���_����焿z�'2�Wp|]��Z���$�'����l�2��k?,l$^�}�5��2��k�����p���w�f��u�d��մȤ����v@�-&�j�&@��tΑ��3����Gx��B�喈�qj��#�.��O�;iZ1�F~x��o**�]N�2r�B���L��ӈ+��"����T+~O]$���1,��J�����-d��{��ST�Hܣ��>�oK��Hh�K��PoW��"�'��O�����D�w��� ��k��?�2���j�h+ct��vg'�|#P�6b~={dB�������7��[��>���k�q� ��P�d�tY����,��?Q�b��_�ѷ� ~<�� ���)pߧ%8����`8T�o��������Pw$@���+� I�R���[�C�a�����>���5����D��^L�u�|�R\;XU�W�'!��҄�n9�������@���O�����2�Cu�ԋƦ���Qg+�{O��|�g���v�I�� ��������ދ��1�^x�-������1��@%HU�Cplש ����C��4TdA�V���t��Ku���RA�f��nC�q��D�����4zX�k�7:�G�����$Y'�[V'^CDќ�Z"z';���#{OrKɅ��Q_*(\�%��m ͤ�6tĆ�}S�i%��h�V��Z�9�R��[�[y�%��8�,�h�~�D�Z�����4r�܆�Dt�n��Gd���l�kD��C&�{�)0i�J�0+�R�V��0�_ ����2=k�Y'�.���[� M:[_.&�a?D떠M��J����6$������ˇh�� d "rfU��wwgxI�S�>��P�yg��: ���K��>�����ǫ>HqUt(����u� )D�2?��e`Qhǥ^�iiV���ÊID�L�.���� .|f���g�><��� "g�S|�����)�B�vD�#�N��G�E����>(����MX`~ؚ@Վ�ɺ�U�_���pN!��(_k/�I���{��+��e*����:|��D������g/�� 3�{�'�����v*BK�c o*�p�`�"�G��w�i-�`�f��/`bX�Ҏ1z��8�zԚ�:�@�P j�F����F�&ٱ��k#��c�vc�ɠ��^��ޅ��㋽v�f3�M�+x�u�o��@Ciǿ����[���0M��2���$2K�F�# ������cC�l�0�H��eK#���N s�ݿ�c�\O5�Q-���(G�i�k)�,yjpe�=���y/�o)��F7��"Y���ú�Zޡ*üY��" �j�E\��^S���\A�d&�R���R���l���J�[���ReN��f��c����xa{��G��*xNp�H0ȃ�O7y"��k�����3�����F��r��/��H2qZ�M���+�S� LQ-�eF6�g dm��J�Be:�+1�J�Z��n??�ҫR2A���x#��?,^�� nu�wCE�y<4���� a�����U��^�i��|���ё���m���� Jy�m� �Vv�P�4�ʃ&���VwM�t23h�h����}P�^iq+���9�[$3�b�mB~�,���U��-����X��xĄd�x��j��$/<Ϣ��P��qe!��X.Ż˗Ԇ4S�� ���[XY���5"�v��2���+R=�u��`ђ��>GA��"�v_�`ʔ<����R�<�\�J�P�����=e|,���f$N�� �b�=&O�; �جr!Q���'����z�(�M@��`z��l���şuS�춵ԍ�����}r��P�^[ȑ�q����~�zDw����͑`g��>�@>>)(E�;S���|���6_3�G�sc�~f���]��|4X ����/]g����A��������D��dh��ӹj7��u�#i�����DŽ3�l��U��y����'�i�{l�|s $,/57�Fa>�l�,�d�T֪a��JI1Z������Y�Q���� =6E��B5���>]�Y����/�k�Qq�1QxK/:\|C4I�=kh�OM�kr������ ��}����w�*~�Y8t6w�F���QpV��d�_8�Ì�,�]�ol�K�� �z~Y��R��=�<\�r1I�P��d�*X3��N��hI�4%��Ն���=9�P�0�f��O$&�v,%��2��`]#xZ��# �� �%��n4�H p(6� �DF!��x�Fj��p��B5 q(���!��o�0ᭌMd�^��T�}�Y�>�vB0�?�]�,CQ�M����,%�g��H�Ğ����=�k����Z��Z�#�y��� ���_ق��� E)�V'����ܾDN��͞����RD�� �@M�;f��>,L0{V,��x $?���v�. �z&�E��� �H$|M����3� _T+���")A�t��ܪ=�ê�=l@RS8|^O;�lF� E=���ɂZ�\1�t�������$.r6*��ש/5�u�ч|A�B]� z�e�%0Q����0W�� � �@�y���(�V��>��h�#�j�Y�8Q#Iz=�.h���gk�P9�Vi�H �@�\��Jwx_��B88��s/-�ӫ�)@��'d��?ɲ��V�5�B&���F/�"Z���O+��5 ���O �p�ZS��n.[Ê�>��u����s���n�A�Hm���b.�.����_������p�y�{ GM;��d���l��Gx@��_�pY��b]o]����7<�M�b��D��ш��4,�xE)>(|0S8H�1��j�g�g�d$�8%�E�'�w5U���R/�Q0Y��Ce��x�r)������qb��K}��`w��M"[q?ցUƆ`@a&����H�o^��w$Y݃���$v�rd}�jX����'���D6���,�iĂ+�f-��+=9�jba]G=R��-/�ۤQ�|?�������D����jؽTV4fy��Tq��p���;�{&�18��{���FvӚQ�&<���I���:>V�G9?� ����f�Q��i��0�����T�����,��9w�c�҉i���H�h����[r��$\෴R�3��ê0�8�:�È���:�=��t79X���I�gj����WD��9�gc:�4������OvfJ�y�X���pR|-P�;?9ϳR��+���u$J$�ɠ�c:M�_�b�˟e �D�x��bx�,���}zOw+'��>,zZ��Z�`�>:�ٍ�F�^�=���!2��G�%�:�����@r����g'7����Q�/��j Z��y��ڟ¡+�N�ɋ4�#�f�Z]��]/vb���'D�@�-p�o&{�`m'�%�bԸZ�K�Xh�c��;����d:����!�>�fZ�Ժ
Static task
static1
Behavioral task
behavioral1
Sample
VisionPredictor 2.3/Vision/VisionPredictor.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
VisionPredictor 2.3/Vision/VisionPredictor.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
VisionPredictor 2.3/Vision/patcher.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
VisionPredictor 2.3/Vision/patcher.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
VisionPredictor 2.3/Vision/webhost.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
VisionPredictor 2.3/Vision/webhost.exe
Resource
win10v2004-20220812-en
General
-
Target
VisionPredictor_2.3.rar
-
Size
16.8MB
-
MD5
450398f626810c8f0d37461bc4401f8f
-
SHA1
0cb3fc520958f6c1be9925f259cc432d3ea9ff44
-
SHA256
fa2e105187bb9774d344b9506fcb4d88828282393f7d26428ca2ff5e4e50a72f
-
SHA512
e911b75265424bc518ea01312bdb303da7a82f32ff8e8147c617dc9e220988c754893ef72f9724837ff073b244419acb0deb59282f0f65cbdf3bd4e76f9e5a40
-
SSDEEP
393216:2ZHA6fAVnTZZ7Tb56RIfMxR1Dw1nH9n6chZsTSxpC/Obcx:29k/v5O01nlXhmAaOG
Malware Config
Signatures
Files
-
VisionPredictor_2.3.rar.rar
-
VisionPredictor 2.3/Vision/README.txt
-
VisionPredictor 2.3/Vision/VisionPredictor.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
VisionPredictor 2.3/Vision/patcher.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 281KB - Virtual size: 928KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 11.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VisionPredictor 2.3/Vision/settings.xml
-
VisionPredictor 2.3/Vision/webhost.dll.exe windows x86
d6348b22d141747b6a0c59d7ae1fb153
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
CharUpperBuffW
msvcp140
?_Xout_of_range@std@@YAXPBD@Z
wininet
InternetOpenA
vcruntime140
memcpy
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
�N���ۉ(�9W��40��H�Q}E�{�a�ҷu=�W\7�0�`����K?���I���V������7�R���zET�5�߫8�;�,G�����U-��hlH����]fSf�X��Ђ��I��6�hJ��ݤ����G����] i��-�05o���5��Euly�t��B�t@��J����5m�g}���-0�������$Æ��H8��ф�M������n����4����L���B�E�R�`F��~�YnE�g����N�������%g!�$�*X��4h�F� ��T����4��ښ~$����j_��ց؇�(d]�������Cˤ�Ba�P��zJ 4�穠�HP�fߥ�`M��&��2,���Y�I/E�ЁX��)z�ۿ����x�t������M�`����5$�Yw���^�.����m��D�:ڒ3��{������J�(�6��|�U����1�����s��_p��J0c��h܀t(�Q���=Gˢ���P���-�o�Kj��y���:$��:�L�u\��V"^����t�\L�H5|�U��:��zɧl�A�١__�K��Bν���a�f���n����C_�%?�l������i����%C�.%}f a#h`,O��8�C�M灊=�"�g杁�c�T�������&�A}��_>I~����L�Z.���O��&�#Q1sn^�ˁ��ϲ%\wn����[|��9�������;�����������gcvo٥�YA#jϽ� � ��j@�-2�;H�Y���$v7�ƞ��s�J�t�Bzit� ��,�F0�A�W�!�ct���; �~��0�ċ� ��3�K�א�/�������`�њ٪���.:�=����5a~������ʡV�~���Vw�j%�7���5���r� ���-�B��1�Xa�q<�@�۩�<����h�y�d݇�܃�~�iN���W-�2���*ƕ�����ݻ�N�gi'��U'��Q��������Q����/P>Ƭp���DƸ�8b�b!35am�:T��x߈qȇHv)y�T����^kzg��v� ��[}L~�!�n�o� I�b,<�9�M��Р(V��j����Y�L0Pv3G xE�̆�ˑ4��6$ޘ�{�]:f��f�[J���Vu�~_ĺg{�_�T���s�4UΌ�vg��=�r.�s��BfN|K��rT>�z� o>���Y���(�F{�$(�����`.v�,J�P���N�:h�Mժ�̎\�˚�dR@�� ;�n�.�������4Nt)U��k������9Ѩe8�� �OE�w?2�+�a(H���b¼��÷��!,����;�9��"_�勵+�������������x#1���ިI�qQ����\���Y��M����������֓h��3h�{�jg��b[�X�]�E�����u<$L=�j��"�p���`Fd7�bt��I:�U)ٸ�A���{����d���uæ%F�#4Z찆��lP��QP�S<z����E}a��u36Y�x��?�����G��7�;����t}:�y�72���7C�?ֱ�����������(|7R�h������G�+����!#ֽ�?U�ET483���� ���Й�5CQ,�y9�>-�d�Zm!� .�{'9��!�5�2����x���4NRI��x�d8P+Y�}���V8��2�qdX 7t��E���o�-b��q��.�����N�� �VL"�~ �p(w{�4��h_w�Ň��a]A5X- ��S��CͰ:��q�{Z0t����}�[1��p�4��"�h��Mڞ5�<� ��k���nx��dzaD�a��O6̓�/g���Rr���<�]"�J ��^S��JV.���G_�����4N��B�>�t�q�Y�y9]������� K���K����^��V��ή��3�#�N�`*̆��>�|o ����/�Sf�ӽ5ˌ�rc��m�w�#�7�������J���X��_���u[z���t�.mȼ+!�Ϙ��m�M��{k������s��KF�Y�"�mVq�ŷ�~=R�����g�'?�����&�Lv���nz�����@5��έ��k�_�\SF�Ʈ�JeDC' i�����H�V�;�i5V7�i� vވ�k���%LQZ*'o���J-t�2�>"����u\N�]f&KZ�*H ��-�b�_*��E�9�w�g�El[T�+4rբ���/��2Od�7��f�փ�?�<}��qqe 0���>3:�+T�+���+gz� ��x����8g�O7�5��U���?e��A�"���>������!��:A��~8���I��c� �c��Q<e�BH��t���:8i4R�+p��V�BJ�|�����Ѝi��bD�J#��a=$������7��W��Y)�:�Vׇ�d�n:E ,���x�DT��Tc�Eb�DNbCj�N�/�T�U��u� 滃�q>*��T�1���,�B>��%7'�R�XԍLƧ`�N�ȶ�"�m�l]NI`�J @E�a);��g�Z�V��q��GLBz�gV #��D����=<���C3$��hA�`7�J0�s� �`���D|� IۿܟmV���_Û ���0k�?��+WH�䣲�/@�n��Ƌ3�7�Uo�'�_0�h�^����J�U�a���*!S$<�hc2<�O"����+G�N&}x�(K��� �d���Sv���5�����[.����T�*7�����_qt �Vg���bA���d�.��{LǶ��Ҭ�hΗ���/))1Z�Z{����(J[�%˄��f ��"�!�j�%���xȎ�}�)���� }�aP0�d�t�1 v�{]�jWV���Z��=; jh����'GJO�̣���.a$jUc�|��(���y�$(8��@��*�������.jj=�{�F���>��N�L�/�����/�{�~���:5��B��-� #x�(��hI4./Ʒ猂f�ؠ�.�\���Q��N�����Ox��A�)5ypКiإ�D�%G�Ș�ݴ�8{\�W>�A<��J~ŗR�D`$AH]Ӻ �S��1�4�7~e
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.retard0 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.retard1 Size: 5.6MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmpdmp Size: 512B - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ