Z�D�=vq�f�)��`��5l�Y���߶�~�D��q������gF�A<��&)����"s���=qa��͢Q�ڬ����I`3 �*��;L.�f�'��*���q�]J��!���.����0��3^�1���9DF�Kx��jz�L��/wT'9��B���<�����Ҟ\L�p�/&����S�U�&`�W\�w}%�4.h���ZP�L�a�g>A0��>��+�70m��4�:v�k Q����z���=gИF7��I�d�ţ�P ɷ�xG2��6.S��������"��q��J�_��W�Wo�v���� h[s��h��,�N2�.];;�Ж!�^1�1��j`�M�@���v�Ү��3:�D�'�g���k���`��['T�t�I"B�� Dac��]:�9���K����V�fl���u�,K�NF�����~�Bq�Y���#���R$^"Z�?���Y���1۱�C^PMơ��yBD�y ���xK_�K7B��QWS���~֮f <|j��eݛ6ԫ��^��U�����GM5�^����5Q����Q[$�s���z����;c�G��`�ࡅL1e�ʉYv2V�` 0��K(��6m���eW� �4AR�٩McB�ā[`�8J���l��##i�T���x��UP��}4K`)-��0��z��4*�/�G�^w�Q����t�p���.Ɖa�����"�����".A�L��\� Y�#kҀ� ��9��&~h�D�E�>��L��}PH rݡ@����b��J��γ�9�zѨk����`Y�K�BB�λ�ġ�a�=6zDwn����Wl*;�nj7,s����\�؝߲G�F�#5 ���N%�U��SA%e���ᆱ�'�����fq�Z���/2�u���ϓ-Z�vs���އL�j�i��o~ld2zU�������d�:�!��+��br�G��Fl�^>���3��ګb�|^���^�9���Sѕ �p)��צAy/�6�* ���Z.���� ����VBG����d(G � ���X�(�U� �i�6��s�2��̫��7��{a��<`5��������Nig�b��GFe%�� �h>�Ȫ��I�6�1+�e"��D�ڰ��s��ˌצ��HH���I�ʂ�~�18|�V�d^ծb�� �݉I����A�B���m���bUby�ضL��"����ϣ��K��#:cbfM*�i�����m#�xM�,��:��^Pm9C�"���8E�/��h��lV9�:���'S�59|�1�s'����T~�MZ٪���.�9�<���6iQ#�e�lH��Z�`�.A�$9M�l5<#�b+�� �=�� �����1ݹ �N��9o�+3f���N�S�Q�˖P` f#��Ь;�c2�g�ԉ�C�&f�ft�X9����j���3�c�01&^�UG��$[˜]��0�=P�@�*j�ؘ�p*���}�=� ۻyږy����"�5���D�猷sA���!���y�5��u���bE�c�SD?g�Ru���d�V[|�I�g۷1�(O�C���+�ͫ���Vȝ`��A�^^���~V�Ƃ�XO��'&��1쒤��U?�{���z �J�����U�$ƋT����-tb>�F����a�� �^�Sy�k�4�& fh��2Y���#�����B�#aǒM>a�j����xTY��� ;dIY'�T�qVx�͗;�F����״bX "N@���Ǵ�;C;�A�p+ؿ_ɩ�!0��t̛�>@>E��n�l3��z2�J&K>d9T.��kCI��u�����eC���Ư�L<�� 3��.����I����4�T]b�LC����'� ��vsR�`ͻU���I�5MK`�@����o�XXC��'�: /���k�D_R~��=L��*/DZ!�Ń=|pJ� 2�nC�?iwbe«�E���L=q����1"\]�:0��>�ß�i3��<�[���K��j�ď����A��9�$��о�z%^[3�[���b^1r&�*d,��j)U!���?#2c�Z�<��"|By�^ qq<�Q^z�y3��n'���������m�f�NFE�x, }ݦř��0#��Ŋ�@o�MWQ�\��Dw9�d[u�����*��3B/��<��^G�1�U��!�F��.��$^��`@��?�y��}���g7_�BFmq3@�8�U|8�-�L�%K�Qi� n����I��^��jgva $�r����ދ����������.%�ŗ��tZ� ��IϽw�g|� �;xOYV �ćz3G.4R�]bkX@Z�Ck<�v>K�ù�*QZ^��z1\n7e�^�sy_}E�z�Qc�O��,����xnE��v����b ����KĿ�δ��n�ڌ��t@�c��Đ�W����&\��j+=�%�+q��dS�ʤN��L� ���zm*|�F5�e�!�,��Z%X�$�^m� �4�]ҝ�� nĐIw��z[$k̉f��I�!�u�� [� ��'q������i�x(�a��&�������Vhx�U�W�����V��D��WG�� e������/1��%�~�u�VH�p*!�ϧ��8���c�߲9�Q��.�F<��s�Ȭ��q�,�}r�+�Q��� *ʈ��*e"M���G��ߤ9Q���v����� �X�'հ��ޢ\3��py�kX3^a�p_�bC�FP��C/��T�1�j� /b���;���I��ג����h���8ι�-T=��Cq�a�z��Jڕ�~`o����z-�c+3��Wt�_ K��ټ�`'f�D�* #& ���4)�x�8�?k� PR��o� ��vtR���nC�XK;��jA�������UtP��� %�ǀ"����f���~�� as��5t����� ���#!�^Ä�� �keuԂI.�!���۽�anjyI)�b��=?3��ˑ�-�������$2/�]�#��pJ[Ho �7�(X����G������;ds܇�ԮCCڢ氊(_���2V��0�GX���Zk��
Behavioral task
behavioral1
Sample
11bf2a65b41443e8feb207f59ef95068fecfbe14a566971b0e725c091d39bf8e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
11bf2a65b41443e8feb207f59ef95068fecfbe14a566971b0e725c091d39bf8e.exe
Resource
win11-20240802-en
General
-
Target
11bf2a65b41443e8feb207f59ef95068fecfbe14a566971b0e725c091d39bf8e
-
Size
8.2MB
-
MD5
4b3659cdd58a9f5cda08278568d65da1
-
SHA1
aa0b48d966d682a75ecadae7a5e0c560f654c248
-
SHA256
11bf2a65b41443e8feb207f59ef95068fecfbe14a566971b0e725c091d39bf8e
-
SHA512
a95e91f9ef755b8b37e9ad52e2ee05f5a7aa67ab7b8b42cad73c154256d94b8ecab81bbad77b874c14b7fbc4838a387708e602292d199efe31cd71d899a68cea
-
SSDEEP
196608:+p/o0pcsYyuI/lQrTe6HNCHxYiMr+h5ij6zLwk:R0piQu7tSxsr+h5LzLwk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11bf2a65b41443e8feb207f59ef95068fecfbe14a566971b0e725c091d39bf8e
Files
-
11bf2a65b41443e8feb207f59ef95068fecfbe14a566971b0e725c091d39bf8e.exe windows:6 windows x64 arch:x64
95035853cdeedbdbff3f31900417830d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
DeleteService
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpSendRequest
crypt32
CertCreateCertificateChainEngine
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord211
ws2_32
ntohl
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ