x!�2B��&�r���H��M-�_3��1��C���MA�� V-(=�(I�.������p��Ս��!A����֝���Xd:�J��r�rp�]eY�N��,���Fh��>��?��Ji��y�H��5�4��e�<-�Y6�*�M����9/Y��#R�.���\��P��IN���Q�< /^�Jb�H0���UMb�����0z@�����Cw��wQxF����4��D�hq���(YbTVn�4a?�FG��V�7�N �Sa9.�NHj���;�2����a5�i����~DN*>���"ũV�a���N��A;�'R*7�>KJ�0���B�zC�%к>&�,��8���� ������|�O�/ �������iߡ�9��56������3+c�ݣ~3%��JCƣ�}0��������d�N��DN������ym�.�F�hH���@֫���:.ͫP�]���"e{j�p}���z�1@$��a�M9W�Dx�v�{��1����H�+P������=���p 7��_7��:��M�w����炢Ң(���V��<��O������{ـ\P6�o^���ۯ�1R�����_��%�4K�I�#���&�����y�z �������pPB����������)��g��E���|5�L��5����*U=w&�FpQki��R�:x�Q�~ګ$ej�C[Y�uS����Q�zFxd �7����� ��ٴ��9��i%�2,�㺌̈́Zf��L���iwN+�����=��B�?b�z�*��e�D��~�GF�����!v\ǃ�~^s�Z��#lY<Ž�]���I��r.iM�C�K�肾��fr�ڼ�*ѳe���j�i�{��o$�^���;�<�y���(R��.'0͡@�G$a�͎��-�! �G`\�j+�ʰ�:�<���H�z�c��*�c��%q��MJ�gMgK�(�~����L�u/�ݘKr4�y$��0�Y���� �b�� �]f�ث� l;�x�{�r�R���z�R��a����8!2�8dA�����L� <��Fey,�g�];:̼��R��%�`2�e+߉�4w�uK��<wy��U�Ӭz+���,C��N��Ĝ1I�/.@�c3{cZ�SK{m"�Uz �_�b���F�?lc+_l�µ�۟졻�E`1�Zo(�a�3���y�i����6L��:7{�B:B���d�ZwǗ/�R�,�_�=Ƕ}u`ÃGt<��*8���_��)�,��Uh�I���I�&^���K�+C�|#�T+P�j�4}g�sx���{XR�v��WGE�g�����h^J*��K�*�N�Cͬ���S�å�#ǖ%Þ�^S99��O����[jK�/� /�U�?z�B�F��>�^b�����J����lǫ�k�a��[�/�M0.�(��l'�����S�8��Ȼ��:�]$(0H�s�x�g҅�"��[q�,k5ߧ*Im� %\�dJ -@a߾̞wtI}����4�V4뢿�}��^5����pY�i np��J��S���Y^ U�K/{�ȋӸ�H�tn8�_{'ɵ��O9����&>HC�������|��f��.�p�º� ���ҧ��kW���l�=^�)�a�&mF|cl�ql���]�%�|�m'�k`K�*yq�RKyI����W=<��B��D�������<�Y�Et)C2�qM1LSXE��i&�X%c�O���:��RyE�QX����huNAt_BDFd�긇/Zs�*���sd§ A�ުd�W�z��*��Ff�/xw�!"h�����R@8�4&[�A��dKC�ǹɀ�c2+5����_&��٦�����p�.k�S��O�8�Pz?n�K.��uX�>��C���t�B����IUD��ݨq�t��X�HX<~#ܠk�Ȇ���cڏkP�����[io��!�ʘ$��1D�! ���a�-7(��{��j���1ZcռQ���{��hC+&x���h�*��Y0d�*�t(��y���~�g����U�3�s�� ���м�g��)�Zݽ/x��5��usk�n�,�".���ݮi���T���W�!�$ i���_�TG#A�zXL�UD!����H�^/;��Y�Pc��vI�_Ɨ�V��X��^���}a�s�n�q�� h��i蔓�=澷([y���\.�ƚlFR�,<����_�g2�~a��s���^*���)xXp��34�^�ˮ�Cf;���H�]Z�Nku#�����Ek������;&��J8ʝ���'I-�U ��k�/�qmY�� JФb�c��V�[�����c�t9=#�J�|�aTs]�2)�� =�oI��`R���� /�V��u���r����cl�#�b��O9����L�#^�D0�;����^���|A�tAw��[�����:=�h��x<�N׀��R~���i�������*J�;O�lL1b%*����Ŧ��#7��>Lp) ���5s8v�x?R�x�0��8���X�i��<��:�K�+�8�-���f�I�;.�iO:v�1UN��q��ȼ��jT����(����$��8G�LF�WI?�ј��7��T����Y�A�G���"S�\��\���sQ��ˤ����h�@{��萼���Y�q� �,��܍B��Br�-�[�tY��sHxQ��w�;�;�K�dУ�Y���l����М8��55��W�o!�RQ}f��Ba%��Z���`�dD��'X�o15����+��Kx�r�&�꤮@4��?e����|+V g���� ��/��X����Ex� 5���3Ï鹙������Y���6C?I=�E-���j��������HG#�T��յ�1ތ�y���6-�l��̤��A,����@��C5�lFP2~��z1R�{����J�� �ʲ��rT$PG�)Y���?_hDh�G��l��j��F��п�� q�a*����������:�-9�B��� �ڝ�W��f`B���^�I�AUC ��{}���q���J��ʖ+��*4�6eS+��5��N���K�e8�vg�j����~���#W6��o��66J��/��x7�b[Ճo rY2�,�/�� C\ ��<������*
Behavioral task
behavioral1
Sample
SecuriteInfo.com.PUA.VMProtect.6026.10299.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.PUA.VMProtect.6026.10299.exe
Resource
win10v2004-20240802-en
General
-
Target
SecuriteInfo.com.PUA.VMProtect.6026.10299.exe
-
Size
6.2MB
-
MD5
e8458bcefddb03e02008feac6e9255f6
-
SHA1
2d43f94b08d18cf922797d8ffdbcb04c48a4c3a8
-
SHA256
e0f6290a0856cfed90d31482a4723e9dd054b31107896d322bc41277d7c29822
-
SHA512
b0b06b07bb4ff47b6bba650ce7580c038aebe2a035735eaf3fa1eeacc66bf1ebcc23e80044f2d2b9b8a080aaf5f9abf9cc04de7ff823ccb29dd06edd1767c1b0
-
SSDEEP
196608:C2wfHWQmOWg5TNkAfNfi0Smgw8g+JULmO:C/HWQFHkA1fiY8h01
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.PUA.VMProtect.6026.10299.exe
Files
-
SecuriteInfo.com.PUA.VMProtect.6026.10299.exe.exe windows:6 windows x64 arch:x64
8d47b9bdb4f5f5f3d9f4571544a2a79b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CreateFileMappingA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptReleaseContext
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpSendRequest
crypt32
CertFreeCertificateChainEngine
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord211
ws2_32
ntohs
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ