U�M�ٚFLV�if�z��3K���H�6�^��o[�e0+�~��T�xG�?�H�����A���)���2 �8��=_���Sm�~��,p�?q& a�Zr �>G;���Z����?�'�i@Olǰ��_̜E�����N�����E����������̷�%O�)&�\��.�?,U�`��(v�u ~!'Mk�WI�VU�(�E�,6>� ~uD⥁���h���9p�A��?V�"C�Gc4�n����J�|�B+��.�����D��ڎw����.������i��0I�5�eX�������<y���Jz;������3���{�4��b\L�pATF�mTX�4����wo5�\'����������e,�����^�wb�ZB��45��#�Jx��{8x�n�c�,*�*,�(���^�5Q1��������ѡi\��n>:�Eo�e��.@ �8�C�k�a̤���O;�dt<�����?�(��.�����)( �M�ݝ������]��D�w�%��s��˅x,i��]tM� �Hj-�+��яC������R��]>UR���\������G�����V�ݟ�U��z�+���4#Q'ϻߩ#�6nBE��;�@�;LD h��YE� �^ݖ��!�����������C��>��������dX�]�.f�\�DKS�G�=�<���6 ��,�6�}���E�o�ʐ�ŧO}�cr�� ��s[4\(��l��xR���7�F'z�fV�� :^U0'�E�o9v���� ��Dm��xу�ѭb͌�P(�%���M�(a��^�l-P�^o 4�A�5�W�܍w��%�U*�e.Ӧ��j���N`��q��c��;�"�R�~�,�?��n� �6+�n����`Y �����)�й�kt��Ϲ��� �a��mMq����a>�S�G�������?��6��ԃEI��r�Ǽ_���1����Huy�F�)������L��ev��e��Ֆ�Խ�����i��c����� ��|�E{!���v4R�d9���FO��;�[�序�9��i��7��2>�es�m�C�p�ss���%��4�N� �r ��t�K�`@fj��\_Kx~e����1l����#s�ĩ���Ë��>l�*�T�L�C�?���ً��-���]��Hk�����/�B`F�5���>��vG��G��qA�uݎ���Gf�;�5�qC_���"�((�hD��'����_.5�����os!8X,�Y�FYo9�|����� R=���0��>��v��"�t���'���6g�4��1\�ܤ���8�W��Y�ͥ��Y.H(T�!��|"�F$S^�>�N��9x�J�)}{"ˎ-W\EW��!9y�˚�k�ȗIѧ�=XV2��ڿ6'�}�P^���������IP)��ҫ4��E��!����T���W�Η�Hr�Nj|!���E�26��̸*6�g��0�Ğ���;&a�� �3_�(�D`P4C�g��F�%f�jm+�ĄN��-�uC�����dB���jB����VX%�A���`Q{���ݥ�`hG��:�<�ݱ~��> �iq�M�|ѯ�`��v��2����Oz�tj!9�ɻ��Z$Q D]'ߺ�:�������5)�:,y8����i|ã�|�2#H�_ľ6�qfɧãAc(@@6Jl�D X�b�#�p��Q����Aad-����1EͿ�S�T�Q��ߴ�������ksu)P)&[<@E�2��/�d�OR+�+�\����ߚD\��Q�� &lj�3)��\-+ϟ�\;/䅨����9>���'5�z��\�Uݘ����{��,����6 p�7a.��Q^�F��g�E�R�4���Ѝ������݇���-�HS_H�{��A%�IZ����k=�����\?jE]B���&�� ?�#> ���R�i�W�I6�ekn�7U_ً��z�uqs��%�/#&o�P��t��f��jN.-;����ה��j����+K�Of���4J�~,��"�4���7au��'?-���M�ɵc�O亂��!@�IO�*��К=(� _�6���Mʟ`�l��:y�d�t&y��J1�l����J��HRk�{5�_H���NpsG�ި! ���-�3O�|aӫ���n�l]����:�465��U�J��Vm"o�k0i�v�\s�ھl�ܞE�7 ���#�#�q���P*� �O�l�ص��#L^��X�v�@��#�Mg�۷l���i��fCق{ؕ�L�]'�����fw�;O�k@�V8�L��1>[3ME��X�"�6dPûJ��{{�nY����U��p�8<��}\����#������r��fcZJj/Yr���%��kC@UV���v�C5ڭ������:��>Ex�ym��~I�� {�މU�.�F�nDN��J%�˾e�0Ιh�`s��ub�E���1���'��:���L�c������<�_�����*q(��走X��{Q�d�sWyz�I�'�4��в�(�K/?ԙq�C?l�V�Ճ쀤jZu�'`��<�.ٕ��_��S���O�r��bl��i�FY�7��1��� l��_崮H�s���b�$1 (5q�n&<o����E*�gr`�O����� ��2"Tn&��F����]��s] �&���.�p-V�V d��7 �k�R�"��Zȏ���y��˴�ǿS\���y���9 "� � ��vmzh��V�M��|����#���)���'��i����+g������V�U��V4c19�N� q,8�s��X!��%T.Z(�� y6a��7�W�{���k}�]k ��e�ۏ3]X�\����V�L��dί�G+�}��W����l� h������F������_���y>�<IÊ�K���f�����dc���xpX#Y� �d�b��u=�to���(�1Si��� �*Ҕ���Ei�̳[v9�$��<H�����5 v��S�>�{�nm�7���CC�;2�b'_f����6��Y�����|1��ߺg���g�o�;�'��j?� j�M˴U�:ɬD�dM��U�2D�`}�p`��� |8�
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20240802-en
General
-
Target
loader.exe
-
Size
11.6MB
-
MD5
3fb6f7382cd42db4ae7e5d2dceabde54
-
SHA1
9113821a3227d7c417835c8d437540d7dc25478f
-
SHA256
f2bce8af8313bd95710966e90e3c5de80728dda7e9b97a26b2e1396e797aef06
-
SHA512
1e4686f9f02def2147deb748cffb04af01530bbb010e86eeaf79b182538bb4d1a1ce5df28084166138eddda789e788e4f7080b12375f7e390317b31e0429b6a0
-
SSDEEP
196608:6mu6lFEZs7cq3YvPIrublgpFV16dXL9ygAfWTwTkZDh0SySu42QcGlV:6t6lOZs7Y3yWgpFX6dh1AfNTkZDmXIh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x64 arch:x64
b164cd412d2b20c0e657a66e6361c1dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
K32GetModuleInformation
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
SetSecurityInfo
ole32
CoSetProxyBlanket
oleaut32
SysAllocString
msvcp140
?_Syserror_map@std@@YAPEBDH@Z
dxgi
CreateDXGIFactory
iphlpapi
GetAdaptersInfo
winhttp
WinHttpCloseHandle
ntdll
RtlVirtualUnwind
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertOpenStore
ws2_32
WSAStartup
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 586KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 554KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.5MB - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ