�ݭp��e��#�z{酔7� �B��(D{w�'���5���m������]*G^�ds�q��mXQ�Q�N���5$o7JX�ҕ�۴h˲����A���.+PS�F�%ٹBXp�{ķ� ]GH�F��i �~���:c��3�CSIL�2P͊/y�A�B�� �[�I �ud6������w1v)I����`D��З� �&�\��d� ��_-E�[:�Q���ft����[�o�&�%�&,N^����Kd����5?�zaDAV��9sO֢�_`G'����@~���W���7�����p�ψ��:����,כ3Rl�{�5�[��K��@�h���O�%F�44����X��S?L�A?�X� �FZ�U9��Y���V���ؗFo�®�/mi�5;���n�Gt=�U�&�{�F]�^�v��0ŢY_��q�4j�} �cT�w�����u�C��O��P�� ��`uLC�T\}C����ƛ�L�+D��X�k4�ԓ�.M9�渼,{�W� )����� Z~���B� ���U���C�X\�\��P���'ťV�T4D�N���z���4�γ%0��w��ܢ��"ܪɤ.���`Kb�1�z�G1�q�nj䑺u&/���{����˄b2ߝ� �)��1s��9~B�eX-�"���`w6K��V!�La`��7�����*�s8DT� �X�lj��@Q��"��TNSe��?��h$�)x�q~ #�C P6��E�v-�*�P(�8�G�o����Ɂg;x}0���o�~��O|���*�hs��W�������/[�5�%�k��@��6��֣�_Vi�+��<Rf�Sk�h�|̎>�~�L#W>X�"�c�$&��8U���5�y�3I%�hÁ\�e�+��b�y�7�=�c/JpEw�uݪ VGf���*JX�� �}�����9Z������DX�����#3A��~D*m�9з�� h�B��B�4����,X:hs�Ꮢa� ��>N\D3���õI�=���0]�;�w|�&�Mը����;KYmQy-���ej �Fq G����f H�~l��6G�f��<�+HE��>u˫� M���ճB連"&9��Ò��������0��&8qJ3a�~m,m�t*���!�eLG��&(3�xU]ߡEc�Hr�p��*x��0Q��Fxih�%7����h�QhNu*1}=h��2~w����V �&Z�� � ����z\�̪6xJ�*�H��D7���0��&���UE�;����F��fNL�Ц�,�TH�]��*bc����DU��yЂ"�yX��O"���4�'��:��2���"~D�G!�1����y�����D%�f��d���]N 0�!��|���p^��SK5��*�E��j����X�$�;�U�����L+U18���/R Z�%�v��E�P�m��i�}�YKV����ƿE���0�)�SA�S gx�ųiu�\1�:��I�Y'��q`(���Ⱥc�&&�m˻�}���k�vd���9�w���̰�u����je�[^�Z1,���i+��� ���J���X����P��zlD�?�_����f������{���$#����MF�"�5�'���hZ��iFv((?���վ3��0") �� _�&��]�(�*�DW������b�S�M�[�>@>�~��PI-u� �+�hCi{�w]������d�����R��g荊\6~.d��w����Bh� �����ڈ���xIB��c�鉈�� �Ɩ�B�᮶&�����_��\p��X��@i���ۀP}���S1�;~`ݲ\|�)����w��k�~6nAK$�w<���>�Z��iY��#{G�Ŷ��7&�$��{Ϸ����xR��,e���s��L�^$�0���^Hv*������r�:��7���733��;b�[���;��ŵg�*A�Kg�Nl��EM>��>o�ҊP�X�EG�Z-���{g~$N#���溢v�����r�>LM/��ᛍĄ?�n�7/w�S�H63:7�}Ҫ�x�k�"(z!6t&��]N���73�ù�/�cŔ3����ϤYJ&4BUw�UU�4�E��e)X�{�g˜��<�O_����2��+�����{_J���TA�Kҷ^�'�db� 﨧�����p5{��ԁ�;�|�X�Q���F� ̊r� -�ezyn}a8O $Q�z�,8Q�[KL���#@�f\��@��E�'$0F㑴�K.Ӓ�BfQ\���O�b��$&K�:7�n���m_(���vEyt��C�}o�������Ј�@���3ݛr�]�k�h������䄵��5�q����˛t��9o��`%r��-��Q��+S����JM}�B<x��V�lb+�/��m�k�,� o� ��c�gdR 10m�\,���,��@w)E�gdjnt[q�V�J���!�sH�����"*v�S��:���'�}!WO��n�3|qP��� �(��_�]T��$q�Uj���{l���r�=�t��J�ü�]Ph�6���)y���۩�} R��7���������Q���f~�!��l��,�=N0�ʓ�F��Ь� �H��[OJ-�٪Y- w�!���<� ,��ȈD���Q�{!��2$��}���S���Y�3���U3"*�s�����O_��_�F!��>�6H9!\�������KY?�|�uZwM�,ĥ�c��D�ʱ8����+9�R�Mh<�ƾ�1%�-j#���$%�v8�#;o_�3<ۍC d�B� �qy��� zR�Q�St]�Ė�@��/@�ިL�%�/+�g�8��e���i8Ve0M��k��p;�����0U�h���8�mlUBC��0���E]7�=0�p"��� =r N��x�p[-o�QX���s�X*��#�)�˙lIԓ��\O�W�ui]d�9�f�I����F�#��+�{L2+�3s�����U�Kf�������ї72ߴ54���A����<&����|j���o]��(:i;:���H�Ή J ���2!��I��!�� ��EE9�������f����"̚3��&�\s
Behavioral task
behavioral1
Sample
main.exe
Resource
win11-20240802-en
General
-
Target
main.exe
-
Size
25.7MB
-
MD5
45cd6d75a34408dd4c1defa8b2cd0bbd
-
SHA1
28a7de9805b5fbc2589c4cd46aa012e1242f097a
-
SHA256
36d626ba3a0749e2a25ee44f34bc0e0181b266c1cb3584aaabba9fb2543a675a
-
SHA512
65b2071124718df7687387825a71272e71b8bdd3132633ac1e73c71f84956facf16f1065a67177e89bb5199cdf9cf20417dfc8ae288c8c78ceeaf67eeb874fe5
-
SSDEEP
393216:3lljK4LDeY/+Vr10ntzIpzoaPXxJEhdam1fThvVOZWc+RU+HygcGxf:VlO4feY/2lqEm1LqWDvHnd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource main.exe
Files
-
main.exe.exe windows:6 windows x64 arch:x64
0a1244f1a4638d06c519228963178a8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
SetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 23.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 25.7MB - Virtual size: 25.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ