��� �h��"� ���:c��z�u��,�~6�k�ÿbr�F�[���kX�DA�5Y(E���1iuߪSP��@��QX 6r='�HW<0I$����qe�&���� 5>E��Fe�5p2�[V�S�.O�҈���Їk�4L�|�/�܁<yn|G��Ƌ# ysO85ɦ�p/�Y���-��$����#��g��{Iԉt'���нQ)�!Ͻ)�(Rψ�>\la��!,�7�o^O��������,�����" �I 6hYɋ!f�`P��3ag�۶���S1b�B�,����^�"��4.�dM%s'��?����6N�?�,;rR?�ݼޖD{�����8�w��E���la��JI0��Tz�*���4���-�L.%���U��͠��m��E��������! �I�����{���33�yrOQ��_��ܢ܉�t�Z�����8=Ķ�Zel�c�Ѧ������3Ir�:v����+/L ����ʃ����_��''�"H��K�eAA$�@99���q�������fE��/Ϸt��Q��O"�~2�f�Λ7(\iɾ`le��w�4*���6!�-��1��b�� 1�K72Gl��v��Iz���*9�l�忒1Y��ai��S:�;~G�"�D���T@QH�C6pG��/��H��`��>��#"��Ӑ��� �E�q[���r�7.�WV<F%yR��� ���)�簸hvU7�.�$<��G9����˷�f2���ViRX������Z�_�[��#Q{���_�vQ#ne�iY/���]��4���g%�a����؋��Y�Υl���s�:Fw;���&�41 �g�RH��賌:�F�r��"�{/4�`ȡ3� O�H�o�0��z`�9i�]��Ҭ��Hx�:������;q�$_F�/�� ����*X��'2$x �ڇ3R�j�$���2�[�Z2��ֿ�n����t�ݽ��S�~C����,�0-G��_��]3"un4�LH#�"���l�ߓ���cu�q��ߔ�،�"�c�B�SO:��8�X8��%�_� �ϐԾ�V_G_�n+�����j�$�=2�ۤ��YB���W���n�TW:������N����W0h9���M#$f��R@�=�9���h�t��5��H �j�CH��XD�ĕ�Rȑ<�����N�� oD� ;���ł�\Dh�w�U�'�@ؗ�Lh�w���������F�s<l??#��]~�Fwd�$�kI�V�M�#I��π5���r�`)`�*����?�c���"�%�ʤ���d�RIN��gp!/��������VH�eB�tr�][}53������;:Zڊd��8$��E)���c��e>m��ҨN�'Y�6=rX'��<!�{^��R�I �9d����o�o���-�dz�@2�(2�{��HE�1J$4�q����^�q�{P�� ���u�����n �6 8o�@��$=���V�>O���dk�k��v���)�� ���v�s�0��L��p\�ʼI���B&Z}r:�E-�b5�@��y_q�dI�,��7M����O�6��?�C��D��m;w�u*�+Ӂ C�䗒�$�b]�r��y��_�(�!O6e�� ��-�i���u�s���R�X�&!�����sT��c�f�!1�7��b�i�ܠN���<_/E�;��`���R���k@ˎ4����Kz�������m�R��[�X# �f��_B�6��r\c$?~V�6bz���.�����TL����Ŵ��8�C��}2o�����$��#��`����;����'��,�����Z~h����[��"�'�Zu�Z[q����EBt�U4��Z�72������\C���5�C���pD6����(��3y����/����j?!HW�ot�%���r簔C��� ���2b�Ri�]�&U��?p�v�m$k�yT�6+wY�Z ^�5��;�5i~0qܱN?�)N���mg���I� }���j���7�'�=���x�o��az��v�ڕ)��5�lEҖ�j���X���^1J���Xo/Q�UE87g���b����kX�P�R������Za� ���r�i�B /�K���dQ��Z�zr���%?�WX N���Z�2ܷ6lڱ��' ���=jy�5w����$i�x��$�A�&90ǡ������J�!t�o+�y��?�C����ȍٗY��$�{B���}��q��W��l>b�D�r�m]�����,�"��W��\� �n�P坍:?���2�� N�;����QA"*�Y�<-~����~kwe���s|IUf�n�����ϿS$=��E"�����ž���V|ʾTV�ҍ����:Y'َ���4������iA���4���I��)�f��G,0W-��?d����y~�p��{����prp�� B�?����q�4�-PH0yW"�ȣ����2����Hy���7�윇?���vM�Ҷ� J�A3���r#��<b��w�[���m�>��D� ��2�\�'�^'�H���RGL���Y��ݡ��Ӊ��N�>v�DF��8�9Z�D�]o�E8i�6��cP� ��<�v�@�H��� �{6=�=""qf�_�f��t.�ۤ/�5F�Q����K����[����=z�>.����rӓ�����?���/.��.��B���^uq���Fd=�y//�C�쐠��yN�-� �1E�5����W" T��%�H^�M���/eK��!��_m�vk��0�eW�p&Zs�_�W9v�V��h����Eei�d2�� �V�Z}��uӀ;͆�c��T�+;=�RtU�#�p�5ʇ�.�C�AQ�XJD�}J��>ħB|����۪��oN��4��p��@6RV�"���2�!����bYR�#@_�F�J�K��R�#A�M�mҵꮁ�����zr�X��T���3��x&�OjD�:�.� ���������X�)�*�/�l��&*>E�i�>,�M� ���������R|��!ɇ����Ow��[�Z�%�Jz�7x��B<�M �n�8�
Behavioral task
behavioral1
Sample
SecuriteInfo.com.PUA.VMProtect.332.20908.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.PUA.VMProtect.332.20908.exe
Resource
win10v2004-20240802-en
General
-
Target
SecuriteInfo.com.PUA.VMProtect.332.20908.exe
-
Size
6.2MB
-
MD5
ae8b45f4999ae0d5f44ef24212f8ce59
-
SHA1
fca64d593d17bfe60ccef31bc68237333c6617f2
-
SHA256
53a3e42e873e4bbf9856661121c96360165c436d125a88c16fb900a4f1f6cefb
-
SHA512
1816420b43659c1a75a08b3cc06aa02842d63b74352820efe56379b0fa2df96e23f069a4f93c7caf5243ce31eb80642e236ba056d57109374687a90ab6c793a8
-
SSDEEP
98304:yLnaNePV+zzN4E3XZFld3uCTJR133hjW59ylq4Ohedsg/qBR6eW1EiO+pe:MaNa+1/XzH5VI9xm65W1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.PUA.VMProtect.332.20908.exe
Files
-
SecuriteInfo.com.PUA.VMProtect.332.20908.exe.exe windows:6 windows x64 arch:x64
5656dc75b59c6ab210aa51ec8369e49c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetEnvironmentVariableA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenServiceW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpSendRequest
crypt32
CryptQueryObject
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord211
ws2_32
ntohs
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 347KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ