��2 �ݸH�������$���+E�k�������Q�30U�ΊN���8��<�����0���b[V�2gf���ci��� ���Z� ��d��1w��=*KR.���a_Zޤu��hx�j�<¬��ܵ�H���V^ _ΊIC��h��wQD;��h����%�1��q����u#~��P��&QC �q��+���8��� �5� ��B�?~��:t��<m��"�5�~ʠZ���}xO��a0X��'\2v����)�g���!�ȍ#b�I��.������w?#U��m��z�)X=<W�u�%8Y���1�%�j8o2��m��E��\��59��"ÝC6�l)��6��.͔�Z���q� ��ꖐý���"�-I��5�����+�Aք `� ��q.���%`;�>��L{)��qG�%����ّg"]Gh�e���kn��q~�Z�64����Dґ�:�P �G��]����0�ɋ����6�����7@%�ȓj�E%j�_+�.�R�ɺϚ� ����sb��*�fn��m�����*���3q,)^�ߴ��ǟ��!���3@�n���t������/]�W���7��.�E��d���K�l�W�GM��xB����*����Y�k�Q�^[�-������/���ڵ:�eU�2����x ���F_���XZ�gK�d��i��m�s]P���6 Y�vAC����6��F:��^�ժ�< 2������)m�����;�N��a�,���k��W1��|$s�W�$B�Jȿ��b?ޢf@�o���/��º�'��+wge�~4�2�SYY-X���F�Ӟ�>;�`t��c��Mq�֏�adp He����mzl��@��[����%��4��|�2��u`�@pߋ��ٮ)&���e���6*���ܕ~9ߓ�d3��*$� "�*lWD�FT�*d�4#ꁵ�qT:yT�e�"��jXo_���������H���W���V�^(�.��I�[2.�ރ�x�^����������͛�i�a^��x2��V�o�X�� d��6���T���/C�:L�f�������-$���p��oW-�{���#���8h.� ?f�GkkOo��6��c�����@9@|c��|����Y������@��J����{;pS9���NC,9e���m��\E2��b����]�/B5� v�R�D�8Z��#8堰T��v���Țk�`'�O�pq�6Wfo�W�"���M:�p+��m������"���P��5��njs��i=�d�1�����R���|�C�&>�1iv���t��w��x��+پ��A*�/��j rȟk�O����zs�colfz7J��$G�T)��=�M���h[��,2�a��DI�H��\y�`���l����SN��u�] *�Km�o 7��k0"3zY�%9�q�?�X{��|��w7����#��켮��|�-P�mH�~{*���j��"�:��z!�h�xɅ�\[��$��S��@�V(s[ڷO�/V1\R��ʴ+XVYoZ�3Wbt�v�)A@Ͷ` ���h��@�O3˛hc0H��By�5�9�,L�9c(��B u���*�p^v��''��~W=�A�7�j2r��T��7椄jp���p2'n�0M��mdʁ'� ����$c߁R���q ���2<�붺��X��!��L���7�y�o�"�F t���(�m>�Lwk�=ćLF�a#�ĭ> ���ϹÒh1"G���Ԛ�U>�Ί�<[�|��{f%_�K�NC�E�H��*�6���Î�*(����"����%���Q��L�+���fk3$ٸ�Z�j�W�wW��?�4lc�4V�h���C�|q���������c���6�),2�@�pi�T�!P�?ȎkBBL�2�:��BS5�BF�E��,�e,���0M�G���I��e����� =`���(n���iUskFA{�E����A��1�r�[�����sT�L�5k#��v��G�,��F�� �[\�`�����^!�$!mq�P�D�]������N����Y��X�5Ե�,��Q�c5���r�c���TC��*'� ˗M��G�P^7��p���}���đh D87켞M�"���~��q��fiL�N?_y�qd�<m7�����jP�?���Q���*���4^�Z3eL,�)/��������N�&����i3i-�沴�J���)�`{��>�&S���[Lf��~��\Du4-X���Bf��U°L�����@� ��)�H^�ˤ/� �Oj5�6�O�0�,�����e*��T;�9\��3W�w��5.�%�U\L��Kpӽ�&�g`�8�)����6�v&p���N9,Z�fPW���v��M v���� 0 `� ��P��6Gk���RY���R)��/��[_���Z!�o<�a���� :!w%��n��i��Ό�J����?��Z��Qv����8�S �WE���M]K����o�bٴC�A�6C����SNp�yd~�/�ZҴ��pϋ�wsd��+��N���#� �M��:�<Xii������IX��z��O7���/� ��K���n�W��+�\aSN�x�v8k�~YqS x�m:m�},�M�L9��?��}��zd�5{6��J��9>Kʕ_/s����c�ό�� %���-&�Ql��9 �6�������ئh���xKA�e��-VuP�>�c�w,�;�����i��njOhO�?�0�UbU����#l���)��TUo�&Ӻ����KZdΜU��:U�������fZ�m ��0�F梐3՝�`��<W��Q�������7�&�a�1�\X���.��|����9��Tr�J�5��^Er�a�b�oԟ����������z��˲�H��^�[������Ϲ���9�^T�'֥'zO����;G�e��n��8~��(���ۀ4�`|=1�;���h�!{iP�� ;��<���������E��c�$������'�6r�tzҭ�'�<��ګ��(���@V���x���0��'Oߘk���%[?4�H����.�Ξ0S�?��
Behavioral task
behavioral1
Sample
injector.vmp.exe
Resource
win11-20240802-en
General
-
Target
injector.vmp.exe
-
Size
6.1MB
-
MD5
cd2541ea19a184d60c0f5a2c0081bffa
-
SHA1
466a368ffb898e2875802158b1479441866ae308
-
SHA256
c4491651cc5c5c38b9bdbb3c14a853183eb1beff4f6f67bb7e2de214a5509abd
-
SHA512
894e68d9b68c84c2685e9c77a58aa1ff137330acd132313000f69e091dbf581261477364d50f4dff213882ee45d469696048493b487dd5a0e993037baa31a400
-
SSDEEP
98304:OcDqnSBWYupfue/Gn+Xv5rmwP9Hw0MfJCXEQwc/CILvuprh09xtqSLWUsoPL8Aeh:bD6XYupInyfNm2v/CITp9xtqSPFj8j
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource injector.vmp.exe
Files
-
injector.vmp.exe.exe windows:6 windows x64 arch:x64
485321da62ef9962c518a3dde50d07a8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
ntdll
RtlCaptureContext
urlmon
URLOpenBlockingStreamA
ws2_32
WSAGetLastError
mswsock
AcceptEx
wininet
InternetOpenUrlA
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
signal
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-math-l1-1-0
frexp
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ