�4�����c��Ȅ|s�yO�DHp�U�&HS��u�b\�ʰ�?���-f�-�/����&�nT��%[q��M�i5h��~r���OʓK���M:���Wg����A�$G�I�QE#��--�9=tKc�� �R&��>�c�XS^�p�� ��vP�> �ł���֤Ek���O���p q�ƥ�����]����2 Vc�Y&��b������s�(Hc�����i���Z畿w�?4K�Bm˧�#OvkM8���-J��۲.�,H���ńP�ߩ�K��;����ܘ����@#��4z'�Fu��h ��C�w���&kU���������QfC�Ae&j|N��Q ��@����E(QNo���劻���ˠ����9;7;?]�{i��pq�3��'�{J�E���KW�c��9I�����@>+E4�+�Q�:0���L`��|��1m˝0Ǎ��es�1���5�y�6�0} �\�) �D��89U��P�!����U����Ȇ�$�ȫЉoJ*,��Wv�k���HY�"7yĩ�E.ȼ���lM27۩�����@� �yt��K϶o�Lj6+2��"6��,D�{V����~��g�"j�7��-J�庍������q�@���mu:_�q���5���=�mz� ��!��xtKa�~�Ss�����x۰f�mq�� �n�qƣ?��d!q%&pk_l��]) ;� pz�1���_ C��e��$,�&��O�N� �oý2��N<��Z�H�X5�pS]��5�):ڞ�\�A3cQ�����>�����hF䌵��\��`?҅�|���t>�;��О%{�dyk��M~}�UJ�F��ORS����}|+��N5<NKz���O�]5)_��5-۰M1P�?W{D�2��ri� ��[��on&�S�ɰ��r�2.����m��`��q���ߧ�?��1�����ME����G-����KLֆ�G�[���Zu�MKR��ݱj���'R������?��}�8w�X �+ �1K�e�z���S�iqO@x촱.JX�I��Y�����!w�7��$-2v�]� �*|��F����=���zq��N�n�`����7����뮂�_��쒮v�U�v�K>�b~���P�Ϟ���/� ����q�!��{�Y�T:���F����a�5[��3�GxY�ҩ��ӯ��̛���"_D6�(�꽏'�mIЎ���e3��#��g�+h[9�szN�:DR�i {k�����Xھ2��*L!0�B�L��hK\�����%��A h��g K_e=��ϸd�cB5�I(��jx�<�6~���AkY�Vq�b�w����l���ͳ���(��JN�3�e"�q�E�#(���� �V>�����'Z�P#��k �:W�U9jJ�b#Z���z�n�p7�{�d��D�g�:����nO��?@�!�N���Kc�Ҋ�5�Yc���3A"�a)(���Ia��������FRv��#�%V�� ~�Ty��NB6����3�&J�X7�8�\��G���_�S���\��(ّ�eba���3*��c��S,�0Ί��@o{�84.@XtT�O�HZ�ou�a-�ד; �k��8 료Ɓy��Їx"9�c�h�HVw�y�XG��ZR��j���W�o?7��>�nc��E������aL<�x����wR��Vf#Ā�s�v�?�z�;��S�*[��!�>��HL>��璪��|Y)����e8Aˏa����h������g��'�ҹ�Fi�h�<o��>LZ3��� ;%�,������R���d4���>�P7~R5�CX��ѓV� �� �j�����d����ay��s�V��vP)Ǫ�����=��1�������o�Eu���4��Q��ہ��6��Q�q'o����y��u��P�P��n��,mX\_��P�x��v�O�?{Df�9���VT^ Ai.m�M�R-�����l�`����ܮ��x���H&�4��k���8W�R��nO��x/J�~��=Pl�4����j��DX�_��Es��]���� gњ���w��T�)���2�K�0��m'� ,4��v�'}�)���n��M�t�o@���>�'�{|����c�DŽ�m��=<'���^Ȧ��l�g!�����p��m�9xC+�3T��� e0o� +'��)���2�gf����߆��A0PH�J[;��Y֪~���a:4*��߄f�BZ�_N���]��&��f>ӳ�hf4'�d�q��Yf'�ZK���-0E�$�c�o��W�Zѓ���H��ƲH�!O��V g��d�}DRb��ɴx!���;���7�俌z��� �q��<FBM����"a���2��~;qT�ldհ���������nu��,/�[[_�H������:q�֚�]Og�R!�Bx]�=ec��5�����X$���&[߀u'�e�(^D���^^|����FƵT7����^y��Ԏ�����y�R�3�!'d���$JKy�ΐ�m�C����1�^�x�.$�\�k!I�G,b8Ļ~�t�� $�$���p��bar���g ��>�+�:8蠚�w�K��Z����AlY�N ��O"�j��'6�a�8�խ�D�E���� <FѝbL �,�]�=� /^��2���^�%��X��<��ݷQ��q:&*�P�։IH��c(�vC�+���M`]���[M������� ؉���V��&�f9S�;!|�1���V�z���������?�6ڰw���/�(t���� [��m� >�6���z�O��N�0䅧���gNU���hz�%�CPlA�F�p�h}>z�tv�D {�F����w�VH���`�����iQT]��Ol�C�z���>����\,=�و+���\d������Фj����C��t 6�5�mėjBm)x�r�Z�gl���k�8����w�ã��sb�P��3&S(�o�o<[p�ݩ5�\�eh� �����,�ng�Q�7��>���e0g�(���<�2�Jo����I���� �1��J�'d�˕M�8$υV�$8���n�'��?������6*S
Behavioral task
behavioral1
Sample
World.exe
Resource
win11-20240802-en
General
-
Target
World.exe
-
Size
6.2MB
-
MD5
525f3da2aeb8d224c710e3ff3e93458d
-
SHA1
4a5f1da28d6438ded712a77af77dfdc433acdb62
-
SHA256
e857527c00e7fb7db657cdaa17cbeba22a50582e2610cb3a8525d0b84031c352
-
SHA512
1041fd62beaf8c6a77b09a5a4fad1384c8dc7e174607a48a96850368c13ab2407a96be3b1bb69eedeee6ed170ba296bb30abe0c216a82a8857c657114a76490b
-
SSDEEP
196608:TpWoKc6NwP66snTat5WkAL2Fl8iY4WzzGKbX:tjKFyP66snTat5lT64Ad
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource World.exe
Files
-
World.exe.exe windows:6 windows x64 arch:x64
Password: 123
81631472274658d3947e814d8e376086
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
DeleteService
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpSendRequest
crypt32
CertCreateCertificateChainEngine
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord211
ws2_32
ntohs
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-math-l1-1-0
asinf
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ