6cea6311f959046d99f31d99f290a4288527e9038d4c3af7
-
SSDEEP
196608:t/OVJmqeDiPSYv3oou5e3p3v+9iBjPjzmc+W0soie7278PoX:t/OVNeuPSY/Ju5e3pZL6cHGiel
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf1eb661749c59c8626519705088395b1240d9a7d71e51ec8ef36e17de8dc669
Files
-
bf1eb661749c59c8626519705088395b1240d9a7d71e51ec8ef36e17de8dc669.exe windows:6 windows x86 arch:x86
a54639309389898bcd04b8e34613ce09
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
kernel32
AcquireSRWLockExclusive
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
ole32
CoUninitialize
advapi32
CryptAcquireContextW
crypt32
CertCloseStore
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 558KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ