`Ɋ6���AL�P��Z �A~���y?z�*�&�XB�jK��Xd. w�l��w�x���ScQ)|���*So[����4�ǒYz�ql˼����1�����s7�9a��D��:�����\�x<����I1�݂��ܙ4m�F@&]�1\�%��4��[����]��MYfA�NI����9p����O��(b��j|�&A�N��c�����C�X붟������'&T';��*�3M9~3��Uz7�=�(��v�|�G��{�zf�rx>��]����ٺJ>!^n'��pİ���ύ>s���2�<6���z'�6u��0V�JԌJ�ܡ W'�-x�0�ѯ�������o��O~@�:���/�m'ۧW��MN31O"�j,�al�JI-%ǕLː�ϼ�A��V��C('Թ?S�0�v;��h�u��X��,G��f��^5�U�K�zJIsi���ԕ��1�S/���� ι�}��MA�7�I��� 9I�_}P�s���4��kI�}m�4jV6���]ND�CJ��`��:4�j�kt�u��'��X�D���xTmX�K}�ؔC�ymq��/i�g�*��j~[Q�����"7s�a&^��AӛP���0����G�Z/z��v���mVQ|��&M����鑰\��:���XMIJ��-v�\� ,ڒ���O��r<8�+Ue��UA����k4v~ۆ������i���� �Qx�)EcԆU ��1���ȸ�[q�Ҭva�o��S�������� 2uP�w���L&�c+�UZs�Ƃ�*�! �l�P���D��&pQ�.WPn��S�?۾|�q�θ�&L��3��d����^���◪ 4�v�S�K�E8���#��g��x�$������~I_�@�S& 2�Ƀ��5�^��?/�3��*%v��������9���� .�w _�B@��� :�!_��,�5a^:���rR��rP� S����d0˶EK�Ί��um/�H��k8�"�~ s�Α���5Pq�dB��� �,`�Z�s�E��B%qE��.-��Ύ����]- w��B1*��+N��%�Z��]��+�t&d������hF�Ÿ2S��Ȍb?V�Tm /Oq���k wl�E���Q���I��������4w���/�c�] �*�u\� � )+��=�w�ǔ��'yP����?F��3�=�J�T�_A�� b��� ë1����l!�ϝ��6���%��珰釾����'ۦ��ʽ�� �vp�������B�|Ύ�5���v���T�߰v�i=nM�t#��ϻ�Np�+y8���>Hg��!�Ç���)njvD���i���48:�l3*������Ɂ��q"8����9[��x�.Fz'�h��!ACJ)�P��'��hݜ����leYӱ��;�F�Na�w,�!-�.}�{��{K$�Z��[>w �\�6�T�(r���G���Iu�t�QF���7t��u]'�v2��B�I��u��-��D�������|�ͩ�&���t��������������3J��4��6�"���X(������; �K1�4��6�i��f���\�oS���!����Z�����}�"��Ԉ��(�v�mS���vK,�Z� ndz����\�� �~��2n$�P`e�X�������P��ѧ� 1�_��,���g�\�������Za�����w��hm�i�J{/���7�p�"go�8$�<O���z�x;�o-A����eM��s�G �{4d7�o��X[ ���R~0ˡ0�h�6]�����\��^�zZC7�c%k^5j�(0��/�D)6^*!s=��V� ��lܿ)��A:����H�!��t�:��� �6����6�۬)&b=�-�~e��4S΄��[NO�N���3��yo)/�]=���Ӑ$#�� u��F���D��&��IB� �Y�%/���ys9���3�s:�4S'&ǘ�9J �[i=)�Y*� ������q����ᔌ�I��?!�d�HF�L�C����C8��#��zߪVlY`��r�Gр�HKX�7����"���|JF���]�7��E)MAn���.Y/c���D�(N!ZGpL֢���tu8��7��n�m �WR�;� �d��#�4i���^�ꏈy�&G�\ukj����t��Lr�g�V�X����z��Eg�;��E�[�pR�hK��� _Y3D��LpYh�cPQ8��^A�^xvj�7X�������`@��g� ��N��j�:1D�� �8���Ͱ�h̢q7!v<��+8X�H���3��HR�g���C�a�<h�"�~�3�iy,~�ȵޱ�AHq �����P��fd���އu��/��Q�3-90��a3q�+L�j*�K%8"�[&>[6C���? ���� � ȱx%�eO��c��e]9��)En��Uq����H���ẳu��Hh:�U�`&z���Hɠ����:$��\�D̓3�'�%S��ft[� ���̃�yܒ�Ɗ�8�T� �Ba'����fk���C�a֥1�+��J�wfٝ���hs�c�2�>5���/Y���l�T��w�u���)�tv�f%���|��]y�g7��A��* ��"/!?��^T.��Y*;�<�<3O���Y�-�H�dW)�%���5%?�bԏk�� ��Y����.���7���[���n|����� I�^:�W����>�r'�>�nȿ����ɓ��YK)�[���ʕy�)��?��}��=!rk���lc��]p��M �a�k���4�W9h-#x��N��,���ћ�"Ĥ��Ν���C ګ]�� ��h�����R��'���J�0U�=8W���ߤ\+vR����凈褂 �_U�@��-�@���������'잘�R������vI���寣���"��/���M�M�j���A��+�"-z^J��H|����O;Jt�=�H�;��~v04�9j����g��e 9�-��8�FlO+6kn[̹6�p��6�1��aj��<a���YZ��/�+�� 8�s���yL����9�iӬ0�L��T߽BªE��z�3�N��;���}L
Behavioral task
behavioral1
Sample
7e4ed4b9630f0f68628c99dc2c56298e2963ed8794a0c09a919639f2f2e0f33a.exe
Resource
win7-20240903-en
General
-
Target
7e4ed4b9630f0f68628c99dc2c56298e2963ed8794a0c09a919639f2f2e0f33a.exe
-
Size
5.5MB
-
MD5
643be8314c495bfb5b10b7a4afefed08
-
SHA1
e6c5febf06b3a47b825cd7aa58fc0285933078bb
-
SHA256
7e4ed4b9630f0f68628c99dc2c56298e2963ed8794a0c09a919639f2f2e0f33a
-
SHA512
2e993a717a536347f9c40f9ccae2e9e2a2b263e5a102d5a5e1999d5f77404b2be471b4d553c9d7a219742edfbc7495ddbd8264c084b9c511563e004a318e89de
-
SSDEEP
98304:vYWQ43GjtfWmp5Wo6Ja9lx5sIZ26ld0YlG9wUkvJpPdZjgC8WQPk/f:gWVWjtemuo6JazxbI6v0oGP2DPjchWr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7e4ed4b9630f0f68628c99dc2c56298e2963ed8794a0c09a919639f2f2e0f33a.exe
Files
-
7e4ed4b9630f0f68628c99dc2c56298e2963ed8794a0c09a919639f2f2e0f33a.exe.exe windows:6 windows x64 arch:x64
627d81962fe95452c12f92692c25097a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapSize
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Xbad_function_call@std@@YAXXZ
winhttp
WinHttpConnect
crypt32
CertOpenStore
normaliz
IdnToAscii
wldap32
ord143
ws2_32
ntohl
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_unlink
advapi32
CryptAcquireContextA
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 429KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ