b�����g�J]pE�}��� ̝�d���=wr"F������u�I��,�������1�3�=�pgS+_����=)!Y\0 w����,�'b��l�|m��Z��~���Lu��G�[^d������d>]�b4��%��ɁjQ F�<�a��w��V���"Zu�{�zg�|BGemI��ڶܥ*����2<�����.3��D�3�?!����u}{�Nن*-G��N�Z6�����g�����@�5;����w/����-D��p�x�L(C�u����z��H���f_���Γ���M,�V�vu��:��W���_���p�{PI��Osu�1���Dc�3jM�u���_����@U�\�:�9O`����:�o-��F���]���j[.�q�0��aD�M�w��`�}#������ؔh��� KJ��z<&-�YY�#3���� $Q<����p���*!�24 &<4Ui����Q����U��- xJK��د�D8/�+�63���ɠO��4�0TBh��!㽥8N�BqJj�G����Ӈڳ��L@�F�����$�_��a��^��n�l d4tB�����Y�>�d�\c���*sM��!/Na���0&4�Q�;K�㔂A��J�V*,�I��S���[��3�9TxY � dC�~��qM~�a P����g"~s��!D˧*�1c�d��i."�bؚ�� �:�u��C\ֆ��&b/�v��-�a��_)��z�s���+���g�m�!���a��&p��.��}�kN��V��������pK:[:��RJ7|��hxZ��C����-���p��}�b�VS��-����TU�Q,6�m���і3�[�j~\XԨгL�?���$D�]��ā��VJ:�=f��� R3YB�*�/�{9C\�X���eY?G��E���B�n��N.��x٪TV�IN���9�=e�V����o&�� ��������dϥ�� &�V�N�* �s�o�B�?�Pģ��R��t�$@���S���]�\��.x�q-�W�̴�����*=Z'����*ث�/�3}/�k��7ͺC���Cj=� ��*0�����F^`�T ~�IŖ��*;����e��� i�S�Yf�Si{[�ĉ��-��@�����`�V�j����|=����kst��P1�����?�;��O�ƀx�ܻ�7d������e+�r�{h�Ap*�b��O�e���?�p�������!�T�A�� #˱�d�쀻(�uJ[t��9�M>�I51�? +X)U*'^��3ݧ� �x0� #yߑ�B��s�}�wh�� ��..���$MY�v���>���ɺ���O���i��r��4^wb��븻�ɞl�O��jdkd�h�2P;� ����kl�[��TN��p�Uo�~x��HޛuI'Dł�It�]���%W��y�d4hUDl���DW�&��$����fK���$}�[Y��6�����1[�B��E=�^ɸ����J�H F����CȪi���+�J�U�r/���o�ڳV;��3o��i�i�<� '�oq>G�K�f�g��5%���Q����%���3�O�I�MIRr�������)�h�T8y��cp�D�x�lD0�ݞ����G�����|���P��S�,VN��A go�K+c�E"���S��5�k�1�Vw�>M��A4NS ��sٳ�qj��}��nxL}�3ȭ�ˠO���sla��Ү�PFZ�|�[�T����Pp��-�%�e��w�gQ��`!�97�^($=����f��@Z�e���:a��)�Ŧk���V�*l0�q��Ht�/�5VE!{/�E(�8O�)��~�y�3V�~�$w;���Ɍ��l��-�~#���F�)��<��_0��o�&y~��w /�X-������α$o�@���LŔ'�;�� u�Ğܐ��"+lQ%� ��7;�QF�х�M#;�����"��RxC��2,�Ԛ+��,��%i��`̥q���l�Q9�V�X�@���_z�T���^O��@�8�X~�х�=} �6��Od�e_�5�&!��&E�?��{^���z�;I�!�����Ĝc�R�]�U�� ~R-����T��сB.��X���gc�B�&��I�驴��2��O���h���F᪴z��p�<�U��p��m��c7��&ȇ�]���§3����cu��O�W�`���G���g� EA�}�gg�0,c�i��fX�Ϥ�{v08�FP����;��X��_�N��Q�8���X���:5��ܳM�����h �7a�k���#���Xn��N�N�0�f���,���l��t5�~���_4'��"� Ы4 �+��P ��<�����͘5a�PEA���8�����jW�*_2:���C�Y��m �����w���%qS������N�У� ̈j:�r���yc82�Y���@xD�Զ����W�����D���Z���P�pb����yK�j)��w���t �t�B�"4��L��*"p ��q'��3��� e�ȗf{����Iz����'GH'���$t$Bd5�٪�xD����C�o��]���/�ᘍͪ^�R��.K8���ǘ=(���S��#����f"-�B�}�]`���)�^�र�m�=�I�-i���H*�(1UN����q���AX��h�1��!��� �:4�u���-���~�ڥm������8`hz��o�w�d�c�/�P�(� ����q� RH�^��k��qݷ\���'�0`�ǧ��!|^W��IZ�֖Y���?S��0$�m�.)��"�ce#ԣث���tE��#jMưjr�Y:��z���ʾ�Q�$���<��%8K��5�l�w9?�V�v@zu��C��ۮ�������~\n�4�d�k�(/V��,;O�i���t��F��� b��$݉VᐃZ�#���q�?�A ��P���G��=L[^w{N�YHl}�38/�ȕo���zN���c�<�9�5�������Fɮa�脍��9����C�($တ���膟.���뫼���h�����m`�,��\���OO.�!���'d�>1����Wؐ"?��\��
Behavioral task
behavioral1
Sample
be670f4453ab99b2ae0ded8e0029fa10N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
be670f4453ab99b2ae0ded8e0029fa10N.exe
Resource
win10v2004-20240802-en
General
-
Target
be670f4453ab99b2ae0ded8e0029fa10N.exe
-
Size
4.8MB
-
MD5
be670f4453ab99b2ae0ded8e0029fa10
-
SHA1
9e197c82a150d07b543af120ca3e6f0311d8864e
-
SHA256
9239508d58b28dfd4e6c9e6d2435c8c0d9a9398df3be622d10ea438ec59155b6
-
SHA512
a1c0e5f69367828a654e1dc46b8df6e9c0d2902fc06d694158e673776544f054ee329f77e82e5b0fd04325a783ba4ad11899054a899bd54634c76cb82cc19f15
-
SSDEEP
98304:c9cbiyMaNU6EkijpMjN+7iFKSiNdvZmzSQZaYNk2RffRUkOb9TBPeP:c9c4SSjpMpY0zLZITBo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be670f4453ab99b2ae0ded8e0029fa10N.exe
Files
-
be670f4453ab99b2ae0ded8e0029fa10N.exe.exe windows:6 windows x64 arch:x64
c78b64bb0fdef83baa771840fdfb3696
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceCounter
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
winmm
timeBeginPeriod
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ