c�{�-9����<}�y?H�{�P���y��HL"��/�m�DN~�C�h���|j*��FT\㺆_T�<�Yz���5f��r�z���j2ɫ��U��<�����m�|%��T�$�{"��F����I���^�EJG��xs.��fc�<�����yY��+��n��@s=��촺 >��@�+��N��9(�5�'������ޟ�k�P��d N�=E���B ��z��y�6H�O]p��.%5����n�g�$I��xF�N\s��&x":;�E�ؿ ��w�����p��Z����R0r:�iϪ��u}�j5�G=Z#.s��/��r�H���@�Gc2��S�Ǘ��õgu��5?�����Q��Fg{/��H�A�t=����j<��{Ʋ/������� uNP6���7i��_'�og�Q��T<)����0�����/���E��xI�S ���Hx�V�q�z���7h��ox(qXk�P��P��!:8�o��O{[x��4b@L�� U[biN�ՇL�9Z��D�M\�i5�PI{���V,l�7�7&'�e!�5"Oo�{Ծ���/ɵ���z���N��I��syZ�a��,�e��;���$��ޙz�"��O>{KRr��^�am�@���g����"Ą��{�=�.�7o�cu�Ԛ����%�K�vy���Ȉ����DF��,�&����UJ��kO?3*��`��̯��ǔM�.������kNV���D��e�b �<�m�VESN���?M��]='Q��kN�,�9e�7�<�H�FJ�� �Ԇ� Wp�E�n�kg痩��E A1��;��[���E�+H�$l����������a�x�z{�,�����ZԷ��@s�v���O���xw$JhE��ʞR�@�pi�5������E�ޓv�d�����>����P<�� �w]ȉL����M�EH�z���<_Q,&��L��J���VW;� ��:�>i r�Q\�����Ч���X����T���%��?��Si:�v�-tb4��7�gO,�;���½�������P�~�j��� wOy ̟D�ܲ��T,(t1��,���|(�\埅MH(B������>��NQ3�k���\�d��1f�}���-n�q5DR>a�F̣�*��R����}\p��������g�C1��i0d'�`9 ��>F�q��f8!��i��\R����2�Kd��y���i\P��Y���{�o���8��a�DXk���c�#A�|��!�K���J�)C=-A��"�}^A����N�� =�� Z@���,q�Ǘו��Z�W�m�����R�t�a�1�l���-Vqs%�5B4�~��v�6K�v�6��6�fg/Kg��������U16s� ����ѓk����Z%�D���r] 9F�7{�'8��sԀ��.M�G�ȵx�o�=�p�W���������LIEz���R��K��ߧG�oC�~ij� 3Ҿ��w�d���V���sM�ε��OŇ--qW���ב�6�I�I�6܆6��}z% �k� H�'i�3x[._�b^�-$�)�{OҾ�rJ�A����ۻ��N����;��v��lf{���f����Ř�Ef��� �A�V(�T��)[�D:��%�c�)�!�έh7�N\�j�����\HU�9OVw�(+w����.�X�k����}�̡������0���¢����Q[�\BD�z��(��TYз0���[x�^ė> 4���>���+��:{6~u�� ���u�.�iP5��ڕ-8i�s^�/01; 5>�$�|xrj�˷�� ?�2�yBN����o�1nJ�kS��;�8Ol��ԥΓ�����v\���ڜ�`�W�m�|Y+CO�L�d���u�����A���!�d���'ו2�L���WjZ����{���$�Q�9f�����Ws#����d��g�]�B7�i��Q�96y_4�r:��������'���RR���xO �w�� �jʦ&g^E�����ǁ;�"w2ƛ8���a��?�40�E>��Lw�q��0T�!��2l�.[�=����m`��OW���-a'��1P��*�����$��3� ���#+��LS�9W�����w�����4`,�� ��?�Dg?������7w�^��jm����1�}�᫅d�R|���������l�A��$���>[�'� '���Q��ɜ��:�[��!ذS�*�n��>ۼ� 0��lk�y�u����@Ki��}�H���y��_� vͤ�a��U�����BB�R�df9�T�����v}q�.7/����r���)�o-!>��}�����*㯶B�x��#f���Z�j��6 �"=f�i�����G���[巳��x���<L��<\R���z���Ȅ�i���\�����F6n�P�̏ͩl��-ƣ�����N�~�FS� )����k}Bw�y���ܖ�+��p��u5�[g C��'�Td�f�}�� �E� y�p\��$x�Q�i�F�x���G�XՐ��w��[���zR�F%h�����EgW+��0[�kna���=�&����7q�G��(��� C�8���:ke�����ӆx`o�z6}���� *�m�"�Е�lj:4�6��y�z��%�Wv��#�~��-˩�T��G�d`Ph������ݻ�\*����ޣ��ݧ���i�F��p�����G��Ț�*|��HT��3���B��^6K�8�,&ն�mwz��:��ۤ��g�r�RɅ ���j���6�p�jYi�8����ӻ5��҈u�H7��P�}abt����s�~�[�X������ x�S�&��4�������*���nƕ=3D�X^�&Ŧ�WH4-���)�J�v�ha�z ��҂�& ��X��mg��]�����Ht8���P�6Ղ}^ei}�E\m���ަ҄?K��S��\�1�i���Ó��F�;z����T��c]/u�������k�ˆc9ZCx��-��"q�@��.5ʨZ�6o��ӗ�3��'ޗ�Ɔ0I`� ��� � ����Z�Ts�wZ��Zհ��]�^fRM��=��wk{����E&�N��y�����a�_�����/g��N�~SDF5{�r��-ް{�oU�Ʋp�q�|�\�EE<�x n&��0i [�3�l��,�q*E�׀�P9���v^(f��;��G�[@���a[cG� W+2�uK�ԽD^��k�vɔ�;�����F���K�Q���. �������7����T19�|z
Static task
static1
Behavioral task
behavioral1
Sample
UnpackMe_protected.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
UnpackMe_protected.exe
Resource
win10v2004-20230220-en
General
-
Target
UnpackMe_protected.exe
-
Size
3.1MB
-
MD5
36671a8059308c1e4435f25c965417a7
-
SHA1
c5e44929dbc0a8d906f881fa2bacadf9884eb8f0
-
SHA256
aa0f8e9cab68a02e6db39a182f3e157e48fe590111cb24ef7e3d059129749c44
-
SHA512
d46000483942091435f50725d4626f2845bd104e3ab52804d816ad13ef20726efb1cfd329bddb85793fc9e80fcea36a8ef815cbd7be6e2dbc1117ee3ffe31751
-
SSDEEP
98304:+Pk90gX5IglJQxzDaReKE0UUvfxK8hF47ft:Cq01OQBmAKEwkG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource UnpackMe_protected.exe
Files
-
UnpackMe_protected.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 67KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE