>*巛rr�~�p�-V���tG�4������#Dv������Ԫ��KL�u�2EmU��V����z����Z�������2�{�ظ�(M��"1���ֶ���q�0s315V���$���b��� W�\�x.�M��ښ����x�T�v�#�Bc�+N���@�ὴȣ{{u��@��i3/Tv���Yt��a@�/��&�J�\#���K���R���ޚ�����P��O ���sZ���z�Cz�T:�$����*#��y� ק�L �����*�;�u�������Aθ��^o]H܊�(y��(M�eW���~T �͕P G�����=2�_����dHJ���� �0Lv2n��8|�o����n_�����m�r�k�I��<��G�7�x�9��E���U�ӣ�6�'3K�qGbRQ�J R�! �������AE8��d���S���n4�JO�N ��f�`��xу>8F�hkn��ri�"?��j�F�햷Pd�c�ܠ1M����~�z��������(�M]� RX�:��z,pϰ<��2(�u2� �q��܀�L��^�����A����I���A����2��މs���������\Y���L@G�{)��њi��i��ur��1�� L�|rsgL��Ie�m�A��kS[3���P���{wW�&.L��V�_E�f�m玻tb�q��˟��V�V������])*l=z ����|w*ʘCUC����)��) g3��^;����OI�����sJPs%Z�I� #��iȘ�]��mGV��� *�d�;����3���oЛ�څ�\�|M׀��mB�S���Ѥ�t��WhN�[B�m�O�!����a�T�|R����=LJ��6���d��t���v_`����]~P��;��n���nD���1߈�[�m�����ZQx���C��`Y҄_��8��}���Z+tM)��/�K��5�"U�J�2夵@��Z�_���⟒M�U���X�P�m�Q����7 �ƨ�5�H�dQ̦B1�3=��ڭ;/�Y�U��Gt?ŗnT2���|�=*į��f��,i�9�K+������-�ƀ�1��,b:.�gaEi�"�e�iVQ�����jxh�� �ڈ�{j#��|�^~�_y�ì���� �8W��m��Ҿö�|D�\(���&�dN�EW���d�����R��M`+��h� �z~ 5�=�_9��D��.�9&�N���(��P=_/�g�J���v�8*��S��hJ֝8<�٢b���9����"�����,��K����փy3P`��'��� �ǻ�����|R��kL��r9������δU��[�T���~���s���R�![���O����Z�pM����Zqa��~�Lй|UW5fQ���ʲs@~��9A�'h'?&b���6�f ou�=A|�Hh�1���/˱�����p����b&l�"o�Dž=�����*�4Qw�+��]���%Mn������%��5Q�T�hӪ�WT��� �[��2���&����/)X�����0�^�s�{q8Ӹ�dͱ!S��i���=d0K����ڤ��?ðI���q�Y��V��p���q����&=�<d�Z� ���_� ��O�r��{�D��``V�� 1e��c�PO%�5e�����b�N?���aԜ1Ղ%��WV1d��M�����yw`��Y'��(�̉��ߜd�нCqy�������>�b`ߘ�^�j���������2Ro�Vڎ�(&]Mw���f,��/��!���������m��u���K��c&I���6��� ��˶��;�a{��<)>��~(��P�?��ԛ��n��`���݁��Q���Sc`^W�ٳ���<���eC�y@��hB��b�C'iF>�����h��ϷU�K�*�^ESN�I��qm�~���\9�����?�b��6��~;0��>��4��p�R.[��R��8����Iq����c�7��=�j�ș�8}�¹x�.��8�yS����]��Jx`!?$Z�����E��5(��;n���9;�����R*7m����:����8�"2C~�+�閵���5 s��(���������e�Ď��aS2��{c$���S�Z�����Ҍ��%LM^N�0��V9��<��K�>9�!8��d,���n�E܈P�Հ=�ġW7�7�6G��~`CR�,� :飥�M��E�̌:�e�FR�}����e�vfo^ y�C<x���l*hB˝���a�5��J�B�ܦ�3P(zt�J�����)��\��\�}��`�۹������&s^@!o��23�vW0,3*j�ߍ�&u�]��}�����[)3���k|�i��F�����I3�����?�3��=��L�D�g,�~�XDpD�G�][U�M�;7y�m�3��u���(щZ�X��=?م�S������I�A��V��|u�����M �A&�Ȟ>�l�L{�,�n*G����M�n�%�����&&��8k��\�E�t������(9����0F�w�)��W@��l@��+�e����pr1}�R��v��ڶĐ��|ЧQ��H"���a�'Zc���8P���`m��Ld�D�v,5��?��Մ���?F�ke�bNU�.�x�\�UW��oP4�C��c��R�|�o�8���"�@�?:MKV��vR����O_@�^����\���� ���S�[F��2����������d�n�]q)�E�C�=��W�B�����{�s贡-��Af��ޕ*���xW��OcĀ5��>y�`��_��Y�� �o5O���kA(���뭍=<a߾ܼ�_���>>��Q�$U������ �����q�v��E5�B�Š���&�ZTH��i������ƚ���������YHH��.��_��2���^1/D7]�tp]fȎ�MN�(�|~7ψ�`M� y_p�[Y�T�t�m'!����O`��n��*04a��6j�|� g�/%��BpGY�q��I��(���.�ti���Ay�Q�s�$`ݳT��;g��Rd���"�����W�iM�(*�kL��g�19��uX2M��! �S!�
General
-
Target
Setup_Password_45678.rar
-
Size
6.1MB
-
MD5
f197f253ceeb39215e7f8a59e9a48b27
-
SHA1
a2c328326af17178d11615302123bef90e0a8144
-
SHA256
ea067216549a011e1194b69906dc8eeb1f5090ac1506f1f574f5943ce323834a
-
SHA512
fc7cfac5c1ba63149e8442ba4fd67710b9e627b78b502cd9220b349b3dc7ecd15e98ea58a41a6966dc2888037c6e4b3157a3bb598e6a368a54bfaba11b13390d
-
SSDEEP
196608:SdSNZg21lt7M1nO1Gn6/8H9QSBhSVZBxOwS5a9:uqZg29iO4n6/8dQSXSVZB/Sk9
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Install_Setup.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Install_Setup.exe
Files
-
Setup_Password_45678.rar.rar
Password: 45678
-
Install_Setup.exe.exe windows x64
Password: 45678
5893e69089e19900fac24ac96df96468
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memset
wtsapi32
WTSSendMessageW
kernel32
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[0] Size: 660.8MB - Virtual size: 660.8MB
.vmp1 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ