��G7��U�U�oȩ0\Q�s�����٦�z�Y����jSu�����ia�b��X��.O�����3���i�С�,8�@���_����2[?O��^�W$�� Iz �4(�ש�:��+1�F���c�z%uCR�S˫�0 &�)��%ìUfC��V�&�J�,w�%~S�8#�0� �'�8���'��h�рv�*h c��"4��7Y��W'A3�A� b��������������YWl���:�u�<��5b�!� (P��A�z ����b�a��������=��n;�Q�>�Z��ނs���Վ�R�5_AN�Q��|��fhTqC̟��%=_�z�F)�d�C��s2Bְ��K��n�D}���n��H�[�8��Lk�HwLܝ��)�����#x������Ƀ��;��Z��D���De��u��_m�����*��f�' ;��;�a� >� ������2�qj-9V64�q��kE��AԖ����^.��x)�F�������a�(b�c��mEl]���_�V�=�u����Q����[�t�8g�\��Τ,�5���,3�?�+�;<��Sw���ح�t֨\C㸬��\��, �A�%�3��+����3�6k�jU�{�7���]"�|��k(0z�Z��H!K�5�����ln��cW�/�� j���"Av�^! UW� ����xݭ��� ��d����yF5��0Vd4�54i�/���A-���p<9Ry�4�b@������S������5�� Dn_q'��E��n�nT[������i�0앒�B!�����G���AE4�w|�]`S �}8��b���R櫝��2v�/�h���ֻN$�/+T.Z�;# cGG��'*g&�V��f�����l�+��V� [s�8m��0����i%G�}��9 3�e"���@QsV=�J#xH;�ӯ�8��*!��m�#x�2��?�ΡO\"� �������o���5� ���p�zwU�f'�k�Rb��/�~WB��hEm�o��˓�$(�k��r�Y��5�o �)�� �>�l'��Q<\�O�<�0���]��h�V��tg߄)fO�ڽ9�!�DU�oa��+a.�o�a��y��Az���I>ti=Dx�<5����̨� �z�D��MVM��6�m��9�c���?����V��v�K��yˮ d/���������PE��������~�]�^FΘbs����29s�!��fo����pmՕp�����bH�Si���q��[���6f�89�4��C M }�0��!�PgT*��$xvZ�V�� ��a���M2�j���̼:�B�� ���H.�ȟ0c�s����e������.�C�>�h���N���"�8�����b�q�� :��|L["�h�V��@�ВN���ϟ���`w�$���Иp��p&�4 &����K} 0��@��+�ۏLIC)�6������.��o&9C��?-^�Ώ&4<��~�b�����o[I�D�f�n��0s ������%-��1�M����@L��+ے2��#k{^H������6�TGRդ���?O]qߥ�XVŋ�G�]���f�.�:��r�nx�9�z3��P�: G���)4슖T��8�/�S���e��v�п �{\���,A��ʹ���FGE9���Y��Fp�� ��Pg��!M+�M#����:�*�xgxc�����@P5i�����he���>�AM�G�����c������:-k�B _?���?9��B3��ܓɔ'-h��ZF<?�x8��T�9G�~����%�DZ!Џ��-����&��!�'���<]��:EL�����zH�kq�����4�I#�tH��^a��B���k�f����w�.d�G=[Oo!��;���V����2b�ej�n>��RW�_Nѓ�1e�&][��+�x$�Ҕ�_�'˵Sx9#�:��� � "�G�q(�$}���PeSl�v�J�F� ��dR\�Nτ���M��+�xOΠ����C6�7>&U��_�B���9�$�Y�]M��M���S�s��h�25�,d<�.x�-"~�X��]��Y2I����B��w��z�y����"��c��v��}Αl\����ik��(��C���v��u����j ���K�1�Ո���mC�'�� �v��;8~A�� ��Ӑa��$ud�"��+�b^�1���y����|�OD�|GlE$<<t8�:i�x��A�n��q]T&#ݹ^o�D�dw)��x��;(w6G�;���>��e�e�����Q�,C&Qb6�W�ɳ��&�CChfW�;�$9��d�5���#�E<u��R�9-�E�WDE�gq�$� �vLI��{���>q�[&�{f�Pe��������[T�_�<�!�)w'w���bc��sͦB�~������2��6��)� ��E�Q��7�!_�yS#+��:�E�w���^3�v���l�4_�Ћ�O �-E�����>_ɿ$�l�0蕢*��9�p�VM���:@�0F=E��V&��IxM�!���1�4�c7�9�Κ���y�-"P��6u�#P'Dz�0[�@��W9>��(�p�u�'����� �;�_����bg7��5[6Å�'c�Hⶰ�r�ƹ��-�dG��ĄiͮΞv�Aʹ!���j�P��0�G��n��*�9��������p�%ϝ�HJu���eG6�jL���&ȾN��;�$ML��x2�քJ�e�?}���WO�!J�4�f~���w�Ց��0l���kx�s����xPr�Z0��|�f�6�*/��uER������֫Dh̞��I� ��k\��W�7bc2���`Y:�W�j�s6X�$o��_����S����ӣ��5}35�;��R������z�g�ikѤ����� �dޝ�v�����B����1� D"0�?��8�����+�+�<.��G���r���p �k��6#��c���O�*�ۗ�6�E�r���ɺ=��CvT4Gܹt��a�c��L��V��Jn��-�Y����4�^jR�e�k�EE�|D,�����P����xz{�\�硭���{�T�UKS)��"�I�~��r�O���
Behavioral task
behavioral1
Sample
1d1d1ff0fad44dc65b379cd3341f9efa5ad58ff7521a423e60b9c1ddeaed0828.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1d1d1ff0fad44dc65b379cd3341f9efa5ad58ff7521a423e60b9c1ddeaed0828.dll
Resource
win10v2004-20241007-en
General
-
Target
1d1d1ff0fad44dc65b379cd3341f9efa5ad58ff7521a423e60b9c1ddeaed0828.exe
-
Size
5.2MB
-
MD5
fa5c9f0290aba236b093449f311689b4
-
SHA1
cdd39b77cd1873d8a31c0666700ca0f42baae0ee
-
SHA256
1d1d1ff0fad44dc65b379cd3341f9efa5ad58ff7521a423e60b9c1ddeaed0828
-
SHA512
211e96c2fd5e6f9d22e82103dfff00504f3341f3a90b3bcafacc6df069ae7248ec9ee994201ab659064229b0c75495dd033ef75b5a226132adab4e6fd30094a1
-
SSDEEP
98304:f6eil+iU8BizwGeqLXtiM/gG9oY5EQVXGFm2Ma+l9ghC/eiQ4z:fClWAuwYXoM39XzVXOmI+/Vm94z
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d1d1ff0fad44dc65b379cd3341f9efa5ad58ff7521a423e60b9c1ddeaed0828.exe
Files
-
1d1d1ff0fad44dc65b379cd3341f9efa5ad58ff7521a423e60b9c1ddeaed0828.exe.dll windows:6 windows x64 arch:x64
d52a26f620bbe930bea7810448649484
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
WinExec
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteW
ole32
CoTaskMemFree
winmm
timeGetTime
msvcp140
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
winhttp
WinHttpQueryDataAvailable
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
strtof
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
roundf
advapi32
RegQueryValueExW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 675KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ