��\�6ܹ�NK� �[â���1��/�3�I��X "����2��;��&���c;�*9BR��"��Q�M]{���������T��J�("���3�S�����@#�\���ނ}�Ӥ;,Ȣ91O��Z�f�����&�����X0�ȴ�J%}�W@\�����}��A4x�ݏj����A���&����\�[��h���A�@1��1��������:�=,�F�������u�e�dbG��o0�]M�R�zQX3]G:SfA�1�W�)���v���U�0%��m�����:�L6)B��70,��ߘW Ă��D��B�98%�e�����C.V����w��~�P)�ϲ7����(��'r���Œr����NA��*W�C�Ȟ��2< ���.��Z>�UPN�f&���YlG��"B*|�H�ȏG����?�Х��b�ȨŖ�y��BI4rq����ɩ�?kY���?a�[;���db^qjS���kr���\����WM�d-�Q���!�_<0�_���0q���K�Oz �����E�#M��q}١� �W��"W)�N�R#�|<N@[��+�Hfz{�{����h=7',�ǚt��4�?s&[ڣ�r�w���e}K�� ���E�.V$��W�o/���˼��Q_%^@�4~��̏�,���Ѷbܖ�W�q�{�.B%K0lr�T����0K5��7[������T�>�%�5�'x�2R�r��4��5��D�Y�"�I�0���mL&ܻcn�$�ŊY�>��&�U��X�Yl[����BA6j�@� �s XG�Mn͡�TH�O�7�I�#&T%�>( j�X�*�|R�a�.�'�-Ч�s���x���6�au$[#�w��s��}��#X� ��%��nS2��=�i��2����1��c`\W�c_LY���N��|�H؇�)v�Z;��m`��RO6\;-�������M�X}<�1}���L:U���Z���d�Z����*M���ơ��x6��[�t~PR�������D��&r��� �����]����̚�ޕ�����{�$.�| q���g�Gx�(ܸ�OU����ք���M�lF��oQ����^�֘����C�=�v�����>�v����s��q)0D���{�C��v����V��匒�LO?���q�ҍw&���X��>S��F�F�)��I�� B'���F� c��'.���0��6 ����J[�P ��U��q8D�B__/]}�� ��y��x- �5���Lf����4�"��"��S���Z�X�p�-��@��lc�m�3|���nO�~.RSF��2S�C� � U,��T�/���`�q�Ԩ�7��U�cCW�����@��ciJI�b?4[dD��]�l�F�O L:��S[gu#��cQ�o:9�����R+�<�G]�2.VlH��8&O�&�����+5D���R�S��g��,h�m땳�'5�B��n�L����2���*��缕/� #�bI�M��ܭl��)�7h�/�pZ6N�:�Q��yL��2�K{F��!c�G���s�T$���e!�����w�ʣ��0,���66I�QT�W�q��d�t��QQ��-��ա�Mr��Q����n�{�ԯǵ���f�K�/1�n�����Xw,P�p��ֲ�I�BUG7�C�P=�4����ь��!��yx��NK� z���0S���j�����V�-��t�M���gƞ�&�����,���d� Q6@AS�#��U�_�֜b�-��Y�ط��^�kKH�%.�n�Wa�w5L>N&�y�W�ӄgTo=;v��� ?E��fQ����`n*k��o��� z� P�k��0�5,���ˀ����o�@�d�I�_����5�ϧԜiP�P}�4>�ߜ�x��)k�L_ϯ��)���tz?�����(�G]�SAݍ��u��꿈*+�;��9�Jk������?>��Sk��O�����{� ��'����h�K��ϬYM���ЏI�g���<��mݰm��qb�$ՙ?�����y�"d�ث29�`|��t�]�1��Ds&�$������S��5�X����D�qN���������[�ȕ���I� ���n�3�m�!"����-��}?Ӽ�*�ٸ@ *�îJW~���|�k�� �F��|���f:�#-��pĨ�[h�=v�=���_Qj��34�K̑�#�r��`rv���i��,�e���s];D�ڳ t���8o��������}����6hw�j}[�^�cu�ʨ������ШL9��̧�������R�O�3�R�gKb��l5���'Cr%�'��8&2ШB�DtHK&��T �� 6���� R�������:��اي���������+������õ�X�C��k�\�Es�R$S'���� �uC/\��w��J�%�!J X�h�QL�����h��� TSS:h �8�{�a?�ޔ�c�q�<�Ƙ�K 1�]A>4ϫ�#G��:�ͧ�ٞ��Z�E� ��vI/��H� ���f<$3'A�f�7B.߱�Yn�F;-g}K�����R/,�rU�- ň�g����L�ѥ������ ��4��5k��������7lh�*/t2t����|�ms��4�&L�p23��e�)J���\e��*2�"`�p��m.K7[b"~�F)דz\�7��_�����B����}M�iʲ;aKF�L9(���/�T[Z��ץ&�� � �2�-[�����\#K�}�fEK"�ڃћ�%��1q#`���"w�V�&����x���G��x:�(}n����ҙ��G77 ��AH[У�P�G+Z���t���6<���h���q4�h!`���Y ���z^^Ѓ툹����#�?�y���)��Wc�UnC�D�Ҽ��L�@{~����*��z_����/�wIJc=������Sg1�<c�4`�"@�V�R��qS�/���-���7��x� �S��L��F�g}v��Ǭ�NA��`�("wt����!i ��5�(vǼ �@%�0�8 ғƘ.�%��0[���(�!��H2k�tLn�_2�6���'-�1tm��
Behavioral task
behavioral1
Sample
fd6a883a6e9de6e9a71e76e76cc564e0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd6a883a6e9de6e9a71e76e76cc564e0N.exe
Resource
win10v2004-20240910-en
General
-
Target
fd6a883a6e9de6e9a71e76e76cc564e0N
-
Size
4.8MB
-
MD5
fd6a883a6e9de6e9a71e76e76cc564e0
-
SHA1
fd510f7abf4dafa5f1460e428ed45ebab6245cea
-
SHA256
9be6a22ca9145357eb920759cef5505b88aedcb3c79c2c60db727509fa6bef31
-
SHA512
d99c0aa1db8a95421032c95683822919d9112a17e4ec54e7f723689f042811e0d7648217bc85155e9143e363bfec5e067f42651c31b7a18df6c7a10dc513c818
-
SSDEEP
98304:Utvo5/+AOqZEJxugSYMqH2+DjUeUc0+zUtujHMgw08nrz4Xx:URC+RKE/ugVHxXnUCUtOMt08nrMXx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd6a883a6e9de6e9a71e76e76cc564e0N
Files
-
fd6a883a6e9de6e9a71e76e76cc564e0N.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: - Virtual size: 438KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 639B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ