t�����$�����zq)���1��Y��-v��}v�R��%� �l�"���@MX�Q[����95���t�d�ި*�����@��{dE/�E#��?���I�tV���Jm#t�?` �d��\ �e%����Z�1R�����ްl=Fo?�Zh�&�-o� %116{���Ui���F��fT, �h���7�lr���(y��L�Ɇڑ��<r��Rw��������k�38�hNxۄ��#��՝�����O�ܻ��� ��\Q84xh_l],\������ )E��ޔ�'.��2�^�WO��d�C]+E#,�"��%�+s���X3���l�gN�Պ��hPP���)'bV{�^� $���#d���O)�N��uO6���F�sN�ٹ�P�� Ќ&�j�2s>P,Ye��8b���384����<�b��� {�.�P|4��}<E�y )�a[����%O�B���`���@���rJW��0�P��hR`���uƣ�������N�x��nc���X$�������(�<i�g�v�m�������XH� �����ċ1���(����<���!�o�Q^�G����� �� �DS�+Q�(��_�n���3. �7�P�-�{��:�$M 7#�������O5�~�/0�$cB�#�\���07Y�;���CjI���Q^#�k�Ld��a��˱hS�H#G��>����M�L� ]�_H�)�F3}��;V���kF��w)�^3�Q����!�1��V��+A`��._��!�_T֫^#����jH��nV\��>k+F%�R58�z��9.��c�'b` � :������-��[�d@I�_�k�k�����c6��i���6mf-��"IB�`o{��.�|��mҿ��\��dUv������L ��Y'�}�[��y!����g��5��My2���pE?������+4�(�n@��1����D��븛+�rM�������'_���4 ȑ"۞�w�Z�44���\�u"������K�v�[t�!5��g� ��+K�^���Κڵ�ڰ�⛘��5Ȩ{+n�r�R�(%��5�e@3K$t�@���ͻd���z�m�Ն���wj� 9���ot�����]q�I�#l& v�p5l�"T8 �A�5J���|!z/��-��<v����pθH��iȟ��:C��us�<�l�R��L!_��G��!����X����8�S0�[�؋9!�A`;sU�9�X9��7k��9�8%0G��T��s��D��^��9?y ���)��p[�|""e�A2��Z� �[ǟN�fi�Av�@\M��v֠#W����������Wǩ�B��������}+H*�9�h�YK�N�(��?Za����a���oIp��څƜo�3}E.���h$Y�E��4�D�����O`��N���<{�C�Y��=��e��(FHb�^���NdP[uɬ2s�L�L�){�yU��Y����e�l'�Oő%�nO�N���_�R(K-�(��[!�v�ku;U_����?��%Bk]Ǒ��Z�:(��G����m����'kumQݍE�W>ǔbNw-c�D�:f`*`�ޑ�7���$kh����IP�bX�)i`9���C+_I�̡�ى�S���9�/e�D���:����w����m�_3�^���c���p�Y}�ű�~����a�~n��q���Y �\�:e�jl�D�rZ�jt�����7٠@X�I~������@� �JI�YJkG����6aH�U��� �R�M���J��I�����@/�ː�MYů}H0p���B�� ɅhÁ���g�����OCDh��eE�}a��I�#��f\W��.ֿ����y�RJ�ɺ��P��in�'w��F��֞ �G1�k蒆���2�����g�U�c�tr�8��a��?�Q�D0�ǩ���>Я��~�~W����*�sua������Ib� �:V��Jl�Y�ܣ �N�k��-������T������t�~qv����R�-���!�;�n���J�����̄��;��4+i�����%��>�徲� ~g�N'�Ƽ�<�Z0z�Vwp�E��2��G�apf-h�-��m�=@p�+$�} ��-���WKj�1�X��ϲr���ԏ�)�af��̕M]���&�-��$;�X#��ֱ�_蒾�O�����HO����Q��֔��w�HI��I�&ja��y�/�n�<�{]u�0lΧއ�|лJR������%I�G!_��;ߝb�+a!����ܯ��$>�/���Z�� 9�m���C*�Ok.��iJ����@����Ѯ�bU!�fH��#�x �\;�N�^� �v��� $�CӤ"�u�}�y�eV��v��� ��q��2�t��� %mm��dJ�, &}��A; � է��.2�ɷl�1A/�I2������MP+_�Ҁ�Y|A0����� ^FU>9�g�ǝ�7b�/U��\�Ђv�IL~.npX�;�7�w��ǰ�zKv��0mL�2���F�v��V������v����/M�S�?{>�m�ݯ(YY��2p������ �\,N�dƮ}=T� D�/<He���X\����(jDX�/c��fb�59�Z��/5��'�����@���LX��.�8�u�����c뇫cnz R�����w��fp��7�� �A�\�D���E�B��7Y�&?���J�h�0"B�G��ox�WѾ�k�ܩ9�>�U�A�'�O�m���!,��cb8�m<��/�uI͈�ɢ�YZ�g:�������5nRiu����'��!����U�p)�*�؞��+^ ��y�A���rM9S!�S�T�2p���_�Ll���8����(�.ѩ��7687�U�����_<����"�P?>� ����)8���lՅ�)SQ��^�̂��\A"*��'I�u%?�W1E�@�S,7�h��X�B4������B�� �ֳ���q�Z"�=��8a:�4-�Z"�0#nf�MewM4��F�T����ϳÂ�;�j[��7y�ۤjv���7�av����<�t~p(� F
Behavioral task
behavioral1
Sample
idk Spoofer V1.exe
Resource
win10v2004-20220812-en
General
-
Target
idk Spoofer V1.exe
-
Size
5.3MB
-
MD5
019e39a0c0c06f939ed3e9580067606f
-
SHA1
fed0a20e7e5a0d865e077b6df4c386d0d954bd64
-
SHA256
60402ce9ace92fde371fadbf0dbdc7a7349905d61e5aa39d82375b0248cb86de
-
SHA512
b36174628f7f1459d8f4ce6889e0fc95eccf1024fd53aaf2ea182834e44d08960988f0fc55799d82048ba92251b482948bcdb94bcc1be1d88cd171258d080ae1
-
SSDEEP
98304:iNl/m5UI+t7pnyzLjAtlZAoWmo0RD+T/E3qyyVsaDf3+GpBX5koX7r8i9L:iNl/3pyXMp3oE+TcaygsIvdpBXfn
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
idk Spoofer V1.exe.exe windows x64
c8e311a614de3e85462ebe1251249348
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
GetFileVersionInfoExW
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
EnumServicesStatusA
msvcp140
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
ntdll
NtQuerySystemInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ