�P�#��6z����.��7TNN�K�S6*���o�T�.�ǩڨ�h� ����g'�A��W!1���)=nP�h����&�y��d��B-J����"�w�\�T������,_����#�Q6�z��1�O��_�c��u���^���-�����p]@�8�?.�^I���&�����o\�'�x�R`ń�1��.�7d�������rq��v���0M;mO�I����_�lЩ���g�|K��^nG�y6|�J+����g�. �|3����%�y�"��2��f��İɐQ�T�P�q�]m���T�g�:��=��,�._0�Iί[O�A�e�����3B.s��e㭨�uF�Iq�J���kx�dJ���cj�� �a�H��N���������}��@��c��,F�� �P%X 0��@�!�z�<.��zAj��MS2��5Ǭ��m������ճ�"oT��G����Fq@���du!~e�LX؍���t����o�/�gLeq�L�מHO�c��i��*�� !��QD�5����D���m�0+����~�=��B����پէm��u�H�k���fӟW�bvۨ��sz.x�m��:e���PΊ����M���ŝ ��>[w�[%�^���� O�5�ы|ye�i� ��#T�����+�,�]�0's��|��S�w��Q����#�G��/]_�-��)'����~��<y������y��*�m��^�_���Dط�d[ƣ�� �.HQp��� m���K+�|(�E��N���(A B��u�@���;W9�"&�j������i�\|��PvV�(�1�J�-�om���N� ,_ �!L�����53H��$Ɩ�O� ���t G$�=b�37�Y�E7R��1^4 �X��mib���z�s�Q���}x�U�a���YƟi%���L�+�Cm�^Q�nA ��+��Ӿ�Ś��7���/w;����Q��g�Ҭg/��F�?@�*�Sv������XYx��d��{|��� BCri�7sbYO��'�C+��hd�Af}pP!Kny�GЊ?�b^�1�������a,]�d��'a��� _j�u�%��o��۫��0�)'��n������~������ Eo�,76n���/(���n�1Y���h`�[�Y�xZ����H�;q��P�H��)�W��!�RU���g�]���-���8~����4 �,��DqQq��$Б�ja��-�U���{�Z��$q�'��d;�N@z�g�t#ZWo��/����L|��� ���l* � �{��n�cSLR��T��W�����#(�Q\"�yZ�\|_>Y;H�����,�#��G�eZ�Oh�c�T�2�6åh�2r�1�����#��s�G�TAࣥlv����̎�A � �7���U}˃a6���뗙'!�zQٚY�֭�c'f;(��Z��K;�$˻�|(��ŸD����5!�w��C���s�;�����Od����F=Љ>-k/KNfG|� @�T �z�*?�mNF�̍�+���)9��Z�?/XA6��M��FlPc���*�6J��]�W �U�gdhl`�V�/�!�Z��|�X�Bv����2���"I�2��E3Z���i s4���b�@��}f��|�%pItae��������+�������H�2_�9�;�����1K˶^ԃ��R����^����3��?oq����jl�����!����Պ{smV�~����Ŝ���S34O�������q�:�ؖd9��)Ku&�8a�����i�~J\����F�%Ϳ,CH���ʗ��O��_��e�)a�0/)?��d��A�@}��w�=7W��B��^�.`_ْ����Hc�$�sP{�9C��+�z���f֯�߈Ě"�s��Ș���M�m�� uN A�1R�#p�`թ �G���� ~��v��؆�c�TL��r�T��֞ܦ�'��n�n�����h�Tj�ǻ�;YU���NÕ�QZ�K,������m����ol<�Pm������Vo�K3 �p�l�q�/\x�du�D5��Q2�uY��%�~k��Z�MءW@ll�M�+���֞J�5T�P�K��;��e�a�\���v'��Nn�)e�D��R6z��;Npͭ���љ�/�?1�9j"� n�h2���3��Es��xJ<V��!9wĠ���F��N&�A�˗#��$���J@����T�@� q���߶�[�h�4�E��{x��r��X"��S�>~�E�Q'Y;�9HLm�%� ���9\���j�`�[t,��e1� ۹Wpש����̍LVʋ��Q}|Q�j�ڞ���ZYO6�es����?�H�/��B-fi�UZx王��1��`< ���S6�[߀����z��� 1��dF҅�~�D8 |�L����2���b��xx�U��x`�|�5��ePV�2���E�bbS��4�m�ք�O���;�,w��A�ڟ�����+*�����TG����o�;�n���bWGm��d�X.!������"XMhV��v+��8N��9��D������+� H%r}Zo�R�WQ5�}F�KKe�X��xE���Х��k��J�a�4�}� n�g���� ��5�Oh�%D{��ra���u�-�����@bl/Ħ�tzOF�7QȐ�S�C��� Ue�Ʒ�������a���a]�~A���OAH4d������^P˚�qxU�>E5���4HT�N��_8:踇ǎ�{���s�7��"���.�O� �Ǖn> �����+�l*X���R$�Q*��s���]}*cQ���4���L�ANߪ"~=��}�h^��D%������Y$��A��x+��{;�,{�����s �b%?9g{B����&�@�|�Uķ�L���F�����mBmVP��'F�Y+�L�h<$b�B솒�Se��54�S��{W$�i6�(�g��m�u:I�wB�z�tm��8�C�<w0��}F����80.�������Z���r�C�� V�XݷHc Wr�` 8K S�~_)�j�������5\�J6K
Behavioral task
behavioral1
Sample
Setup-Full.exe
Resource
win7-20230621-en
General
-
Target
PassCode-10101-To-Open-Archive.rar
-
Size
6.1MB
-
MD5
6de5660f7fcb4d8bc53bd538a032f419
-
SHA1
3e6ca1a88dd411f97ffe022cc162780127573c42
-
SHA256
1667353f29ed8ef2baa181592246d10e33c07855d4aade4800c84072d6188fe2
-
SHA512
e022e03bc1dd6c16cd57aa58abefe8631156fb457b4d95b25cfc4c78890d65a7fcc931be6fe0126269a68bb2923f892f1f1d621e807216bc351eea78e37f3d98
-
SSDEEP
196608:rU5J35y312iYkApuN4LoT7CCNK7n/bGQZabAb8:rU5J3ztkuusMVNKrbhZap
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Setup-Full.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup-Full.exe
Files
-
PassCode-10101-To-Open-Archive.rar.rar
Password: 10101
-
License.Info.txt
-
Setup-Full.exe.exe windows x64
Password: 10101
5893e69089e19900fac24ac96df96468
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memset
wtsapi32
WTSSendMessageW
kernel32
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[0] Size: 660.8MB - Virtual size: 660.8MB
.vmp1 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ