��s+(� �7E���(�?�ҨSj�p`~��Tٗ�'� ��V��_o� X~��� (�*�������ʈ�_Okc4�$Ii<��� S��;5���������p�/ PͫT����X��?x� ��h7QE^ӑ�w�X���y�f�+Q���;���������-`�F�F��Z��,'�.��hO(�aIL����rk�)Q��Ac�߁����`��N�1��d$A2���Fyٙ���hOPͭ���Pqo������7ãK����+�Å`�-�tP�3k#�5�'� �-�2��L�T!N��W�w�mÇ���ɟ��'\���C�c�:%j�s2�t����=YU��A����zw��,��Ҟ�b���k�I|�Mh�� Fh�*�M�HL��+�H���Q ��U_%��;�wI�' ?r�!�1��^irA�l{��[�cV��HF�+�x��椰�a��c1�H��.�c!����@O�bC�x��;>��8m���w�#0r��s�����k������w����q�Mo^X�������bi���6��@?��M7�8trIbA彆&v���r9�T����C^@e��B��k�/��D�oe�^O\��&�W��������0c9�����6�O^m� ^%l��E����I��b����Y)���q�H�i�&Ӌ����6�����B�A>o)���G���"n�j�������NY�:}%FV7?p[T���h� -n��YK<W1���K���߰��!��۹U��B���ʵf\x��=�ā�������H fD� B�YgC�'�Q3���ڵ�zs�6�sY���$J���;�:=�a�cz�]}����61�9������泎�����f%�۔��w,Az�xc�`硤o�#����'D5��W�����@ �<^������KR�S��m�����R�s x'F����yߙd�U�>2���+W��\5�m{���[4����#H-\ly�����|IЍUc��d�)����2��?�x�{6���x�~�%F��-o]�Myg��)_G�tP�����W��F,|�y��'q�����u�fl$Ö9=�`�D(���:0̌�md53��/��i%��T�"����H�a�gFi��c)�˽�g�f���D4�+i�e�>o��o(�$�t�L�L&K!�T�o �9q��},�� ����wD7���ωⓞ���"B����9�+hsr�}-�f]�L TOf�U�g��|T�Y� b�NF�3��z�!��VG����*at!G���2���d�_e�x������� ��*�Q�H ���hURc_Wuk��eH��G�4��ʧ��fE��E�,��e�Kc��u��mϺ����a-uYv~p�M�k�/��67^��]Ŧ��0�&�+�c���v���[�z����k�b\�����l��C��i�)����kVƌ���tZ�Yk"�A#��{�q����j~OYt3��t��˓��˓x�r�TH�]�,6W+lLqO�c:���c�t��+��v4=?��N��)B=��NF@>s~P�W2~˹}�8���3%90+�I&c3i�JzG/���T���K��8�c?+�;wx��岭*�;�%��e5�< ��eYG���;�\�F:�{�1@G�?Q>�;��vwd�P�6�{]�����`���_��F&���s��ej�b��� M܊L����{ �vK�ec�[/[bs<Y�^��[��<�hW��T��x�{��%�x�\ ��o�-�[q��ʽ`C�)vLW�� EǎfG��S�]Ն��=�?��4���5�I�t��?X���S\W,~��M��!I�ς��ka^f/ڊN��Ϣ����p��aM�؝F�]���S*Wu;��^&U� 9�eC��h��7���,�pr����I��� �l�AEf��B����'^�H�|o��2&�M`J\ێ�H��`�L����R�����ڛqHI8���߿����o�htzd� ���,��v�,� ;�[]��Zg�=N�*B�|��3��@�%Դ�B7�&W���+�G��`���=�p���r$���������AZ��vW�"�u������{�_��]�~F�����,��=[��ogu�i�`�E]"����Dxσ����ᒂ�,��P���@�����,�B h����B�R���� tI++,����D�v����w��@�"����[ml�ゞܶP�����ڜ�����'ߒu蟣ڀ����] ���M�H���X��\f�%�@�������B�,������֛VU���,_�d��i��$��G�t;8�o��κ��Do��y��G��g��"��s�F��Y��+�BWt+0r[�|�����xT\x� RHLKDv�6�D]�\P��iO\�^�ʱZtM���=�G����X e�(,��x'MWjh1�D��"�{D�,%1ȣqX� ����A,k)� �d��G@/`O{��ۚ���^�.���4 �������Zpz��q-D#K(x�b^!N�rQ?�t&�^�Y�����#7Ï6K�ȣ�];�\�,��[s�oh�Ѵ߿����$�NB���D�pq��� ~R*���iãg �F��(?*���@�(�8*���FO�O��A�a�>f���"��R`���K���1�Yxq]9%���];�V��KE�[Gi�p��C��h��I������]f� �� ���T����6��D������l�#�ش��lG�wo���=�<X�AO��-�Ѥ�\�e�o ��˰#������ L~�O��$ _X���OY�v�� �C�G՞,>4�M��xn�`���H����/Vz�A�R�.�Y�5�T"�*�n���1;�[�f����b�+ĝ�]���|��j�H�nSsKjW��Mf!�����aN3�K����a�g-�����(�5�V���ya�'���]��֟h�1,�D̤�O]$UW����Yw���4�l�&�k->�?�3����9X���1!��DZ��� �}Uƛ��!K }(��%`��>� <�a���L��r�_N^^�����hcD�g�a
Behavioral task
behavioral1
Sample
matcha.VMPDump2.exe
Resource
win10ltsc2021-20241023-en
General
-
Target
matcha.VMPDump2.exe
-
Size
14.4MB
-
MD5
5aa1a6295148f5907352fb953fc32974
-
SHA1
822b2552db01bee512cd8d790702c3cbc347e326
-
SHA256
be2750acd7bf2354e044d389815a4c0bc919c58f97105b11ab8a8db98ca93720
-
SHA512
46a89c381dff3ce6adc88a7bc80248ac935b3c4bd4d4ae743c19f61d89bb38dff9e71e274db1edc97e5cb819b22dfae2a70c1e29bf5db28c115722fd1e49740a
-
SSDEEP
196608:5ygp0+URy+moy5x1VVa8/+8QouVKYBS1v/PlH0w3RcpAEtaxku2R/:5ygmD5WxuHzVSv/POwBmzcyu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource matcha.VMPDump2.exe
Files
-
matcha.VMPDump2.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 376KB - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmpdmp Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ