恹y�[��P iz����wu6q���������K���`�� $���_�"Dќ,��,���VkA?W���S�k������z��( U��3.���y�G�_���W�h�er�$A�4^��̘� ���A�2��������q��D"��DRbe���hM�[/���U�U��m�P�dN��W���rx*�` �0D�����z�����I0�7w�º��K�i��A���ao�o'�-|x���#\��L���Qޞ���E|��.��-���h"��XI�Jh�?�\e�3��+渉�j1� ̚��E'��ѕ��C|��F�+�|ݦl���D6���o���`+�x�'Uvn�0/����2���}A�Ϻl��,�>�>�P���C�d=�IyM��ys��A��ē��rg�Z]v��en���P�ft���%t�Z�y�t�g��Jlx�ؿ*_,f�,�h?��e_mq*�``^O�Z���3����?��@X�}wiWhs#x�%�sފ����%�EU��K�J��4�6X��m��Ms8�������YG�:�v��ij��g��cB�T(����M��;GsY?��W݉�X�4MtN�A�j�7o+�u�3p�fǴ9 |�3�ν9�?�`���A�`�c�+-�������Uͱ7щ{�;�@~�W����Zm�QGSI��qn2�eR�~lN�1�芪������t�.�� ��7k�àԷ���LE��gȱ��2����b�2p"���b)f(-b�Z��Î!�%����h�DڥF�A��i�u $��i�⺙�&}iR=/��Fu����H�������-�v9k;�� �l�ވ=/s�87���� pTB!w._z���$��짌aY��Z9.ow�_��S��'ԓG��}[Q�w�G�l��;CF�_j��i.u w��S���*UO� *"�R4� � �A&��+d���lRg�U�&,�"Jo�e�8�n�����j�Y!5�0<�J���D]#�[��`m��U�|�^4�2�Z�z��:B�A�)�C�I��6:?JdБ���8��F��LSY�-�T'�b������@TN>�D3i(œ���<�ٌ�E�5٧�.u�ƣ��g��e7e��ô�.#�+����ă�h�}�AA��c��N�~˿C?4b!�-�i)������7Y9 ��� �9����S�����<��:J�H�(:=|NFF��~�^�<wCDfQ��J%�S�D���-j�����t��Ǯv�������II �NE���7���^e֟�������gZ�s�h$�q���9ԓsB�B�^66>� ��� Ҽ���Փ����q�����㽗�;s[��2�2q�⃛���#��b?\��@�nCAY=�\�b7��[���-��I�Ct8�<i��H��U���:�\���ߺ���� �/��2����N�^ʖ���#��#'���;x$sL ����`zO8��]ֳ6:=4��t��%���Y��+N~B��$^> g�H박�VF�~ĉy<�Aڨ���qW�cګlG��=g���h��Mx�w�< �� ��m��I�.���妟���s,��/�r��a����PX%,;)<��8��U<�DT����ٶ���;�8�X�kY8JH,%U1a��[�3��̘]a��f̀k�wW�?��:3Y�&��.$�w9����p�K���vVIKB�זcRu�t��v��d���I��f�N'�X������%*A�0��zmb����l3J�����,jU�^Ԁ2��uV9��I�FL0'���6YP[��y�Ē�Lʆٗ%��D�1���|=�X�,韇����#� k�4 �d�����d�p��ʘRz�Q�&��P�B�e�8%2� n��H㈗���0�l��sa���UP�Rg:�,�ػG^�)t�\�+"��&�U@:���*��W\�'A%5�9m�I���6�:0������>�5�D��}���A�I��\�t*�x�I�\˝>�5sxD6ggzU^:5��W+uǖ�&i�<�����?46x�`�xqp���O S��d �� XffG:6���W4M�Я\�;��w%hQ��J��`�����1�'���!C�̪H��v������*�:-��31��Ӥ_s�]qΠ ycR�ό~����$$��_! b����0�p�#d\� T���|�|�n�����Sw���@,��\�/�`�����'MP�pK�����"E�{�]@F٣C[aY�XD�FjrR�њ`th��:ԕl�!�����=�'�d�@^X��Ø���͔�6e���eF�z8S;W�H_B�)�҈�ɟ�$���EQwy��_ĸ¹���M���P>�]<o���V�/�r������Ɉ��KE:�972�1iɏ��Ƭ���f���� I�U[�`�L�t�[+��!�� 3뭍�4T�u��(R_�~m��\��QB����R� V�0\q����'DX�%����Y��U2 ��9Y����=�°��q��}2���q���K�*�}� 9IJ����v����������,�ť�#�H�O�,;�+�� �g]a�5���϶�a$����G[�mm<�����1!u��GW`n��0.CA�+��������F�b��W��t�* K�������^�_U�l�Rz��ƾ�th�b��%�w��v+Z��T���Z�9��D�ݽc�;��F�k�;�[C��#�r���HS��.f���J�dׇn� �̡��k'A96/_q7�>i1�?��K��C�����t*�u�3����~�x�O�Xl���Ao������3D��zg�ˀ\6#(���[�<�d��<�`��{aM1Z�_���[:ˆU@���������_���xX����f%�N�m�T��g2)=��m�����Ǯ������N�ni�O��V]���PP�|%E�%���S�i�x�@վ)���l!�&�C�/<#y�͏1�(8�ts� :q�m{S|�A�2�����S�gѺ+0asZ�p���ġ���G�L�˲Qd��M�}�R�$����"�����/|s���:�����I�~�N'V�jyn��:I���ȓ�^
Behavioral task
behavioral1
Sample
5cda1ac64bb1f5a1dbeb29d5e4b167391d4d28d17a4419356d0b910ea4b02e96.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5cda1ac64bb1f5a1dbeb29d5e4b167391d4d28d17a4419356d0b910ea4b02e96.exe
Resource
win10v2004-20240802-en
General
-
Target
5cda1ac64bb1f5a1dbeb29d5e4b167391d4d28d17a4419356d0b910ea4b02e96
-
Size
7.5MB
-
MD5
7eea16c88770db37adf7eac7c330705b
-
SHA1
0324e06c0cc0bbec2ce6db7c118b6a7140e4480c
-
SHA256
5cda1ac64bb1f5a1dbeb29d5e4b167391d4d28d17a4419356d0b910ea4b02e96
-
SHA512
5d7a81d8923f12a6967f94fc59bfb66a3ad97ab5c7af1f834d636b8cfd7d6646eee07f73b7f88736a29163c3f503893676f7a06dec695616480b7e898214ef1c
-
SSDEEP
196608:AC0QqhfUrOesFAzsk1B898tbZaYJedObJWO4xKCdxou:A1MIOsk1B8uYdOUO4Fdxou
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5cda1ac64bb1f5a1dbeb29d5e4b167391d4d28d17a4419356d0b910ea4b02e96
Files
-
5cda1ac64bb1f5a1dbeb29d5e4b167391d4d28d17a4419356d0b910ea4b02e96.exe windows:6 windows x64 arch:x64
6432ece150ec264a2076b60e4fe10697
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
EnterCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
ole32
CoUninitialize
oleaut32
VariantClear
msvcp140
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sin
normaliz
IdnToUnicode
ws2_32
ntohs
wldap32
ord200
crypt32
CertFindCertificateInStore
advapi32
CryptGetHashParam
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 960KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ