s��Fh�ݱx�B��}-�J�� ���7~���4��� �J�c3���$�ʅ�'�zO� ~�D~ޢ���]��s1��UK3����d_&�����B�F��6J ��e�� @q.*p5x;�Y :���o�l�w���L�Nk� ���t�5C�����S��]�t�� �E�C��i���)��Uf8�V`m���+)q�n��b��Oň�@d��`�TЁ���倌������E� ��굡g���W��bZRmr��]K���dU?���k�.S� ��<Y0�r<�!]Mpкf���W/ݤ�R�@��&;E�rm!�i�E�})e/�����X�#%�:����M��<�f��������Nj�M%W#�:b�z��'����H��&8 ���MA2��<*�v�H������v�3�&�쀌�;��Ѣprڍ� ���P�ȼG�-gPC5=�MMe3/=��^х����'��g��Ⱦ�Xj��g�5���M�-x�/����� �S�6������`C"P�a����z�@6�ky"�nݤ���_7��'����YcF��j>;�P}���c_0�^� �'lHfF&�z�vJ���l�v��s�"� :n��_���Ǿ�/-�ѕ4��84������>[�7V�2�� U��E�`�{5XM�8�V�bk�n#(��Kmw���j��Rtq�����6a������tƪ>'���Z��X�:ʔ���l�P���YKݧ�xdI�}��\'+[�{�~h'n��Q/i\z�� �D^�]t�z<��v�#�T�:����R��,�7��E� �&l��� Jh�"��0$�"����7;��yP����(�����ze�Ļ6O.��� �>%�,C�����o��^,dg�"e��IJT?���O�8We^�V�d����+0oeR����Zď�ifT��^���� �� \�v�#����%�(� $�_+Y݄�qC1���V�+�5�eē�e d��>���� �^���[_ ��Km�����X��`���2����A�}�]D�sq�P�3�U�#��3��)|�Д���������e�ew^R, ,��y��a�"=�kl@ÁU��m�s�����iwx�t��r3Gy����~r�p�e�ͥ�!���<xf[v,�G��-A���ś}�)��;c��U�^D��� ���$� �z4Sם'��n���?F�c�U��T�m�Ϩ�2WF^�S�X��ԱE��q�,��>6W�b�"���5D"�!ϴ��c���j+Bw��w�a;�/���B��e�!v�SK����Y����_7K�Zt�4)%���{�m��ٽ��Q%I9b����aZ��B[b&�Ƴ�k��2j���e�C�;���aG����8�J��Z�UfU�;XG8�d��4"������#���� ��i����ׯ�E s�lS��K�Z�J�C�f��O������x<>G��ƣ^���Tj��1N6����@$��;T����<�kr�g���[E[0ռ���1_4�����R����H�8m��m���]��,��,����*"�Y���r�ʚ�Q`�p�+z�Ȭ������h�\[jJ_�\'���)���C�6XR��5Ư���H�j;Ҵ���66Y��i�9�o��������B �z��y��ל6�c��:�90Z��(�4K�I�R)҂���nڧ�{�)�yN�G�I��'��ņ�'�T�<��a��Ǎ�����T������֘�#� J��f�W|~���w���A��ǐ2z��C�JіUS��h�X5m$��������ujQ�?���@�>���&��ͧ����+�"���˛�Z�>�������q�Aߤ���F���]�eE�W����z�D�#�ȱY}0��s;��.(q=)_۟)˟:��8n ��5�]R�i8Hu�as=���f�9���K=����Q�[L����Ӗ)�;�o�}tX�߿O�ef�H�A�M^5�?�����X�s�N:��E�c1��3�ҁώi�B�Ϩ��6�Z�`�6���k�$ĕo!�2���(�{�>�* ro�t�pϘ���~T�);�sNj���^U����6�#�]�k�z%�2����#.ؿ�B�"Ɑ����n���N�h���QX��>{�蚌(� ��l3�NS�����_��{�Z#SX$�6��ƹ-�Q���8�U�y�ҭPf�s��W}-(h����#�k�I�S&isO?.�qË=yV�Q튼�eno�*P���j߈z�)j�{F �f'��8A5��x^��d��"�{E�o2��¨^����v�)�m:�䵫r����s��}��A��.�T��!�+�t�@�e��#��@��_�^�'�A��&��h5:%�C�6�k$�$����-������vB�f������Š�*8nuR`���� ���` �Jy������L�������S䤐o@��˓���OP g7�㾊����#>�����vaQQ˓MBB��ND�BA�&{�� �^�)��l��wʂ<4;�&�����6�V�~��P��߸km���bd��h����P4� ۣ�^�M���7>�e�����l�wd+�Y���˅?��`�� �h��f��KdD7��{��:�&�A[��-��1�9r�U�ǭ��-V�o.A���� �����e�̂�N�.��$�g��O�����O�+�J�SX�dVȯ��y.����{�9ԍ��S*־�=��r��x�`�PR��������\�ɦN��1�"�����cP��������u��+0]� z�����!�w��m6H�\T=�k��\:��mj��ٮ^zѕL�~��@�#�Z �9iԗCk���0��u�|sU�~D*5�=�dž�U���)�GX\r�f��R��8%�Iݩ{"a7���� ��g�q8��v~��뢗�H#5�>�L��y�FD����#������d$��!�J$�/�hMjF���!� �R4*����F� "�[cSk57�X�d1l��[u��f��~��,y�/���i�Nw0�� Su�NO�Dz�U�( �V5�k��(Ҍ�/���� 6�̕�(�
Behavioral task
behavioral1
Sample
injector.exe
Resource
win10v2004-20240802-en
General
-
Target
injector.exe
-
Size
5.6MB
-
MD5
add56dfbecec26e1eff1f22736ec5f15
-
SHA1
1bbec8cbd6c9efd3bddb5de8a5bae7f7180c1990
-
SHA256
b54451bee62773563502f10ac11df5313883e25ffab0f774c0ec8d3a97153ac3
-
SHA512
05279179d448438d984794768750f1a72611f53c8aec9a9ec7f68f5954a9b6cfdad3c22d7e15fa2120e11d215144f37746d2103625e599a0f9c39e70baaae817
-
SSDEEP
98304:WYsZcCqIlBQLczZnmBoEi6GykKY8JFfa6WvLoUdR7+V0PWFyZTqNmlXtf6GRO:k9Mok1V6LXR20OFyZTqN26Gs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource injector.exe
Files
-
injector.exe.exe windows:6 windows x64 arch:x64
fdb70a00c32ada7d0dd834c797c289b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
ntdll
RtlCaptureContext
urlmon
URLOpenBlockingStreamA
ws2_32
WSAGetLastError
mswsock
AcceptEx
wininet
InternetOpenUrlA
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
signal
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-math-l1-1-0
frexp
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 397KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ