����4���-�u( ˤ �7���ҙQ�8 �n|{�q��8��;�F���U/V�C��'�?�,��~���A�D�,���_���\c./;��l�������O��/nhl�����Ig���q�d��X3��:1�SC�hl�1l�/U3T��>^9��7 ���.J��&Ն��P!rC���m�hd���em�/\d��r8��Z���R��#8����[,�g�'�8�h�E��W C(����V���W�}dR}a�a>Ov�#��y�(R"�[W����|��X�"�~vE�fjĒ������lv[g�����-�YD�����C�*[�#fا�1�Y�A���7�g�멿w���VV0�FEKY���hcT��K{M��Ƞ�$G���<���6��ӆ�������Uf[�T��e���;p�� bdxߕdי@n2�48g BE ��(�2�1a�}KI��b�j[���W{����i����d5��^��;od��B�C��n�Ep���E���r��h��$d�1����p��ow�P"������E��ɯ%٣��l��(g�U*i�,<]r��~C1��&�氁�������t����@[O��s�j������:(�P�cL���`ESYR,f�%�+����gَU�X��-�׆#'�K����gE����b��9!�8���IP����[�E��gb�x;�_�y5�`���� <���v��L/9��dǎ�@��+��dTg2}�苽�a����w]����{ �uI`����G�}H�Τ�֑�Y�������D9LS��� �>��(%#�I������8��+鋤c�=L�T>��X�sw�x�OŰ�w���Y�[���oVA@�s��,��f�F���>ȸ1����۫�o=`����$�J�ʂ���'z���S�.� 6�徔�_#��E��WhVC�3\T�Z�\�� ��"G ���V5� ��ٖ�&+��putr���U�E�b�0[�q��i��L�{b�l�gL�x���n��h �nd���Bt0���Eq�'"��SJ�� �]����{��~��;N!'mN�Y2 6;ت����+5�濝̝2���9�]�Z��`)rl��^H�Z��;�#|�R_�G'�x�'lR��0��=�%5Γ��@st����ޓz��,ͳ&���=��9������0+��"�5����ܠ�����:��������1�zhZ>��-2�dʔ��r��y��R��:�1w�9h�;�ঊ��a\r3UE1/N���z6{���K`�����S��jƀ�x��?���#�-w�A��˿�#�|3��}�0-4VvI��D�����D� u^��g���F�.H�[�q�k�҄fj{m��7�s5�)�p�鄛����f�kP��m�'���@�ܞ�)���E Ѫ�#] ��d�D�7��ogֺ��}����0���Ǔח�bP�jg���s�o@~�|V��H�O��R��?vF�y-jk�7VR��Wp�l�� m?N����Lt{��-�>���^p�Rv��!����-�^��������lH��-:��~�����s���1B!~vu�L�7����"��c�������l>eJ0���.l�+ѿx�勯�B��9H4��jƵW��*@�I�i/�]�0�z��T��@��T!��.�nơp�Yt�j�,Ԯ��I���ڏ��R��7�6�=N) b�a� =2w�c���+�F��\OwV�F����d�� �>��`�ͼV���&f��=�_�L~��o �C���ָ�� �eU��Q4�8cuN^?n�b�/U�H��S����t��#C�OU�˂ͺ�� �9[��Tw*�W�����hN��:/)�l�������H�����&F �j�,�g�?�1��Q��Ɨ)#=�Cg� ����..�!c8�"��� v��`�F�Z�?�ϊ��JF�B�I�}����9ם1��ar9���$���߳.��t1�piE��I����F����:&��?�[pxT��J4��y�k��V��b��yaó>�e����[(�JR�-��m���p��� ���:LVAϿM:d0D�>�n]���T�W9�m�Gp<����5��T�a����(BOI!�H��lP4v�A�~�`kM��� ��(ǑQ,���}7}A�D���Ցi�m��NiD��r�����"������]w�2(&����0w-��A�@��e��'L��P�/��#���c��N�5W @KB����^��Q��(!X*n�`���ܒ*��;���N�zm�Q���{)�n _2B+4gؿ��>�_�10��3�f�Z�oq�=��S�X����C�~�%2[Gd56ݒ��&�4���c��ԩF+�ԯ1$5�c_V�e��B!��Յ��!�zIm�Kh�ҧ5�tO,��yu�����D�L5��L����U��3��HhaV�24�B����,�X���+"\�-��-5;m����%���G������� ���X�a���?U���RB+b�5��%���diȶ �M/̫�=�?s N��ֶ�]�d�gl'N>���D�Y����s\vq8��G�.�}�#�@���4������ ]P��H�E�:�&��,z@��l�a&�1:�1�Y��)��G$� 8�zQ��%5|�n����e:���FW��1u��R� �>�Jz{�c=�<�JH&�����{n)��w����H�;�m�zT������K�&��~��I�l�e�I�J�Ϳ����q�Y`:؋#��A��Z(�Td���b��銌�d`shq����A��Ўjz��AG��q������c)��@��-����Y�8,�}�KT Y*�[�*��|L�>eC*�͚q�p�!*%'�WR�������D�DQ";4Y�e�:�.�K�Yw;�)Rw{ ��5elM$d�� �H� �?jn�ƂkR�'!Qso����#5�#7*��`���ף4u[l���V����B��T!���6t/�����4����p���"�����t!M���A +4|��F�"{��,����/����ʟ$�u���W�����8vv��{�
Behavioral task
behavioral1
Sample
904d122b8bf322d91a0711a5adbd13e6a100bdec5d735e241409481b40f5a75d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
904d122b8bf322d91a0711a5adbd13e6a100bdec5d735e241409481b40f5a75d.exe
Resource
win11-20240802-en
General
-
Target
904d122b8bf322d91a0711a5adbd13e6a100bdec5d735e241409481b40f5a75d
-
Size
6.2MB
-
MD5
1394628b42db25d5960c3ab8027b4fb4
-
SHA1
6778358165002ca54686d85419f35e9575b4e8d5
-
SHA256
904d122b8bf322d91a0711a5adbd13e6a100bdec5d735e241409481b40f5a75d
-
SHA512
7ce23c0f137f7df96d34c000b3e04effd17595950dcb6733ec569d91aebedbc9197f98be7e597d75a220eb588ba6b1dc1f5f58586b1e2dc52b5ce2c1acfacb11
-
SSDEEP
98304:Oiwk1y8GFolQ9oZqqgOxgDh/KWbWw+FmJIqKfWNXinAsgZXqvGYMbn:O3k0FoVRgtF+FLWNSLl
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 904d122b8bf322d91a0711a5adbd13e6a100bdec5d735e241409481b40f5a75d
Files
-
904d122b8bf322d91a0711a5adbd13e6a100bdec5d735e241409481b40f5a75d.exe windows:6 windows x64 arch:x64
81631472274658d3947e814d8e376086
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
DeleteService
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpSendRequest
crypt32
CertCreateCertificateChainEngine
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord211
ws2_32
ntohs
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-math-l1-1-0
asinf
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ