a���Ś^�P��������AD���pQ�%��Mn;3�Կ�1�%�b������Ց���}5n̡�Ќ��%r(@��@��5��N*1^��F_�{��^���fJ��[��S";��H�* ��z��Y@h:t@�R�A��^6D}�2K�ݒ��m�o/r���M��ď�5H�7n���.��*o �Jʇ���D��,�3���p%�Q���"�����;c_pG�w������smHx�� �K�0�2u�G��..A��Ӭ�3�i�O�1�5'wS3j��?��*{�?W����!�C�t0�ݍӲ(դaH���<=[��Q/��;�<���!���5*+~����˴����Y���/�GK͘�/y�e�Sd�:�]U���O0�㏴�}� <Q�����y����V,\����#9�U��l��t��d�%��6LS��5P2��Q��-ܫ7<PU�5�n�?"OZܑ'8��4)�:����G�eO)}l<*B�����m�%�ps����W�e ���9>�\��.��Z=4�u�e[���(-i���: �3�K�8�ìHw��n�"���"r����hĦgւ��n-���ᵉ螑V�i�3���T�0���t��w��V�Foe���Y'%-�o�_�=�6ب=3˗����G���nP,i~Qhi���VL���$k�jr}���U%��.�rWJ7��4Os2�%�i*����i%�fk������Wlʷ��Q�՛i�?��n�\������ؘ/������>���^�aY�r��Ꝯ��+-5�7�'��ɼ L��_��*s+�Z�y���,��tqq�. �mD��ߘ����kd'b����ٕ�^͘g�@z�@�泡��w7؟����t�kI��qh���C�?����38>�����p4��B0�[�����0#���]0�>7�:|}����Tp�k���B&��G�$�~�q��H����%�P6����O$����V�j:�ے^�&.�u�}���gU����_]��^�����v>W�i�p�uV$8op3�t��`��os��c2�����r_��^-2��p�p��p���cm&�1�#��D��r�2 �d6mi��z�P�ly�dȵ�g\8�u�|��8�#��ɦ��$��>����g���U���U9iI����`��6�FwG��s+�d����I�V6q�)�����Δ�{��tɒZ��_�Νh�+B��%w6���<����X5]��ZWǿ��h'��$,|3�8!��K�{gYE����.�q:�b|���O梻��� ���ņ�x�a��9���Q���C��2g ��Фn�bBeܙ�Tsq*�$"��W*<�=z��HϽ��E�|��V �8V���Wdf��Y������<1���W '�a�\��YQXtQ��fA����8�2�;���FEs����ʮx�8��V15�$w��\�z�A�}�����KY�W�#j8�x�gTm���W�j���������&�����fƄ�1NJ��Ԧזf�r��&s���c6g-�c�oz��"Ǡ�p��ϿU���+�я����Jz��,@��E�o%5�l��D�n3 ax�g�s�����.S�'���.<�����]b�cn�:��� (��v�#�kտa�&.hG4�mВ�Y�jpR'�0�K�SU��͕�K5���e��PR��t�S�FP��U�:�WB&1H��^���#����N�vÎ]��1U���9A�k��=�;dbp���ާ@���cM���}rl�ۧ����M��������X 2�ԛ;!�o`�I�.8G��h������v�����?���dŭ �RF4Q7�Q`?�b~�υ��ʏ�.�!�R���%��`�T���y��o��q�u�L�1�on�p ��LDn��F���̶����!�#�enY>9=��A("�|���4�>A��Ł����ܤ���z�=r�� �'z��q�}w��W=��W�xc�Bԁ�v C�]�{j�:���c7,��H�~���\�}n�A�$[<֥ ޖr+E���� ��{���>N��U��H�9t�$k�n�e�/�W >���ae�,�h9�ijVw7H�� ����9���a��g�tc�;�&��cs�����6�|�L�<��ʶ���uP<���&�|���E�%'Ս�@�9�oh����}��˄ړ2CE�RYΧ����r�7��m:N��vУn��kCWXz�2%c�<��UR�M ���������)�%��B_�.���J&���{����!��7�;L�%�ƪ�p��3[ ���jZߟT�UG�G��Y�-sj�Fk�ՇϼE��s���hj�i$��p?��»i2?�����_$�=µv�(������Î6Cqn�I)A����6F02w*c�J����`�Nq�L< �(_G�w�Bb@U��*��ۼF ��O�� .c7�w�ٻ�a�0�LȪ�ZSi5Ŕ�~�˕��^�,�(��O�~�pC��I�9�.'��ߖv4�A/�T�Az4b�>���5x�p�d�D#�>w�F����h ��ܞ�,����p%��w��� $�_No!���`�<��$K뇬K� 0�0���?�&�s�67�A�K8��"�i��c�Ot b��A�#F�6�Oj �ˆ�h8�3�SL��M�w�� �O |n�0�8��.�4��(<����!z�&�f,�ۣ�X��#@w��]��UrX�$̻�)���B�)��m�F�R_q�)^�8�c��h1���W�8�^��ax ��f��>�#Y�x��}��k�FJ�zD���Jb��g ��qd�0��z'@o�����pg�Ut%?��{��D�w�:g�oŘ�e�w�Ee�ͩ5��PPSf��<iGA@����[�j�J��շ�K�wE��jYX=��'5O"�3�VCr��ȥ�m��UD���7��x�^O^m�0� sm_���()d���L��j����Ӗ�@P�ͷ�*��ZVfݘ�Kޓ����ϔum:Y2q�:��&����4�5h���ۘ��^��=�HJ_ Of�H̝[h,�U�� eV9oa��l��-���'!F�v^a��4 ���X:
Behavioral task
behavioral1
Sample
External.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
External.exe
Resource
win10v2004-20240802-en
General
-
Target
External.exe
-
Size
10.4MB
-
MD5
98af631a49bb90917007129f47ce295d
-
SHA1
302eec13f06b7e6a0bc0bec21fe01f6f8ec9e1d5
-
SHA256
c5ebf9cbe3afcfffa7ef39974a558dd449d4d4b1b0468d302f51103ffbd68b1a
-
SHA512
e0acbe39863953bb2963b410dcb6296b91bb4ed34936e353e3c6c4af6252ddcc7c4c70a5b895ea34522280b4850d8550b29eb2f180186979803d2a27398f8c17
-
SSDEEP
196608:slGBpwd2FUfm76ytW+5dTu7fct4GFl18Sc:3oIum76yA+nTQfct4A83
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource External.exe
Files
-
External.exe.exe windows:6 windows x64 arch:x64
Password: ez
e852a4af08d2643b50bf9f8425a5505a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MoveWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
RegDeleteTreeW
shell32
ShellExecuteA
msvcp140
??0_Locinfo@std@@QEAA@PEBD@Z
ntdll
RtlCaptureContext
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.4MB - Virtual size: 10.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ