I@0�.ͨĘKn���qgH_1mj4�)��o��19��:$�H�X*X�N�ނ�s)����PW�x����ց�ԯ���s3�|�Q���M/Ϗ�L��u��fZ�i�=�"��j���0p�a@�c�*�OgU�ч��}�v�#'�M�yú��S@w�zvжʇ�WE�B}w��Q����9�(����e�H �[ÓL(6���2��N�Ŏ4P��]� �(\^58�%�E�*���X�a�q�淸��;���M#N��� P�$�72�����,y=����D�M�\&}klL �pu������P�\�B�V*�G��I�k\t�ܟ�0�d�jAJt�E���1�V�Wb��j�s � Ųn&��Iб��0�Y���49Y���ˮ�Q���v%�J��TT�����m��B>5������k ��ڂb�9cz�67�y٠3������p>Ѕ64LI^��V���Qc L54�D��J� ��l��d0�}d����c�Q�à9e��V>�1&�#Q�)�͵j�U@iv0AjĶ ���P).�B��L���5��*\��`+i�Ѥ��o8���/j6OkM�?��&2k`-h��[o\��@�I^e��TMjp3��d�m۶����'z���Hp��JQLΕu�Q��N>�a�aV�j��#�t�&� ]���G]��m���j{�����O��2�ф�ہ:�˩HIb.�KY �}h(�(@\e�<Щkߴ�-<M��!�������s80��~�P�t�}O4��6���RF�<KLx���y��3���-��$��'т+>����n�Zg������4�LO�u�P 3:�x�0�Uy_�Ί���q����=����0�)2�de�\���EE�r���h�I~w�n�:�D.��^�����Ax˺<��3$:-�#v����]F�|}a���L���{7y��$����<�k�Q� �/�n�Sl'' ���O����[�G�]=S�b�>;�i�;�<WQ�� ���uE:GVX`�eT�� -�*�r)\��,�]u��%% ������!CgIF����p���njY��a/ m���D9S�Wt�0�%t����I�"M����>B(�2��Z@:6�z�Nk\9>�_U�e q�s�Ɉ�� y-�S}���ˉ����'�]�dR%o;=��r���uk*�A�w��2��k{��YLb<�J��d7���]K�L<�t�1Z�L�w��= ^����W��=b��M��l[���z�Gp��>��N����E��0���I��0��� B?4)P�B^�m�Dc�P9E�6�C�J[��tw�� ?a%V�����4{ Q�lp����1}�Q�m��3�^�2�2�4�J^(�@O6���J��ZA�<�oS�D�V!��D���l����o���>֟5��l# E>�stG�<*`ʹny�7 l�d�Q{�U��q��v�ؖNUvb���:b �&�=����h�k���C�ė�v�#�d �w&T�ɜq���.��x,��&E�c���t�e$�TㆧuEs�7I��:���W��bn)�.�;G-�9¿��3�%Y�j����3�v��ն+���hEz���~�= �q��� L��<Ǟ'��������{�{�8q5���~�&�O.�k�0b�Z�� KL���\�����.^�-E_�j��X5?�+��X/��wאN��y�#Րk����F�8m��nU��QD���m(�՝�(�z������*$a�|��~l���J�dT���Y����",���/+�G���4B��4�t]5Fi[��L�B�F��EÜ[�+�]X����^���䴕��6���m�$��['>��7�j�k�6�)R�o|m�^(���;���}Zdi�����`>h�i:9-tz>�`_��7S!t*���&�I�����aĦ���a���%�y*�S�Ta�h�-�^7�1D�Zh�?S��)s�|���z_]�)N=1˴�{O�M���̤P�l����@$y=�+L�\B��V2%�p:�+ �Á�!"o��L/__�l���}�9H�}~���0\vG]|�ޅ�埪<����[��c�� �c9h��`WR<F|�^� =/�m%�\�g�%2x��EU�z�[*�n�D�0�ː�9���ص<$ǝ��z�"znS�y��p�D�'jߑ2��4�?2:������"��E9�pw�&��YF����B���v ��N�=�Ǿ��~����?�R�1nz���a�T^���4+�CG8���W��C�m��& $r)W���k�d��<��!ްŨ�4�H?��L��p�~7�|�r��xIO��C���lUa4��CsP�}#^ �>ޒ�������_-<��1�E�4j�|�� ���gjS`U%� |�������[����,L"Q�kҩ*�I�O�bG��A��wo�ft(���#���F��j��긮e�)�����,s�_~LuE3FT��u�Ȳ�E^h��7J�M�K�o��� �+�J����{<<����#=`�v�p�,�U��|c��(/�a�f�϶��@=�kC�����:e[t�9���u�5�t��.�/՝=k�Y8tDA��N���<&g� 줅w�nuޣ�H�j n��P]�rڬ��Z����?��~'T���y�ZR��wF�ݚw7zS0�����!&%���hpm%����/X�T�\AN:���K���"*��S���k �kQ�y�M<-�]��?|.�E��Ї��=NW�!���O��c�'��Y0p�|��.�*��P@�I�l��u�a;�U���bUq�d����ڭHD���r���ۗW~Y�t�(d���9������Rv�i�k���0���L���t:�ף�������w�q�٥+w��ۜ���;��� �K�+�<Fe6E �x��+ߴR�j�W��Q�tqSD=W�ԣ�����J�W����K2t���1-HA�}���nk��c3pv�do+�� 4ʸ'�1|�8��?�{�7�a b���Qso��vl!�F[��Twa�7Ji�Tr^g��c:��r{��~���{�(h#Ȏo��h�7
Behavioral task
behavioral1
Sample
81cc68386ca5d4bebfff9c61ae6d679310925a4b021293e52180898fa2f35b34.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
81cc68386ca5d4bebfff9c61ae6d679310925a4b021293e52180898fa2f35b34.exe
Resource
win11-20240802-en
General
-
Target
81cc68386ca5d4bebfff9c61ae6d679310925a4b021293e52180898fa2f35b34
-
Size
6.2MB
-
MD5
27047eb28d9fce65df74eb314965e864
-
SHA1
83d69213149561a63fcff59451c74c02c823e6cc
-
SHA256
81cc68386ca5d4bebfff9c61ae6d679310925a4b021293e52180898fa2f35b34
-
SHA512
7db1a8db18b17ccbc9358d6859e396405e64a1c6e94a9b1c14aaa78da7727a5ec33226cd7c86a44afa489388e7899ea86380c7ad9edbfec9ad8790bc94cb2d82
-
SSDEEP
196608:qzzoO2MjOwMkzjJjOaqQ4ZDJC2l67Zo/Nd7oLnT:8k3MjOwMEjJj4JZckHULT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81cc68386ca5d4bebfff9c61ae6d679310925a4b021293e52180898fa2f35b34
Files
-
81cc68386ca5d4bebfff9c61ae6d679310925a4b021293e52180898fa2f35b34.exe windows:6 windows x64 arch:x64
fe62e7b8a40c03d561cfb8699c943fa7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
DeleteService
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpSendRequest
crypt32
CertCreateCertificateChainEngine
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord143
ws2_32
sendto
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ