�Ǯ�U=NԒ�ȼ<Vv��8fԄ�>�:�>���-�6s���[xO�ƿ3��U|��}ٸ�徐:�.ԅ�P�J�+b��i���P=���۬��+=o�B�ۊa ā2����~�^�5����z:����@��~��^rz��j����_������w��\������922`R/�{@]Q��6�R���7�Y���Y+�_l�L#����&�ѷBp>�^>%X]�`%�Y�� %E�����=��i�.�6疘(�S G�����% VM'�rN����X�$�ܪB#Jj�� �L�ӞNS�\���/��m��{N�؇����6��ʌ�-�v�R��ÿFբf��l22^!�$+�RՅ˯y��&�d�a�B��!���wJ���eU�@J��A����.��|ڵ4�)P\��k\�B>�>@�yYP�B_Lp��α]<�9��뇤��� �r��L���*#�#����%�Pf���(��P�Й�Վ�R��Jܢ���# ������a�D_�>b�H@��ݛ��*���k��v���5 D�CT�L�P0*m�5t�vHuK.�\�1?�=��,��U�GO�6դ�.� 6����F��W��U��B�Y�LMl�5Tt`�u���?9�X�\9=�Vm0��?�F�|ɒ�yeoG��M ��b;�c���l�sTtP'H�����K[Y���>�~i�Yfu1b���Tt�jV�%�(E4��uq�D���6jR�J��� ���"T��hr�ܡ-�l���"�T��W@����Ҟ�S��xy>����j_z,�\�3"YZ������d��4���&�~?`����h��r��w����ҿ�(l�c�~3�GLJ����iL|�o2��f�Kl⧏f�<W��rT�v4�U���AS��ox���)ń�>\u� �\���̾�2�F��*��Z��]�i��M��}�TFH��|֠J�>���52�Fz�Z�E/�/U-f]�0��|���A ��ە �*C�g�O`���iFТ-�����bd��-�Ά�{����7^��Z��� %z��aHI�^g��D�����/��.PMu��nt[dڣ�e�=�g)�o$�����k`'�����2�J2���yF߰Cu��];m�� �hB�G��븤 C�&�d��{W&�+O�j���1S��� P3� �b�1ZC$"=�k� (���^���#�X��z�!�$�-f��=T�`eP2&5\a�#�9�һ 22��(IzBU?�;�,44�@N5ܚ��#�&g�FS���3.t��_a�܅?�b#�qGH<N� A4e�G�%E~��m�¼���?ڳ!G൲Y$P��i�ծg���is�����3�m��ΣM���)����7�H�2�8�2��R��n��1��� �:ϸ\��>ΈKm����О��������f�,��|i���7����I���!��]�\@�Ǩ���n� ��e�b|�jPW��܌���ü�_*�P��72���/��f��l_?P�����]~J�7��^������Y�Z�J�ш��>�EsУ?��V����mQ1��o�:�F ��YWH�B��G@H��) �j5�s7��q&[ yF[T�d��"��ι��# P(}^~iQ: �-��/)?���Y�a���^9�����y�����G@^c��9� ��lt]��O~}%"�{\���@��q��V�}�sQ̌�c!$>��۲�f�O��.�ب�mrPY赡Z0��@���00TOy�F������R[p̜�Í�'�.$���0M� ��@�N �R�>A�)��d�u����㔴�8��D��G���[ez�ɳ� �o�Z��`��5�_�.Ƚ�3���Bn��k�;�hI���&��r��wu�պI<I{q�R����`�˾�����8rW�S�}��j8k�j8Y���#��P�5L)�5�m�WLha�Ȼf��"�[�t���RJ����.a�[Կ���yž`-iR�!bg�lQ|-di��&]?"4��s���"���*��t���)���k(+.�_����^f�d�7V�����QOa�v�ʛ����I�<��-��F���i�RЀˎt �f��4HWН��fx��s�7�� ����%g�*���2�SZ�V�m��2���3��E��]^�E�������j�b��᳒��y���*5U��S�Lv�����[��IX��h�� v��8�h��h���S���`Y_�o� ���y���� ���,����v�� ��hP0���2���(=����t��� �ϕ���D��������M����-H8N&�`��G¾�����Lc������Q��y�$5j�Ƴ\�����������,Ö�s�;Yuc�f��Q�����# �_i���A"�����2���x&��?��"8A�~\P�^�?� !��������A:t�%UPM���LU���3�q��%���ܓ�IZ���'M��m�[���T�4w�� K����n*'���=�#� ����<iŔ�W��F��3% ҕ�vA-���̗��?d�u��D� P��м�I�O[�x��V�3�\ߦ��@��A���T�OW��@6�����^���if�Q�L�$��=gG(i���Ѣ���}�D�="�j|���5 �� ����S���}�Ǐk".P�<��+D��T���sA�#��@ ˒��U�L�\7D:����o�F>�� WD�q_�K�E�`+�s�dX�D��G������HJ �].J>y���[}?'�,�_(r6Y;��9�����9%Y���*J��d^*�N���P����� �)Wq�T_�z��r+f$<*!����u��$�, F1��ou�h��oz5I.�x:PW�6��}n�X���k��"(0�'[���,���RB�3�H��3Y*@+F�C&���_��D��b��$ΠB6R��QN��{K�`���1��=�fm��7�~� H��9��Ö{#��O�����tN� d��?�j�����οɥ?M�uϰ�F��k�v��h;���013;f p�<�����_�����B�)%���%p��?D�� W
General
-
Target
ahk.vmp.exe
-
Size
6.1MB
-
MD5
4d6c95c9191f22ae69df8c36b5e83484
-
SHA1
6703628bda4beaeedc09946b3c38cba9f68d2d07
-
SHA256
fa1aeb8484a3d7db1abbcd336ee44785140926c06a9ced6ef91817121885b7e4
-
SHA512
aa3cb4a677f34daa02a0a2c8e76a429f254a04e9e6a83a07582f229d001b9a387735b836d85127fb3a50425f84e10637d1e13e4a0453313bc8c7be32e3e142d1
-
SSDEEP
98304:6lXP/oi4kaxb+O39VJVABLECjeLZuSjaWj4EiuTtkkuA+2tHtj5yR:Mno9/bJ39/mBYCjMagNXzlrVy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ahk.vmp.exe
Files
-
ahk.vmp.exe.exe windows:5 windows x64 arch:x64
50da240f1b9f63a6025e7ed0d223d358
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
gethostbyname
winmm
mixerGetLineInfoW
version
GetFileVersionInfoW
comctl32
ImageList_Create
psapi
GetProcessImageFileNameW
wininet
InternetOpenW
kernel32
GetVersionExW
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDlgItem
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetPixel
comdlg32
CommDlgExtendedError
advapi32
RegDeleteKeyW
shell32
DragQueryPoint
ole32
OleInitialize
oleaut32
SafeArrayGetLBound
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 888KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ