~Lh�[T��O� Q��ð�D��^]!�=���A���h�S��!�/U J�\c�?��Z���!�+V�"�5�2���oɃ>�~)�C��k�`pTL��?$���j-�x�udj���N&SҀ�,=p �(��$u>�����yO?� ����y���9��$H a�+����Q���g�6�B$�G/ g��+)�&x#�zu���j!�����.��7��X�qh��(!:=�I��PӴc�c�PɿD�?0����<fLIy�q;�1��1�)ٸ��nϥ��f�ڣ�$ɱ��KZ���J���eA�U� ��"���3_�5ԝO��u�\�cC͑�tbX����_+!�Jg�!d=��m�~q[p���nj�{�I;v�XU�]x{�R� Y��a�dvFL���W?&���Pd� ���Wß�mM�a����^��s5�u�0M�Nj�ȼii=Z��Xʐ�ytS@4��_5�L,��m�)#L m`���9�ca��Tqc���'ț�'.���Vd؟1�8FU�a_Vy�~h� ���0}�f�[Gb[��V�l̈́{ y��5����i���*in��wص|�G��]X]����4��e�B��s+13R.E���5"���Aq9�Ë���K��)��Ҝ�]9�� OJl��+-JQy�3���p���.. 4:���+R�?��u������.1;�n'�)cن�pf�DH� ���)#���ֆ���|s��#7�DS����v���5��I���O�����.Г��~�����{_X�"m��RG#J/r^��_i�p��.jbD��n�h���N*�5%ENy���G|6R�!�n���dU�ԗ�d�{�0?�W�C+RS'�A���h�v�u��Twd��M|���̧��Z����ܘ��C �zh���?Y��u��XCM��j���g��(vzK����&��gd�S��#)���<D�!\�����?*T1��ǁ�<k�*ƛS�E��ܸUiF��8o�*�qAE*���������ա5�F&��5S��k��%�:h�d�DZ�����܉���A��{�/$����KI��;a/��s�[�}w�#P^v�������s����3�h,��M��Pɳ�:^1f�6����PgX��_�f���EaM��pd'?U*�)$ʉ��ΑW������U:H��,Os����h��ݰ�[Y���� �#O�y�5��E��& FdD�`eJ���m�Ax�S����^, �H�xU>�Ry���L���P=�o����U��[~�5{���S�i�|[�'l��lA���W�*z3� ��.#`7�l���Q,@����=�B��c���0�FH���"���4�l5�ԭ�{��$�����N"yq^��J��Kвl� �o���_�X��Hč�!ѯ@c2&^��7�Rh}n���.ϼ��I��"����FF�� �Kl�*����%6�-��ѧ����P'⻈N��B��^�ӑC{<3sgJ�&Y�rR!N��li�'eX@<��j�4�9���D�+9���8���TA�m�ʏ��(�3V2p�����o��V�U�ܦ���zp!���1����"�5������ ��]3k�|���^pH-�呺�R�'�v� ���-�P�����iy����������V�$~����m��z�Ap�+���x�����V�Opî��*���@�&�"�Z�/o��A&G��З�Qb���3 Z�#4�Έ ˁK�+n�bJ�N�lRX���r���r쐢{|s��nB+�z���n�_U;o m������UP�TzqC=G��yS������ ��'˒x^H�s+kNd��ா.������c�H��;�I�шp�ޔ��)�hcV"l��3y�h�~ڋ'���m蒮{'�Zs��\:�\��v�e �g���?�+)g���qq�d��{�J���ټN���,��F=r�!d}��=4!��غ�fi?�_�k�tLj��!I��=Φ[)�hf�D3�Z�D5H��Ѿ�����/��8,>��8x/3�ϋ%R���W�� n��P5����N{/�@�]��r�僃^O{#\�`�='T��L]��=����\���o�/9o�J,k��s����}]c�k k���1ϴ!.ރ됨� ��I�����1C�M����G���?M\$�rJ/l��|ݤt��Zz���u���2��yjk`��s����e$�hd�!��▛�����2�x��9C��F���8%-br�`HGFh���Ȇ� j+��<Q������mQ5{�0������[H)4$` (�����x��N�A4�~,&4������Ԥ�1�����l��� �'͟����� IU���`ћ�((�v�ܮ#�#�qA�Sc0gw�t2�)x۬� L��!�M ���ӳDi�&�aU9<x�TBo��_jM�1X6 an���P�$�[�W��!�,Yb4l�%������ á�x�G@G|�ק�%c�:�*�MY|�+�v��n�ߙXQ�M�o���b�p6�s�y_�4�ڀ���N�W�0p�4���c��6��00n+���8{dD����b��ݼ��ܽ�̩�*�$HjRr��W��A�M QjYܝ��z��1M�_�a�[�O ��Ô���&�+8e/�����䷹�j������=(���,��(D������R���H�` ���bg���X��؈�D-��o�IIX�yޚ���8�f�]�?2i���M�è�M|�n�[���`&�>�]U���ȇ���:��w�n�V{��I,yQr*�(�,�i�╷U�_Rd�6�X�{�vor��v'�Uk�^����a.�. k��*�_(T��zh6���@N���z���m:z�$P1rnf��e��=f%�q�L>}���*��$XzX&�n+.�5�D B~T/���pK��˼C�y4>�4i��� S`���$t��Z��J� ��`/_����,y�J}R!y/���h;�U�O<M�p�/]8sqp��Em��T�VVf�A,״��-��G�)O_n{� QIg��Մ8�� ���Ԉ�BҎ@7>�*����yݻ����_pr���s��8��j`��g
Behavioral task
behavioral1
Sample
ow2full.vmp.exe
Resource
win10-20240404-en
General
-
Target
ow2full.vmp.exe
-
Size
7.4MB
-
MD5
d3260c5a9df0b0f4b6aa098ad8fac429
-
SHA1
d51cb00125aaae2c1b5ad057732b91500afcbbf5
-
SHA256
d6fedefb0eda3b635afeab29d85266391d484501ade89656b476b075e6086e57
-
SHA512
d82224eae7cf840361b8afed73f2ef1391cc005882b43018e5f7bfec3018354c27ca8aac04ce7eac7bcb760cc7d4194857049afe89d18bc83df89b46b4bcf3b5
-
SSDEEP
196608:P4ySSG4HXFkOh+Big0fg1cpY5RJW/Z8jjF3kk:P4yZG41k+mccRJEZ8jjF3
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ow2full.vmp.exe
Files
-
ow2full.vmp.exe.exe windows:6 windows x64 arch:x64
ddc182baaafdacf9a4cea21921b36605
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryFullProcessImageNameW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptReleaseContext
shell32
ShellExecuteA
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?_Xbad_function_call@std@@YAXXZ
d3d11
D3D11CreateDeviceAndSwapChain
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertFindExtension
ws2_32
recvfrom
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
scalbnf
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 966KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ