��b�;B��4^��,������H���4���!8���D����UrD�le4�|�u���RQ�I�^i 4�ܭ�3��y͚�_�E�l���gg9;J4��*B:J>���;R ��O�P�=��V�M֯GJ��抖P�� C�ۓT$��i� j�fS4��"e�b �0�,������8���G�̡�� ��u�ն�c!�x����4��se��t���c���(l�y��JⰉZDp�����PH���h��㹐�V� i�]K��h$�"��s�Kw��ʘd��gy]��/gNd�'S)�/0�%%�# A���� j�7���� Ý3q�>�����m����;7�G�Aj�Pج6��E{u�)5FW�L� ��) ���Њrjk}Q�|ⷀq'O �::�zr�+��=��z��4�q?J�� :����脠�IӄY��F���J�� ����� �N�fea��-%��:ޛ��Ԡfײbb��,�b�o�oW嶤o��v��ۄZ �f��;%��pf��]�L�B�U�О�p/ ̪�.WÆ0�K1nfL��f� ���vީ_S�jAu#�WqKi�c�h0c[�6���a���^)��j��P*_a�Q�絔�8�>kpW��H�˖�Z�� ��{hJR���i?˝�u�˝L3��Rj��������pa���!�8���+��{ ��渪a�� ��?)�*�t+%pi�R����_�V.L�!6D�2���@��r��8�~p���'Fz 쀇b,�E_d:[��[m7���X@��`4Lj ���G��h�ȧ]�mؑ��Y�Q�Z�#���L���mW�H4D=5��f�p���A����E�5h�|1����rE;ن�a�y�VGE}& xx���Jn��s�(�~:E�$a�Nx��D�<%�S,����������aJ` �i��O@^���llYD��D ����@�Cc>N�8�(&��I�P�Ԅ/x�@N���C�����疸��`���ݪ��D�cV��F�Zu�4A)�k���RC^=��fً՜QX��U"r��i}{��jC]�b�8�L���s_OCS���n��&jR�\�}lӴ���E�=�}��*�dl�;M�ft�ץ�kމ�h�#��p�w�����2���S8� ��(��EB<Y�U��~��jd��w��������m�����Y�a��{�8 �ML����W�1������C�AC���B�V_�H���AފrJn��s�״�#W)B)��Fa���A��*�µ,�"�TR(�dj�u����D�jprmz��� ��@�a���yMӑ�������1{�P� ��A��c�*_O4}��~sl��;z��ϰ$6d]$ѿY��_�[���&�9cb�8�I�L�jH|��p�F#�YlL.g�a\s�-��f������vZ�<i-k�i� ��ŭg����d��S��1VI���dqg u!�a����y�CS���]��C�k[q�c�3����eB���*�ar���<�8C�pI��n���DO�ڥ�}�`Fz�u��Ww2x�4a�����[�����YEm2�� Z��1�xL!V��g��B�څ�H.ۆ�mA�k������T7Qx6dg�����Ҧ>���@�SݶP=GҪ����i�k�����m�G;�A1�w&g��<��/�A$dL�:�K([0�����f�}��^IM��g�.���"��"p# %T+��&�?p����tnq�wS�k�Tl?�<Q �T�(�%�sql\��;�@`tt�@����W 8=§C����C��?'��8�O$v��y�F�z�o�üϧ!��й���"z�n���Tf��r��"C˥�@�����s�IU ���Eiǂ����R�X! +���%���6!�uʬ���9���0<�ѱM솤�'���b��2h�*iQ4u�?�i��Z u�^eR&A��k�� x�1.T�A�J���7��TKx�Y�%ߣR�3�'A�5��nb�$�dMM��Hu�(֎Y�3��g�Yh��Ɍ�%y��U��=$e�_�7��ڽ��u��N�D��[�:����:�_�d�J:R<�u��~u�;D[��(�獵���6���`&�/����N��x�Y����R����%M(��Ǚ����XmQ���\��H��M�}%za�3d�.��[�s�|�4��-v���K7Ҳ��JB�r���°^Ó��]e~d�%�߯n�iH!��������#9���� �3l*E��2!È�m��~��9�����e62��$ET�ӈ�Ы�236�Z2��-�����C�O� �ZA(e��c�1և�1|��bҨt�ұ(�����wM}��]u�a���eu\�M����0�濖u�~�}��D�$)�Ti���� f7� w�I`4=�>���]]�7f��䦵p�ET��V�@!�kB��P҉�'EWND�kz�c@ ������3�V�XHw�v������M��h ��Q��ÿo9��M��僒����kљ�(r�0A]x�x&]H)^���������n ^��14N��4�9�\��]���S-R�<�e?����h˪�J^�X��W��S�*�p44�KeǠ4b'%�)�g��W��jTU��q�Rq?+��S�E�������M�?ctTh��D�ΠJu��<�'��v��j�Ei?�n;O�|���W������l�R�j����ܞGQ����о5d`����!��"J�a�>��+.�D��E�ĉiT.��0hSI!��b{\�N��� �(�����M��=��b�j��m1�v�6�i�*��x~*���kGԃ�m2�����ge����m���o�c�^Y��/�уV:m�r�܇��]��(̫!�i�( 4��G_$�k��J�)�?� �ӹ�bG(�8W�Qy�5�N=��U�<=��4�/n��pm �v�i�,+y M�?/-� �o�r 3$�]�E����Jc��oV���6�<��ӻ����wZ_�>�"�O�gTA���#��"�R�R��MC�"�(n�T�P�_��H}r�Ә�3���X>9��U� �d�N�Bd�s�e@���Qcq�G�������
Behavioral task
behavioral1
Sample
SecuriteInfo.com.PUA.VMProtect.18481.5853.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.PUA.VMProtect.18481.5853.exe
Resource
win10v2004-20240802-en
General
-
Target
SecuriteInfo.com.PUA.VMProtect.18481.5853.exe
-
Size
6.2MB
-
MD5
489ccb5d43455471137a798cf13d95e5
-
SHA1
758ed32cc9fb5377e7adb234da1531155d22cd68
-
SHA256
47a03616ded76ceec06c720b4d2dcfeed7bf2f0be8d3ac6bef519872f4530c69
-
SHA512
411fc34ec07c2de5cda089dbfad2b3aabbb53793af56e2ad9179c4deb545cea2b437a07749f871a2655b6fa451b899cdf332c5518e426fc4fe1b733dfd94aed3
-
SSDEEP
196608:UA5fIbze3liS4nHnmh3yGALTDUcKXc2rKry:U4uy1iS+GYfLTfKXG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.PUA.VMProtect.18481.5853.exe
Files
-
SecuriteInfo.com.PUA.VMProtect.18481.5853.exe.exe windows:6 windows x64 arch:x64
5656dc75b59c6ab210aa51ec8369e49c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetEnvironmentVariableA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenServiceW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpSendRequest
crypt32
CryptQueryObject
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord211
ws2_32
ntohs
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ