aN;WdFM � ���P���[���Ȟ�G�rN���W(�d�X5|�*��N*r6�$xb��g\��D-#���ÿU����I�/h_ٳ�8�u�X�y���^��@ZtȢ6��d��U��`�}*�}��f�#�V�7�\<�\��cBO�3�N)˶������*Vm>�(�-4+8(��D���`��l# @Ѡ{��А�̡"�������ѮrCB� �)��|[+@��-L�UM�m��H'�-�D�K�W�p0�gv�T�Y�H��)qɂ���Jn�m��\����U�Z���>*̀�~��EI+0�����Y��;ᅊ@M�� �s�?���u�E���u��B���v����!�zR��e�i����v��ndBM�Y�Koߨ�B'��F�[�����Х(�{^݁��\�>P�+�p���0��^�Ժ�J:�ʻ>�W��EV�T����+wS�'��!��)��s=�R���S�p�Q�]��/����7P[u�EՉ�^������p6h�^0�sm��>�ڳܼd͂��2�Izc��jfԩÈ������������x���6�<h�|N����Z�WJQ��g� (Fޑ4Uq�$v�י�$ ~Xt�Ǹ6� �����O96�~��(d�}��&kV��`�$D6Zuc#�>�[F�i�Q��/�5vM}���v�9�b��Z�J^>uZ�G�t�>����}C���Ĉ�D�^]㰪�K\�V�����ն�Z���$��~Y����_ ;�#I�٨geF��`�t�[z�!���U�4j���y��*��*_+3�^S��ض��u`��>bUĮ�W���Q���_ �ea�Ab��<(F�c��a0M� �;�����^��~ֳ�+�������:��!�ۼ��[Ʃ�}z ~u�1Q6!��a�Ry(U{*�!��)���8�!�>�p�����y�V���%�Rr��<��0�����=� �|V3�Y;�{�-[ �yUo Ћ[���HDl-�0��4m7z��1����%c�(���P 6��uE�ĽDHw�u���e\���]ń��A���7�ì�nHf��C���k���$\;�s��G9cC����#+ޓ1�1��2���ʯ�r5��<��pk<x,-I`h�й:қ1����v�~W��c��Q�f:V�mG�X�Q�4_$�PBZ�����-���-�jgh�P߷-��#T�l��!���Qm�:}C�?-���R�A`B�0c�^�*i��ɨ�(�-�)�w�C��<����CAe�`�Jg{��9����h�A���[O2$1xvz�4;��q ����yE�����$ͭ,�X�)���)���q�E�a&����=��s���ސ�@����EOu(�w&�^;U��]gu����9��iT�d'��GS���Odւ4�L�7`���zh��� lt ��߅P�/��9T�]��i�n F�?-q>+�.���P)N".��r���/3�5��� �S���n�]`쵾=fW�0�5:� �W9⎍�q7���o�J����R�l�'�-�*\����5Xz����A@�e0bL-z�3�;�*wODட��{M���R|?��z��D��SY�l����X��'� ��v�������qN�B��폀�E<a`���4K�kE&�QU\��o}��Ku�oj��2�JE�5z�i��%`K�-�U �,N�_p��@��'���CxqZ8�����,�x�XY��ܠ��1<q�ِl� �ˎ\<\�����L�'�C���#fμ<t?Պ.8�۫e�S��ZR��^ApI�֦��CIg��2�?g�- 3����`�u��;W�H��g������9��E��L�s� �/cW>l7作ʕY�ŷ^�W�"��ଳ|�I��o`<H��Ws,��YϨOZ>%s�5r&֕��K#�}M�ѿ�KX�<��k=�=I ���������5�3���Q�_Ek� �n�e�r�:o�=(pկ�]�}i .a�T~)X�LS�|qůZ��'��6�CČ��R������[�0��A�1�E!�*�Ҁr�ΌVsZ��D[*$��G'? (��0�� ��u1�������c�.�0������&��C!�� 6���kA�' ї�}���J� �:^����x�W}�#X�����������������}���f��K"On��H) �ϴ����|n�e�"�j������Dn���N!�o�I�]����^�M��bu������>��Tw㎪�*���<��q8{�'U��Y�Ep�}+h �Q�V�ljy2G�x�Yjb0�#�D�ΆB�0V71b�����2.j�b}t��-Z0��o�?j"75fj�k���(SYg�.D��"\&J��P��6u\��N��)t9`���̯�~��Q[�L� � E?V�1�$7�'Nep2���nk�X�/���3�Z ~�J�j�r�Zy vc)�*�{vM}܈tY�+ϖvN�k.�r�o�Њ��������I����P�v�%����� gO�-���<��K�2�r.����#Aq����Tdw�n���e�|������kz#� N�M���Jҟ;����f�Ɵ�k��bZ�����=�Is��|6��&�4�^��ؿ���+�%G��n-O�1�21�H�t�<��O��Oz�=�n���/[d)�eK�y�E��薊�y6��ocߢ5�j?g��X�`B,KeE*�����a��B����Ơ���s� $N�z�e�<6}�3��k��p�%��L(�K_���������BɺaH������5��ZTr>��(��F#�{}ڒQ�� �B���m�_2���n�O��9�f��q��\{������n�����/�'��M�_T�D�̸Q#t *_�e�dTM��tyo��7�q{�tQ�@�Jpؘ���!��pSM�lЯz���{9`\)-�g(y����0�~��n 9��)_���rċ�����w�i 2�R�r�1��ϗ[1��w��ߙ����(i�\�i;�5�M�Zk������^7�NM�'$��ná��/q�� ,>,fv�x�����d�1��
Behavioral task
behavioral1
Sample
gay.vmp.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
gay.vmp.exe
Resource
win10v2004-20250217-en
General
-
Target
gay.vmp.exe
-
Size
5.4MB
-
MD5
2d1fd41cbc1769d934cb3093e6f8063a
-
SHA1
72de3c4a9969415fcd973e6d9a4b0b19d892f4f2
-
SHA256
88d4d2554bb064ad0db74fd3fb97bff1325dbe751e4d21bda0ffc3d0bf5e3cd2
-
SHA512
636a62e8ee870bd6b076961f4d97db7eb8a3ece57d60cfbe2a65a0ece084d9157b8c985fba014d1dbfbc7d2bcebecdc58f9cbc9e1f8ca0c3a6c5592a8e7f23f5
-
SSDEEP
98304:2l2uqawox97EzdtHtaU6ZJi0RueilG11U0xDYxFUPFUJh610:2l2uqawESdtHtt6Z9Y811UX+P5C
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gay.vmp.exe
Files
-
gay.vmp.exe.exe windows:5 windows x86 arch:x86
22a451d0afdfba86b387010a05af30a2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
GetErrorInfo
SafeArrayPtrOfIndex
advapi32
RegQueryValueExA
RegSetValueExA
StartServiceA
user32
GetKeyboardType
CreateWindowExA
EnumDisplayMonitors
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
kernel32
GetACP
TlsSetValue
GetVersionExA
GetVersion
Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
UnrealizeObject
version
VerQueryValueA
wsock32
__WSAFDIsSet
ole32
CoTaskMemFree
CoTaskMemFree
shell32
ShellExecuteExA
SHGetSpecialFolderLocation
SHEmptyRecycleBinA
urlmon
URLDownloadToFileA
comctl32
_TrackMouseEvent
wininet
InternetReadFile
winmm
waveInUnprepareHeader
netapi32
Netbios
NetApiBufferFree
gdiplus
GdipGetImageEncoders
msacm32
acmStreamUnprepareHeader
ntdll
NtQuerySystemInformation
NtUnmapViewOfSection
ws2_32
WSAIoctl
shfolder
SHGetFolderPathA
avicap32
capGetDriverDescriptionA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 570KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 37KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ