��H�J��eŭ��$*�pB�KG�:-7?)\UHPn%ؾ��g.�`v���4��P�^ϝ��B��FeY��Cj���tȮb��8F���a��ib����㎪�E���Y�I������T�s;�WS6)W����v�1��K��ò�R�K��F�g\�/��(䲘�4ӏ*�C$��*@�n'�����Kњ�xF��� `j��STP#㒠(-t��@�{�f<C�Ҿݦ�s�I|���/�F|Z?Qh� ��zb��l�Q~����Jݓ�(#��_rVT������m����*�5��!C��%�#���g�Я�ᩐ�&Տ9�Ųٴ$>�X�6Odl��:�@��G�P+��d=�<�zN��2�Bu6BJ$8���O�T�����xƙs�gOȦ����Sr^�+!����IL�O-W��-�Ws�L˭∔Jj����S��d$ ���_U����[Ыߝ��F �4qm0)���߁D�)[3�y��2x{��<�M������g�BJ,���,Z[H���3����ۻqR��T�MU|����Z�e)ʵ����|��U2���g�jG�!8�=6B���i�kz����7���^�W ?F�cA��'��o��0�w�;&��v}�@����4��1L���J5�L(�Ll�ȗa}��%��eO�%�nC���S�"ŀ�0Z��]��4� ��7�����Bo���{2�(x|ŏ���W�9�|y�8��(���qН��i��7<�s[.�]�������� ��ç�8���%A��Od�DK ���U�Sp�.�];_�i`�\��(�}]N}���x�ͅ]������a� ��Rl�g!P?�>r�iڱ���?��P�+�7 �3�;~y�k��-��}��O,���ۀ�F��1�2����B����^3��%9� �1@�N�ȐR���y]�ͭv� �Z����ue[�fv��OX�����d���o�f��Ҡ�,�N��2�=�kϲ����a�Y��*�[��U������B�]j��6L�X�O��^|k_�N�z�C�!P��$EF�w�����;�L�Y8�_W�j8A�Nd�F�5��F�L(�&��Z;N�&��-�m�AZW�X��SX-PT��eBq�@+M�Z���mdkj��հ *T,���*�ND�X�#�����y��߲��xsV����2K���E6hD�(6�<U�Y���3�IVӹ�`H[ܓ�ضl��`���lI��糨�h��\ � �s�(�S*<Y��%o����ϼ�5>���y��1s��CO�����E/i�����sl���u;6�I7��TtE��'np��ngS�:��P�M9F��ڤaN���f��A��]��kI�&T*g�R������,�o�3�������M�$��_�H����2`�/>+:��d�=7��+r�#��P'N�-�=h�;���_�a�1 @}P9K F�����]�P\ ��j��5|�e�Y�ؖ����� ���J�WR�\���mf�X�랃��� �ę�Yޒm��v�S����B��I#����c���o&��Ko3����"bM�,U�W���?��p����W��6��L[�l���=/ĭi���o��@��Tc�~��F�~��=e��Ә,�s3,�:��� 6O����\fs�1� ��|��![$)�{v3��oG$���[W�:U=}�%7!�ah�4�bK����l{����εt0ʯ�h���9�~���Jx��}�>{� V�$aGn!2PJRJ��QCԜ�Ex#Yͨ�s�s��<�tTF� �_�k��Nt#���� ��0�G�"�b���Y�qZU�c�2��{qVi��%wp��e��P��z�9�� �w��;�#�z���)��'~ۉl�S �X�(�8\)�X��o�cn����痣�F�H= F.�b��mg�26q�$��N�e�DY�?I��յHv�E���g)��i]ܔ*�����Wd����d_�+,��~)!�6�8^��t��4̊� ��ѣ=y����CU䦁5K��ʷm<�£���KbnRP�$iѐ���N��vC�Z��]i��X[��٠ p|�pX4���ŀq�W?�j���Y[_�?��7�C�=.,7�x�Ub�~!��{"�j͂mj|���_����ʣ�v~5͜wC��a�]e����$۬�. `<�<RJ��fd�9�~�&;# v����:dAON@#�&�1]���3��蚷��8,�r����#d��R{ġ�Z~�>BsΥg��6`3k�A�6��=��<����z���*�c;N�}{Q1�^��}��A�^�q1� ��~I�r�a-��#����V�ơ^3�}�9��B�U��x4D��+j�[�IW�@>E���Y�'�zJ� M+� ��L�p�S�&��M�s}�w�.���G�"��>�4D�UG�x��U�� �,:Ս��>�\�EZTOi�Լ�L��- '�\>��ߔ��H�R;�$7�wĜ�r�tyuXs�$������=�+�_��>C�}�3،����eπi� W��o#�h��~��0��2�EU��\H�J����F}+A���P�t1���e�e.h�J��#J���hP��*�*;`��.ӟ���h-o�����Qdbnm�p�('d�@a�똭$I��YW.ǝ���ѐ��%pie��"�I��LY�88�5���te�BYs��N/�)k[��ݬ72/��O���H�����r�k�k�G���D��P$��g�qj��h�d��fV��@���O�k�S�i���-���]����(_�l�bX���-�FY�6�����3����.��� �%�X�����Ą@�q���rL�t_)w���@����R�ݍt�k��鰦��p�`��E&f����jק`1)�����R�m�3&�@F���3�e��7�R=dj��܀֕¾K�}�E^�M��f�\�����Ql���D���{��X'�����f�@�krwMO�@��8`[��4�G�Vr���+7�Ki�S��F|��%g�rH]��HYZV�!�!�7C�}hM{3<sL�I��d،:-�j���
Behavioral task
behavioral1
Sample
Encode_380.exe
Resource
win7-20220812-en
General
-
Target
b620edacbd2647290c6410c9ff708bd6c51796246cce4971b6ad49be587e859e
-
Size
4.8MB
-
MD5
4ca31cd91a2a265da80a1e64537bd901
-
SHA1
edf06d8a1b602ee45846e99f7638d3153fc58518
-
SHA256
b620edacbd2647290c6410c9ff708bd6c51796246cce4971b6ad49be587e859e
-
SHA512
e6a256508089b8bce34f7ca8b769c824531924d45e2b9908b268d3baf82ebd50538386dc2cb9893eba1ff27dbb08d1384418c67e73a75a290ba0be9fe6a1c683
-
SSDEEP
98304:Yh6TYWpDIEL+nCSCIMK2jUs5ZVIoIjBJk3hprEHapBPJlmZPSbyZVwq9:YupnqnCSC35OkRprEH8J0d6qmi
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Encode_380.exe vmprotect
Files
-
b620edacbd2647290c6410c9ff708bd6c51796246cce4971b6ad49be587e859e.rar
-
Encode_380.exe.exe windows x86
8b8f4f65d9868d604d9a4eb0a0799d0a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendDlgItemMessageW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SetMapMode
winspool.drv
DocumentPropertiesW
advapi32
RegisterEventSourceA
shell32
DragQueryFileW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
ole32
CoCreateInstance
oleaut32
VariantInit
uxtheme
EnableThemeDialogTexture
ntdll
RtlAdjustPrivilege
psapi
GetModuleInformation
oleacc
CreateStdAccessibleObject
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 641KB - Virtual size: 640KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cxxx Size: 878KB - Virtual size: 878KB
IMAGE_SCN_MEM_EXECUTE
-
編碼器使用方式.txt