,y�nm��� �v4�G��0��62�4��k��Ğ0�&�Z,�R��9�a���Z�i:w�-G�UF ��]�� �Jڰf���aS}� �^���>��!|z0�~��%:����n��k���Z��즐��>����DNPuցfL]�Ւ��m� �&�/,&��/�,������� ���P��4��"0���l��Uw�ݰ( ���-����~Ƅ8�v��q���ꜞ��>g�lFL���t��e*�/&�M=i*����*]�D=[&��4'�%2-���j�oIG�Cخ(N9y$�AT���p��Ck����4H�:N]�8��G�����W��Rg����V��۔|B0;�X3��"�e,,���J��I�s�X|�70�!��3��]��埬��e@�7��iz�g�o��������ۛ7z�U�塚H4�l2�M�% ������;rʚ'���`R�^9��2XS��"��������؋ڿ�#@�W�}��P)0<w���"�$ƨԘx��{�Uaў+q��Xᙠ�nGf���J���_NKX:�}��4={u���̆�>��o����-f�*04��&�V$�r�lo:�78V�m�RUEߔ���� W��I���jd���vO֣�[;3�Qqe�E=�`��$��92"���FQr� <��Zz ��\0s�I�.��6mA*�9Fm��i ���r~{��9>��?��� ��&���/ǥ���$��|Q��d[L(�d�X�W����M�?{Ƴ.�3A��ƃ��%;��^L�oG����ʘX��@�^���m��;�X��W��R���w�h�#�V��A˶�@5e�����;���� F$.���ic}~jPr�Q^��"x�cī��o�/�ʆHM(�8ϔ��P�aC<�>18N��R��¦b/eY#���X�ߛn��gea�.�"k_�c��1�5Ɖ��P�Sh|=%�3�![��֦p��)��5� �b������/� 5���vö3G�����Z��������iWZD��O����c|���Yn%R�U����t6G��UEW@�_]\^�����$��tw�+���n��A\��E�х7h���V���@�k����>���u1U��Om4 ���vg�@��tod`~�{�^��k[ۙ@nV�jX�[�a4{joJ��tblo~\���YIx�wm<��f�ڬ4�4����!�jY��%�9%qD1N� U��_V��: ��b�$�"٪7ښ�������)��(��a�ts�k��\���;{R�7IT�a� 2`�#�eׄZݶ]j(�>��d�rq������Pޚ=�/�i�p��p�F��h��g���^W���+4ѦN �����"S�� �����h@��`�z��+�x��e-W�J5�,��rZBQU�&�4�&��%3d�b:��7h���Z�i��\�r�'����һ���Tu��"���^������T{xi�D��\��� �o����d�����]�X�u�OQ��K"31��tu�9��BkB�L�ݺ���K e��0*T�7��|�[��V7DxHNf�"���A�hæB�1��/�����H��M{ទ��ddL%g���(�p������)��e�d��&`�����<�4��D�[�- ���m�������.{��> �\t�[D��*���ɂi��(��K�_�ɉ��������\�N��m���������j�ڧ���ުiOۍ�C�#|�c�q6�7��!�^�sg� ��ʌ����41:O*��� Cu�nK���hɦ�|���b���>A�h��a(J�yEe�it݅+Pa�"��L�5��:%�G���Z>j��������*�q��S�) ��ՄFLb��4D�l�O`���L�8�P��d*�v� �M~��R������u�h鎜֚Y-G� *.FXp��c��́����RG��X�^EŢ�#����ɑ�剝n�ɕZ�WQ�E�m2��i�����i�gwW�]Z @VV9��'�[@�*����~ŖNX�zp�2�ۨ�vD�ϰ�Lz���Oq������J�HY��o�������g�(A��2�0{m�]���ww`���~NZ����8�#�N��re�(ᝣQ�k�Bˁ1�|2�J|�#k<�ɋ;oY�����0���ь�[S�T*0;.�?���eu����/4���Hy"(@�5�����lR?�M>�,���5(���1�9�0�W/i[5�:��=&���F�$�a��ǖS�I˔�[�s��ʷ��e>��t.�q�"U-�����b� ��rć'���?�b4R&�o ��85�r��Z/��|�IQ)r������>�w�I�c;�@Ǽ�7��{g&�.�� ��j)x�e�h��]CE����� @���@#��6a�N����&��1ܮ]Ah!z_�~T�Q\�M�g*T"'�$��\�zԶw���m\<)�: |`�Z��}/LP�~c����̯Z��V�W��@|�<S9����6�a��6�F���@gA�2�Q"�_ܸ,�Ș� 5�x7�t���4EԾ��[Ŧ)h}.Q��QR���JČ �(#�$����J�' �M��h�}mx�G���2t :�cM#�#�Jf�t��"�Si�67��U ��I�?���< R�+a\�'0��J����m����7Q������6��!@C7�e��˻]0A��Ȩâ��q��Զ�k�Ўs�[�b��y�-��{,��rL|K�7����-`:@R���h�@X���U��t�W���ɯ� k{�����{���Aૠ Z��?0�i�ńͦ�(��!��I4�dZt:���k��.M�, k eD��`��2J� sLs��Ԇ<]*�꿽����X�>�Lj�7^���zQCf@��FF�n�,�n��<MhZm#���<���!8���}����V��[�i�N �C��/��C�"TN�u�%��2 @��%�`��(2��r\���6������mi�F��@<�A��4�7�]��#%��v�}� {`�.X��d��z�qU��k�2Q��0���V����8�=�v�T��(�� ��%�()�
Behavioral task
behavioral1
Sample
injector.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
injector.exe
Resource
win10v2004-20240802-en
General
-
Target
injector.exe
-
Size
6.0MB
-
MD5
f10df272dd530a2c2b66228e8298c8aa
-
SHA1
3ca3a924da38a3a97b73ac856d18936bf3ab1f6d
-
SHA256
72ab973813e15a1032cb46c6db2d9e0d330d894f0ea8027b62f1f9d08fd863f8
-
SHA512
6871ba6513ac4519627f4fb1c956270a340921f86a7aef1a5e94281afbe6630a9da2f5b80c62920f3a9306ad3c8e643c0639d712d01ce631dae984eb030846a5
-
SSDEEP
196608:0BLS1VPbPMZPTidz3kuc8DeVyzSqGRFMinb6Q7Gp:0YLsPwdc8CVDRFj1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource injector.exe
Files
-
injector.exe.exe windows:6 windows x64 arch:x64
b13e471f273bd3f2a33fd4ab591ffb3e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
ntdll
NtReadVirtualMemory
ws2_32
listen
mswsock
AcceptEx
wininet
InternetReadFile
vcruntime140
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
signal
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-math-l1-1-0
tan
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ