9s�sY���1E�#b�OyfA��WR�2�-ڍ,�bA�\jX���N�*m"T&+� �"%��s+�A�2S��/�$��5�=9�-.L�Y�%'N��^w�.��'V���x ��#��-=�o�i�Ɉ� ʩ_`��Mdp;.ŵU&�X ���Mc�/��(l�*X�ٹx��Qg,��� x�Ҙ �l_lr~ï9]��c�o ���?"�v���le[�,��U�V����N2.&� �u1@�F�\��� ���+�W�2�<C9[*�e��6J�R�u��@�nC2��"�;��$��~4>�C��;��`�[email protected]�R�D�������˞��II���fmMih��p-��l�H����t��"@�����\����Y�25p�uQ٨��UT���4���/�44S�������ʏ�!!�n^�O��w F'���0f��I{V����Q_�m�9B)���K������k���A� ��;�^��u������W~Z�5%�K=�x��e]������[k_�.�T5�\�H�=�3�}�:�G�n&٪:����7�b~�b�\a����n�m�a�j(��>h�ELT�g|�q(�� ��{�xM�{4d4�=�g2�l�B����x�AQՉБ�i�O�>� �ʋ%�i:�9�QI�F_ssj�Ի�x��^�F~\ѝ��qsi�V#8/in[��Q���aM�?�d��%�����|_.JΔ�X�Z���Xu�Z;���u���Ut×���LܦG�/�Kj�-��q���q�7ms`g�r?�0v��u-Xi"����K�LE�k�Es!�m�.p��Q��?����{<,b���ةkO����8�R�����?����얗��'�@s�&�u�����Q�@zR��R�^��R�3�R�+�&$��g���6{n�m�_p���X�rRy���H��ݎU�>S~�t=G���Ka�V���O�V��� ��+��p� ���e��6��D熑��Bf�Ȕ�%-��Qc(��ev�a��i N~e ل~t'8=��x�uxj9����'�L��{Mש�k�O�,z���gY�ss���� �(�b6�3X�8faTA�qXQBl����"y(nB���Z��"�����:y?�ĆdKK�cQ�:a��[@J�r�ˌT��:hЏ�U�$.��@�nJv,-�^��L��������v�8Ft�om?��3�m��Zh�V%\XS] vP Z��n���ek��tL,���D��g�. }*�$��D&�b��YQ�{�W�`�:�ȅ��r�n���oia�kAwk?���.A�f�xW���h����Tz��A�4�\�� �!*�����j�Gz�C\��q���g�ZJ�j+<��{���ː�^(��]����rm��~�X!�<�^��n��˾;ٶ`�������$ܕ��2W�LA{�t!z����ԫ� +\ΰ�����9t�,h��}�9��x�~��R��W9#�JD��$���-�_^j�l�#^ǻ+3qS'��a��+.��M��){��]f=�(��l���@��j$)D�.9q���M�r�?�=�s��gyd;��,���5A�L�;��GD]�~7�8&N���ɶ�M���MW�T�Ԩs�-.�K��CV���U�������]\^6������ȗ��F|j�[��ip,������rN�O� � � �T^=]�Mn3�J�*�;����,�ɟL0����� �u66x>&[� �T�!� �0��4u2A@ �yһ5'�w]�DO;��)6<-�/X�dm\-q�]��E����a��3��mx����(x�˜���3|�FM���t�%Ar;�����OKwn���5#u��S� ��`�G�j�@i�?x'�-`����\�]*��p�4n�P��7W��s�z��_f~�?�ݞ�|����H��E���F��h���R3����S\)��mP��CY���0��ybt�X���cܴM��� �%��&�a:������'�7퉷.{�������Ë�_�i3Q�wǜJ�6�cF��1� J,����/�:��,C����t-�~�T&[k\�{�.v�[���X��s�>�T7�9 ���cS����;PB#�����_���7�VO�����\�q��@u�z&K�7�Q ����R�X�\ry(��$��=Ƒrk��/J~��>+4�=������* ��+F�ڎ��E-ά_Id���1-ؤ��V+�^� u���(�d7����z�Ju�,c�֮'��%Bۻg��� �$�L*)Y�O��3a�;i��%b�LzqŚ @�@s0�me�������Z�t6�����|D�e�Hj��&K�xD�g�0��Jm�R�� wY���ZI8]k�@%ڭ4A��_d�p2f~��ڵ𢡄��r��+'����U%.2iYv(���Դ�Ҝ�q1�ɼpݫ=�v���Q��l�h��L>J���i}�&�L��@��9Q��"�)Ȣ�Eq�>9�U��R�X]�뺪l�<� ؕ��sk�jr�i��V���d�*���yܯ���{�� j�!�YQ�����@�ez�dA'l4ҋ|�p�G��,��hL�{j�W�TA~��â2psd��>/��ŷ��i�L+�{� �l1��(�*��o�Մ闊����w.+D-mA��/��u�EV�D6݉`�_���Ǵ�=�Ŕx7��>��p�.����BX���G����w��% �p���]mi�Yš@L9��H�h�kϫ/���'��i�+�R���k��ktCJ�/6�*��5�y�������+.�o�6��¤� ]��:R�V!����O���.bu��Y���ؘ8�r0�y��+K#�::��)ѱ8�ls{۟s�f����3�#�I���{/�F5g�\�0�!ʫ\�KD��ˏc���j/ԁy�+tm(J�7.6�o;Iy} Gb��S���%��K]>��̀���P�@�&g�{)����9��L��x`�j9��hʏ5�f�9��L���s��L>�� �Gӗ�>c�M4��J4�{���T� �I�q#mn �/�r)�X�=�=��B�X��g
Behavioral task
behavioral1
Sample
Game_Data.exe
Resource
win7-20230621-en
General
-
Target
Game Files.rar
-
Size
6.7MB
-
MD5
759acedb61702fa3f0dbb5ef285b4d75
-
SHA1
40478fc12eb0f5aa196e4ffdea22f4ad84c0eebe
-
SHA256
216d89a8aa930542e3216a31c7decd17ca90d507f064d81496cb284cc98b966d
-
SHA512
75001c6ab1732d7e90dd175c2af0ff0ce440bd6e8e77d0c90db371aa21bac40e0542986b7c3f84eb49994ee585e84bb67b0acef89826dc55bdded77aa0a7354a
-
SSDEEP
196608:KFAFW338dX7ENBmFrt/+pU4LjdvXYpalggnliSREcZJ:KP38dCmld+XGpaegllLJ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Game_Data.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Game_Data.exe
Files
-
Game Files.rar.rar
Password: 1234
-
Game_Data.exe.exe windows x64
Password: 1234
5893e69089e19900fac24ac96df96468
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memset
wtsapi32
WTSSendMessageW
kernel32
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[0] Size: 660.8MB - Virtual size: 660.8MB
.vmp1 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Must Read (Important).txt
-
PASSWORD IS 1234.txt
-
img/Advanced Settings.png.png
-
img/Menu.png.png
-
img/Resolution.png.png