/a��Կ���>^D���F������b�e��g��.�r�j���5jޚl�8����;�DÚ�Ȉ�.�^�����uW�L2��q�atH�k�_�+�o7�d�1п�OH�^b2�H;%ʋU��4gZ裵�wܠSh�^y���2�1<U�<������ھ:=���E�u�[�Vr9�`Bqآh�-�Et�A��V��!`�`�#��ӑ�U�bwӺ��6�{q�gܠll�P�#���-�����s�J�e����ҡ���n/lP���>g7��4=k�9 *w1�J�g��6���lj[/Ь�Y���&k�qЦ���~0al�r���s��-��g�$��C���_g���Jԇ�����é]����}�h=��C^�����&bΚ�$����x�y�q���r�H�D�sR�����N̈����_5��6^��=-d� ���l�A�L|��1f�\L�y:�"��!-:��"�����L]gl)A�N�*��Q��f,%x0�uWt%�k�>a������m%��R;�ÌKk5L��*�I�{��m��i�T�*�����m�.tܝ7&��ʭ�f����\�C�9'@_P&<���)'���1^��<j�h!��A��;G5䒞�:���|�(�P#<��-�_YR�L�������ć����ɍ),O U���2K��C]�葠�!�� ����J��}���a�T���f���v���"���7|�jOӽ1,��ܬ�{��A01u1��@8�g�_n�.���,�A��~5�B�1�}(I��]^_����2 ��O#��Оs��������#�|��e?P>Vb)&9��%L� ��:y8ر>-ƢK?�q`~�;q���b�[���up5*bHP� �UO,��պ�#�Ƀ�M����-!Ոx���YS'r�j��E���l��t�����ᗊ�xbGmq�ɧO�.�@����F��.A�0�N������Y`*1(7��kD����4��oɣ��AO��\@N�y)�]��7)�嵹�#�@��f_}��BUq�2u�F+L��+pua|����x�[~W_����U�m��� j����b/�M��ύ�ndZ�ѶVЁ�Nb�|g$�qs��a�� �glz`���1s>FM���p�K�+��能g�1�j�g�m�,��*�s��,Jep��^:�����$��ی^l���m�Z7'�,�if��Ods{�������u2�b��\'º����:YQ���M���@fqk5�>�����q�W���UN���$��ǫ>an�@���K���7Ӗq���$�'.Q��\�l0ޙ-+��4^g_����8���[}��$R�u����W�Pw���"���E�h;���Y"t�%i����{��j�l�c>J��Fk���V�ms�(c{��'�<���5?��uB�a����"/�w�!��w�J2 �G�����6�V��/�@h�R����B.���i�k����%=#������K�`BRm���{����}3����rw�7���5t��T�&���X~iv�1]fԞ��V2��'�df'.`S C��.n��7�,;����{���2�b�n!+�"���u���x���"� @��"���_���g1l(�=#pa>�P�v��-�8xRAH({PW�R^>����B@ɩ�g���eS���H�%�[�O�!"B������hϸNW��j@X[����w\i�s����"ԥ6i��Lxb0J&�E��\q뻅`>�̧�aH`y�C�D+X&�����O��w�qH���R�j7A���@P�� ��H�G]g�鏲q� |c6��8��������e7q�D,e_B�<cۧ}� ��k\6vR���^�XK1��<^�������+|��トR�1��%�I3y��d|�rS?�q���Hl�C���?�Eh�<:(��9c����_J*���8jYj��K���=q7�E?Pl �g���Tr}�z*�ҳ1���#�~?�y�`n�7sd��`� a6脃ZW�'\$2� !E�,��]"��H�W-m��h� $U��{9Z�k�܋�v�-���}�a�>�M���Ԁ�.�M�N�qL�D���io�)������wZW���K�e�|��8�m0�EF�":+:7�j��|g�Ԅ��s$��8�b�96���wJ�7S��i��Aa����y|�e�����r�E �9V��'SΙ��g�c;չ|�.���ƨ�g��q��" .��T���r�拵Lst����2Ј��wby����`�)�\�e���p�p��^�9�F�#��Le���ԾD��ޠ�5���ъJ��Ќ�S���G�)�Lk�>��� �+��&�V��|�R�L��x�l�Z�qS��F��l���d�u`���XI�'+ռ����k5GQ��8����F�X�i�Z��E�6����IHU��V6g�@�I)�9�����2��76Pe�b�����ҚF�<���Ǽ���+RN7����"#�̩;w���N>;Y�^��&:�f�5�"+-������f�� S����w�� ��gR؝䨿 ���D�T��aP�a�v"&U^�5�rZ��me@��s0����y3Pӵ^m^��Ƚoeq��s����pЄ�؆��5]H�-�&pU��Kt�{1 &��_��ƎK]��[P�QC[b�H���:���ķ�^�F������]��9[X����*�����L4Tk�-����&�~�V�H�|�� l�I�dv"�&��P�zbu�����D�Y4n� ��/n� �4p��X.��4.���vLc���(,Y�oY�[�}���49J�������yeA��=�����b�nȏf��ؑ�k�T� �CT��n��}��9Vw%9oI��:���}�� `) s��lt� �I��G�a���`���Ȁ�����x��NCІ���A ���� ��^���!�-%��ߙ���7챳uh�So�[�N����=e9/��-�p�7s-�m��/��&����ɤ���mp�"�rOX���S60���@���^!EF���A�V�H.U�h�.�;� �Ͼ�F�63�b�:�_���]q���mKo5��7
Behavioral task
behavioral1
Sample
c04c95771f7c00b18866a6edb8acb660dac40f092a3ee5cd278aedd445b04171N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c04c95771f7c00b18866a6edb8acb660dac40f092a3ee5cd278aedd445b04171N.exe
Resource
win10v2004-20241007-en
General
-
Target
c04c95771f7c00b18866a6edb8acb660dac40f092a3ee5cd278aedd445b04171N
-
Size
5.4MB
-
MD5
758d5d87dc4cd1f7277aa9a71af42c50
-
SHA1
fa514aacb404cbf82a3f5914a1b59bf5b81722f1
-
SHA256
c04c95771f7c00b18866a6edb8acb660dac40f092a3ee5cd278aedd445b04171
-
SHA512
dbe60f014c6130f9729762d07f9b25f425c8ad4f7d6081eb1d333facd5794d3e5843fdc24a87c36b152f947b44e90c4c18c1649377a27f9af36a2d0b54153e18
-
SSDEEP
98304:5DHr9hWGTgAGoy8bRtULMlU0L6sVjbZh0cWINN9BJoUrVJYBM:5TNO8bRWLrGnVjn0creUro
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c04c95771f7c00b18866a6edb8acb660dac40f092a3ee5cd278aedd445b04171N
Files
-
c04c95771f7c00b18866a6edb8acb660dac40f092a3ee5cd278aedd445b04171N.exe windows:5 windows x64 arch:x64
5b69f30798c8575d83bfc5ec6a3b01de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCommandLineW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
ConvertSidToStringSidW
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ