�4���rD��)D0��6�jC=���`7�8��p��L+j'��@�^� ���r�j��^����@iJ'�/Y��c*�[K�/�Չ�rqڭ?ӡ����!9ެ�W��v��8�f�d�$���DI �)�gݱ��zjb��ww��S�8��C~��G�_ N�XE�F;��(S�����7uʹRD�*��ݺ>����i�9M<w�J�K �o�l���y~��E���k���v��K"���@澰���YߚI]m"ѩ3���`W<�rT��܇�$�V.�����:G������AҎ�]� �a���}=-E E��^�w��&���E�V!�>z���0�#³����o^�Ǥ��{k����}%:�����hChH>c�V������r*�(K�>�jAl��f`�3�+Q�M����;.�z����5�zL�*���d,�v̾y�z~��a���f�&����a���<���P� l9|���G�,��O���N�wA]' 倈��"���f�%�C5�/V�%"M�6�][�w��F�{q�n���W�T�;٠_�UFzv~�Lf�,~�/����s'�m!,d]{̫��8��� ɳL�h����?��:C�7�,�f�8Az*Y�xB��y�j}P�'x9��<S?��@a���=3|d%#7?A��is���s��3��a�ū[2���"�b�%J0��=A�z����ّ�'�~j;�ע�]�\�MvX��h�8Q�����wj��I�/������C�51��i^V�.�0z̫����MK�q��$�fk�N�)�1�oEx���#��22�~_�k��/w���ё �A'����.������̔��!�Di(S8����@�ք��&t� �`����y�#�rŚ��Ӧ����p-o��1�_�*T��s�XP�~�� ��ؐ)ذE^���?���O��#F����lظu����O y��~ﵲ�n �����x0d�G�Ͷ�%k���7���D���O���E_�7�,��� ^G��X�B���X�SN!��3��U��~S1�h�*蘯>�i�uO��0vh>DZJ}D_6"`���V�����|��h�6:f���I��9�!pA��j�Wr��-a�^��MP���M��y�d�]�"�|�}��/�Yvl���eT��-慐6p�K�\���z��d�k9]q9gS�Ӕ��E�7-�Vw�/��o���0C@�۾��bb�*�<0!���~(�5\b��=E��&�dJ1U6�z����6�Rfړi�V�cCe���ա�LNa�̊M�����ϫs�E3�8�l����+�L �]<��8�=o��V�;~���8����b��X���piOai}u#�E��Er�h�(�o��d4�TH�F�5�#I� �´\�%a�#��I�p_}��JHU��dMK����N�`0�Ud)���_P?_.�ֹ*��R��!���wMQ��S�c���J�)eOI;ɄMz".�鲬���*���T�0��Z!S�|�rX�Xz]<B��r��� �q.^�dz��)|�U*v����mn2�~�v/[2�w0����Î=_�O�\ )�� �[��I��������,�}*���8O��n���kE�_�c��oڪ�9�֔]��=gh:6�JE����,��؛�(VǂOQ�k�z�T��ۿ$���6�|�8p~�B�S�]{'��|ը����@a��dAٶ5������S*>۞�@�=��G�x\��F bvb���zW��'�����R a+a� �9�� ����9��ڛ��{.[�P��{I}�?����B�!n�����+B6ץH j���{�P�4�)��}�:�t���J�~-i���i1a�4�;?w�֥�s���x����^C���1�5��ƿ�U.1��G�(�劚��U�5�p$�>�Y�n��M�հ�mH�w���"bFD�p�[�O�qSJ�ɎM������� gSU}�!���*S��{��wKm�N'�E�A�J�� �G}�5 5˾{/M���O�f��K��l�=ÌX�-1N9�R=dW���Ϋ#�V1���0��M���G���F�f@�re�ڶ��b�u��B�9���zk����Y/�f`��'�/���#�-��� ��E���<^�'Vo a�=�~)���mZ�h�X��$Ipf�[iJ,]u���E���&��H���r#�c߳jPzuT��S8��f�/�0���++������;x�68X�@��@&:bL��)�������nX���D�j}9��F���=�o�.�������x���:�x����A���`�s�Z:�7��µ0��)d`�ٳ>�^�])�L�G�ʬz�&ev�گ�7Y��Ipˑ$SA/��6Z��ws|R��sa�C��i.�=��|Du���~�2���I���Ō/!�➮[J���*f�8N~�3O��3��a���E\$!7�ͅ������< `� v�]��y�\��loE���2-r�Z�tU���H�6�JJ�/Au�0��� �E���j�t����6����an�_�e�Uæ:�wB����s�)�u2f���H5����?}���U��IiD��� �rn�pxxjg�,.�;��8�G{9���1z98DE\�(hy�u��5��c�r�iZX9�vFw��t^lDV ��ޥ���N9NqB��~������(u��)+2Y�C���7��zPJ�]�vG��0�5B�$"��P�҉�6z�-o1h�z醳y`D��E��K�E(�d�Am�r��tp"��@�0+kF� ��A ]o����#�;7�������[g�y$�և����/��֫/��� ��Q�,���V��'j>��lNlk~k�K"�NA�������Q�����"zm���T틥-��Qc\�UXz��3���K���O�(\Ó%� �g�֍4!��e�f���z��\��dKI˔fE���k��(��������V���b�=���ѵU��K�|�A����a\=�_p�5k�}pU�(<��!��_6*���r����[���c�ȧ�5�p��,K2N�0E�E��Ӏ�UY�ӂ��r����!��,��� �R������6Co|Nc���lR
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20230703-en
General
-
Target
de_up.pIGRZHkB.exe.part
-
Size
3.6MB
-
MD5
3bd0ff09c7d5255299c63cd4a44093fc
-
SHA1
4893a34895abe11d8d9ec02a754c043b9f2d9a85
-
SHA256
dcc9dd048bcafac1f7b75ceb4096e58d3465888eb96e3e92a2afaa621538c1a5
-
SHA512
2bdf7695e6a35642ff662dfe389a1242f7f344e258f16a36dfcc279da73b89c2dea9017dbb661b946a03bb72baaf283d21595c33047ce16f205516b6b491a700
-
SSDEEP
49152:ow3urGRGjf+vQRb5gkIsZb/A98B6fJJal36SaZqI2hLeokN7TrM3GNyBs4UfCNrs:JwGR0FG56b5FR6Sm58kNPLy8fMcEN7KJ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sample
Files
-
de_up.pIGRZHkB.exe.part.gz
-
sample.exe windows x86
d69a0f393fe53d001b84bb2db8204cd8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetFocus
gdi32
DeleteDC
advapi32
RegEnumKeyExA
shell32
ShellExecuteA
ole32
CoTaskMemAlloc
oleaut32
SysAllocString
shlwapi
StrStrA
gdiplus
GdipCreateBitmapFromStream
ws2_32
connect
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ