��Jz|"Hx��Je���B��+"<�{�0��v�)ט�H*uHԊ�Rߏ��Z���_����C��隧k�G��D�v��=ʘ]\� Zo��7[Q%8�ز���H�`��k��]��a��(���U��e�2�+.��o� �ܽ�m�`�#���3��s���+>�g�v�E�R��[���s&�੪�(��=Vh�����ê|�����EzZ���N!�ط���<���Ѧ r���m��ALP@�� ܱ�̧Q#�\dc�IC�H���u��OO v���#uwvg9������ƩuKħqǻ�NA"�fkA�VD�� R�p$_;��S�Z��Gw�$%���ǧL��+�m6utW~������g����]@A����-�8�V-�ɞkQg|��x�>�y�Nt��>��/��1Yp8�Z��^��vI�N��:K�yGi��:x�iIE� 5�S��F�ʹ��A��7w{mz��ѢIh���V���u ���:6��,�o��u���o3e�/N�䷹N� ����p�q��:���Y���,��7�l�=��(/��d�ZdZ�|:�&���J%���N�j����_� Y]��uE�[}?)��ʾ��,+H���#�na%G�Κ��� ��K�*�����8�>�좟�r�I��E�e)2G�(0p�䙱�B��/5&`FK���44x�C�-JR��;�%���}9�M�a��#r�;}F��[<�X����V�|���=�@-ؕ�n�G�H�H�ٳ��ޅ)����Hot�����3����'9����9��Y�BX9g���LU&j�J�uvﺎE�9��n����f�d�W���hom��ԼE����K��l��k�j�G����������$� RTq+�u�ȸ�F��I,}A�������2>o���>8U'D1�{'�N�6�!IRcg>6�dM�7٭�� �Y�,M��ݎ��&��WU9Bg\�;�<oȨ.'S������7�5��Ρ�q����_J������~]�K�L����W\%�^�Vc���2o����r����Y�. ���u�K�v�c�q��V<���S��D�k{ �c�ݗ�r�����z���J���>�D�(�J��~�aU�������ei��(x�1sy����B�{�\����⟪�v&�U9��W��szZ\e5}O����Em�F�K� 4��_X�1�k�\�����f�Qg����Q^��y�憣� �����C5�I�����P��`l@Y&,�\y��@??�V�4�3�>��q�> ���2�5~��H=���B��i �^��Ж��Ձ�F�N����Y��V�_�_\-T��z ���G�q�K�ں���pb�& ��8�Ie��5 G�:A��vٳS+1]R���o�-U#PS3v��<'�>��qN)n��^����B����t �z��%NΨM5�Ӄ-�2�p��5����ת�G>�<�z�?����� �PZZ����7ڑ.b��c��JR�ʤX�g<�E�y�Gk��L��0��Y��6�f�^~\�8wJ�>���d!@{�(�UB�� 2R�I��a�d�!�X���N����,N�.@�1�씭Pzp�*�`lyTE�qIתC�W����^t&��Jm����{�[����+]PN. ��2h��p���ɂ�!ߪ��bn�&�v ,>�-����p��g�j�����ձY<��~I~>Ϗ�lZ�ڕ<�^����";f�G���=R���ȱ3�k�J�ֵ�kaϠw��$gV �Q�d����0��=�Z�<��KeKz'���/��t�"��: A���jNT6�|lTFE m^ܽPj����b��2��>վj�?���Q<��� ��̺Z�k@&B���Pֈ!�C�@���l��q������U�&���7�?>+T������Yc\Q-'I���H�:�q�����R*2�&��}�@Q���ŝ��tdm��ZVN��+9�76�;��G*������E���1?����=��̰ �d�u�D�{ �4}�mذ�����KHs\�� N�* ߫���>u>�&�P��ę^O_)�� �F�1)f�%��O�4ܠ#Tkf��.^�ZFVZ�7d� !�����i4ZN�>-T���I�,>����� %��I��������`�3��@���e���ʧ#�;.I���MJ�(LB�ɺ>�R�W�}0�B�u3c<����?i���&���ND�6 ���d{���IW(4�����Լ�ϐN��Cyu��t RI�\qt;mb51A��f%v0�_V��a=>f#D)�XmyBj��sW�O�B%��|h�6^�k��.�Y6+�4�>lE����c���fA�.���H����w��R'=���:\��C�W{͈� 6�W��� �0��z�4ء��TA�ӢOթ��$�����W4놡H2;���T��8��D�l6��K*p H�u|���HoO�1�u������CC\U/_?�����[eb�7����r���kD��N�4�B#}D���+�R���>(RJ�hl�.#����4;�=S�:�-_:dŇ�D�Pe�f`:�(�U< ܻ����x{�Ř5���Ȑ Ԏ#x�I)�� �&�W����5�r�����*��Y�\����'���S%݄�.�ʀTR2r������������/ ��$#��0�<U�f@onT'N)e�GH��PW������q�).�~]�}㟗 ��ڊ9��HB�������&��?X��"]T�o��_�r��%�}��Dc�����S5�ps^����?q���y�Q�:����ſ�����}=���gܩ�ߤ���1��9k'���y��سE Wvb�,��&~Q��|b$_a�?ʬ�m���ގ��'7u��!` ���D���H��A,k��^�`Դ�j�$X7I�+���J�Cٞ��ep���i��:����%t=ۃ�G�=H�6+��W�CvB��c�+�;�oh��4D�p���\��ɲ�I���_����ki'=��Y�1����*�f6����tZ (�{5vIȁ� ����FGΛ9r���!����R��
Behavioral task
behavioral1
Sample
8e8253b00b3bf665504f046f028cda5115576d7dd646103c5dc73d7bff734ca8N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8e8253b00b3bf665504f046f028cda5115576d7dd646103c5dc73d7bff734ca8N.exe
Resource
win10v2004-20240910-en
General
-
Target
8e8253b00b3bf665504f046f028cda5115576d7dd646103c5dc73d7bff734ca8N
-
Size
7.9MB
-
MD5
a1713f6751616929b5d1a4a824b6db50
-
SHA1
69179fe96ebd6a2e25eac1512f6c58723fdafda2
-
SHA256
8e8253b00b3bf665504f046f028cda5115576d7dd646103c5dc73d7bff734ca8
-
SHA512
09ada079586a6d443385be288266f6e9c223505be4bec514b4e0ab2b09d06b671d1dc9a63456be10430e5f3823a7d5bd3eef2f379a22595d72de9a9108f2640b
-
SSDEEP
196608:U2wKpv1WpzayCg7X7mIn0RhXiQI2cjE8SxCc:gKp9cHL7rmInEXfqjEBxb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e8253b00b3bf665504f046f028cda5115576d7dd646103c5dc73d7bff734ca8N
Files
-
8e8253b00b3bf665504f046f028cda5115576d7dd646103c5dc73d7bff734ca8N.exe windows:6 windows x64 arch:x64
cd1bfcc4b5bcfaaacc6979592aba549a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSACleanup
crypt32
CertCloseStore
kernel32
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptAcquireContextW
api-ms-win-crt-convert-l1-1-0
_strtod_l
api-ms-win-crt-filesystem-l1-1-0
_access_s
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-private-l1-1-0
memchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
_isctype_l
api-ms-win-crt-time-l1-1-0
__daylight
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-multibyte-l1-1-0
_mbtowc_l
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-environment-l1-1-0
__p__environ
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 422B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ