`� �%��`�M�&� ���߭�(T���5��4U���8�F{a0XEd�Zs\�p��H|�<���i��þn�@]�'m�F�0�6����=��^ŐB�&�_� G8��Ax��,lp~(�b+cbK�1�U���D�����p�v)��ۊP�`Y����x8b�uֺ�~9Զ'Vv���*t�5ܺW�vSg`v]jy��y�+�+ n���xP��[{1wG}� 3%g��+J����l����!n�K���@���y9oC;��j��rv�wߖ��`��H��s)"8��(=��!e ��R,q��6���r率8a�,��O�_W-P��2:շ�ɰ��Xk:o�CL��Z�gn���R� xZ�fٶ�ZV��[�g�(��-�ƛV�M�L�=�����NŇ�C�=��P5��ţ��B>�DF��z�)�4��?f�am�D��s?�꠷�c�@B���u8�U�5�W[\�E'ț.�#!�� ��{�����Пtr�B�������bD�@b�.:V.F��~Q��/�恿sx�n�'oV�wM����x���4�=���z ���U��<����������߰�!�@��s���i�=�8c���QlY��Ip���Y����p����:;5P_�܃���u{���T���Ej�¡j��Q�($k��$ W�Z�Xޓ�~�� *�r��%Z�Bi�j���a0z��4H\�.�w�@�kH�D��"��U�_<���^��_�E�K�6���Ge⫙r�3[Ff��m�g�����nHߎ�N6��֏�y�t��m��C���&Q,)h�7QG�W>G-�2�AN���G�gE�Ff�%�vT�.%��U(}�s�� %��I���<Y��~��关��z|`s��)�y=������q�橅�3�!!��$d�����>"$7��ΐ%F���"�C�{r��,?���V=��?�����a��$ ]}���S��acA�����d�3�p2Vbz�}M��.��C5*!<H�qk��L)�؍Jk�R���pr"@��W.^�ד��_�DiHUst�W\�|��;�<��Taq Z�N�)C���d6�p����/��ɭ)7̴�����P1��n*1�z|�s@��/~�ۈ,���T����W�����E����X|�8Ӳ�����e|��_/=��qʔ~w�����F����4�%����U�oQz��*���y��=�5¦�mD�K$����c��P�m�bw,7M��n �w 4�S7����=��)��>�n!��A����v�O��߹�`e�Z��6�O�W�/��ю��f�*C�����p���_2M�u�ٗ�2���ۀW4����5�0��T�Nm��V�V�G�U*{��41h���%F�B ��#_()O���M�R�K��6�~�ȇ��+�ξ�$l�m�Fⶋ/���bO����>_^�@V�cD��- �4����X��)�⒤n�zQ��@X�}�Cl���-��}|�Ln���s20Z�;��^p+g2 �W�ݍ[�,�W24��j�̕��T-��a��q�)����6���C⚯Y%�#`�S��ڭ^�r����&�rgS�ی� T�Ĵb��*���a�������ؖ}yxP�>ށ��f#����URH�wb�/0���o�K2�-��?(�\�Z!�g�+�{�u�~���кۙ�sWs����_�v����lKG]s�z���k.��ri|����ߏ�K�*G�������[t���r����I3��}��G\��d��x[nW�lʩ���i�+ �l9%;�@���;�T4���B{���e,�v���?%˹`>�=b� �wKѡ�Ls-��1�`K��� ����w��S����{�P�>���N���^WԹI���A����W��w�2����~@�g۾���� ]���,��:�I�K�j�qL�CMtF,V�tյ ��hۣ�Z=P�����Uo$֓�?>����k ϓ��^�����C|�4xs�,_�9[��uN(�;F�sL�0b�-���m ���91�9q�I��N����^�)��83�q$�&%����?8�D��'��YDj|C ��w�}�e��t�������C���/�A�O�K����S�`�A`�b���h�k̙ע� ��@����t>�q���342�"9/?q �!&�aؚS�x�J bB�͎�j6VNF�j�w�C�G�A�A����ώ�W�k��RM$����-���ޏ`#h3k����fCEݪ�%�7� �*�v{g�\[&i���d%}Ac!IʍƋ�&��E߶-��M�t��4���D��P�ڏ�R蘫��Po���Q��I��}|=�"��!�+W3��>ߜZ�K�C�K��>��b�������Ѯ��IܚnXKL���C��[�O��Ql��uY��ŞĜ���M����JƄHt^�d�����[��}V�zK7�C��p��,a~,��RI~��kC;i���G�D��o������4�x]�A�Q���8�K��7կdp����/$ȊT���|z�V�����B�s�q=�w�y�7Lsa�<w{�'�}�sS4�،��#�՛��a�<3�Y�^���ڛcT=b���$mT��Av3]a�i[>�y �A���d���ֵ�:B����&�t%�RG�j=@�e�ݰ� ���BӤY~��p5��f��%]Waa��gY��I��7ig�Ze��r���J��/���� s9T>j��l1 \L\������k��#�ې�L�]��N�[,E/���FwL,�:J�?\㦔��p��h��z�M|0xes���ŏ_f�+���3 �%X)�k�][VfF>{4��nZя�|��dDM�'�m\�F�"f#�ʦ��G+�p�>�G��M���1��E+�d$�,8ܞI�Xb.�m�LN�ܷ0#g���k����.���h���ӡ�3��: 2����@��y�Մ�g����vU/i��Ϥ9E(g �j���ͩ V@��<�&�y=���K��E��~R �6$�0��'|��p̭���?�/�+�
Behavioral task
behavioral1
Sample
完整克隆8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
完整克隆8.exe
Resource
win10v2004-20230703-en
General
-
Target
完整克隆8.exe
-
Size
1.0MB
-
MD5
9f6b5cb1d118cadaf1e81d97665d86c2
-
SHA1
43b9dba7e7ecf84b8a770d99f5e624c5d405dda1
-
SHA256
faee0919269371892d80c8a9ed9e96edb74b326a70d322e244a3a04c7f2fa990
-
SHA512
2e2fd6561143a4c674b89fda3fc0b43e23b752e55cec0facb1adcd3f20a7ff907dc57f62568589b6a86c68f210f6b8c6102d321a931e25a09f89a79cd8652aa8
-
SSDEEP
24576:C3zhlKC3UktdxTYzyHwOaHicYzdpJjp8RBPWLUWXexo1iSOsO7:C3mCkkjxTYa7zJdVYWLZDUB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 完整克隆8.exe
Files
-
完整克隆8.exe.exe windows x86
02049513ec782d2b0c07f3d54cf75b4f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RedrawWindow
gdi32
GetViewportExtEx
winmm
midiStreamOut
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
SHGetPathFromIDListA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_GetImageCount
ws2_32
inet_ntoa
comdlg32
ChooseFontA
Exports
Exports
Sections
.text Size: - Virtual size: 548KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 784KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ