���>3��hGw���''���`3�����'ܦmO�x���5��ѹ����.�E�����|Z P��ܳ��Z� ��4�`Pw4�Ïo@�����/l���� �b�ߥ���w�)WL��o ~�|C���]�;���bʊ��g^Θk�.�$��o�B��B���H3�C@��5B�t�#ٹ^t�����IV�,b,�C7��'aSgî�*�C��7��f�/v�8�� }F����&_�"��{�o���%@��PX�vd��p���2XJ �P��XKY�D7����\XE��}�*�Y�?�z'���T �d����>�L���@i\� ����t$�W���݂c��z��Y�M��:�Oƈ��=)v���l*���_T~�o���y�ٟ?�{^���߅�L2������};��.)�Xb=��*"�j�#n�*!��o������,'es������ �U<�'��r�h���w���˪a��Eq�\!>�qs�x(-�?y)���w�%ɖP|{�!���(�zH;m`3�!��jR�� 0aeâ�O�~3�!*w%��5n����ٗ����B�{���*�&F`�Hgג�ۅ:�8 ��f7#6�������H�W׃k�}D�xtw�V�DB�E��2*�#|� H��z���ͅ4���2����ָ��3�1��2�{����I������{���/��ekhO�\p�+�@�Bbg���s<�����>D�)2������g��gf~W��m{��m�@�e*��'�T�I�o��X��j�k(��Zt�[T�r����s��Q_��oi�)�����.IE� PI���X.�`��Ճıtx���r�K~���R��z̚%0��:�����������@Q�� aۧ�(�{��x�YA�?�B��Z)*��ϋ)z�m���;r���>���g'��5��l�lɸX�iHb)�n��v7����(_����<?[��tdoLX�=6�/��� ��r걵���EP_d�+}S�Au��D5���l�{�I��\+�X���M�)v�ɇ`����L�����\�Mgጡ?6�IĒ�5���0���]j�{0HV�Py��!�z}1���=����岢=��K�6����occ�T�����p{^̏�&����EvF8[�k5��� �-`"�XlA���,2/�� ⽙���8jUj\�u�����W���:m��ց}4����iJxɐkm���E�B���t�[Y7� U��7X��,(�:����q��s;�F��)Ee�������s2r|����Q:)�fI�H���A��������ڍ��t�,d3��}�Q����l��_[{]4RG�S,�~�����P崕ˎ�#4���c�+a�7�_�Y@�3;�� s�nFߒNkr�����'��pp�1˴�-=3 �)���#c5�K�#Յ��?�'c�(�tA��jLP��~n�� ������4�{V�d���N�g�9��&63|���V�(˿��p?$��sR)n�l-�����[qz\zh�����'(�N]��o؉�<� 蓮$#�3�//�ͻ]w����,����Mg�/}���d�Ȑ�{��23����ؾ�ʟ�a�R�q�)�V�W^��A<}�H1fg���Jg0`q��7�U��Z��K� +�ʺϲ����]lw�Ď}�8�hE��^���jP��� b��q$z��� U��=�.�gM��VAt�f.hW��g_�O!7C����~����9���[�t�m#��Fq����4����g�hv�^��ו�A0�u�|��md�1��];��2{ ��K�8�A�C�`6 �p�S�L��P�7|�~Dk��w.�\$����o��6�}����K���D9C2.�)�=V����Ub��DLM �d�jt� ʗ�Ȏ*�%�-��֍���H�5)��3�Ez �X84��(��;��~�'��% ]>������b�L���R�bwEԐ_th���b�v�]���'�R�K�<H��Y(1 �_��aY(���̈́j#ZiWͶ�J�;1Xv}�ec�P`��C�䋌짠���z���x'��r��\W�ѭQ��2�}��p�eɲ�>��`T����Β|�'�"/~x�7�����c�^�"����P�a��jQ���Ht_D!���/�ig ���vk�nG�;����+�q8���)�n8��:<O���/3��� ����^=��"&��$�j��:p쿴l ٻX��#�n�4p�a^��L��t&2��O�]���Ma��>C�zE�c���a�-�zmj�T)�x Y�ܳ���BEK�������N�����S��t�f:�k䦜�g�N�#�Dk����^�SGߕ�r�Ԃ�X��ܛof��p=��:�P�Ȕ�f���~x��rߢ&3#9ti�ťȠv��^n�Aǟ�ѹ��zs��F8G���V�ϓ�:��;_&b.��"��f�m��=��O��Ȍ������}��8s���g�N�f�"��+:�����ծ>[�7�a����}i�Nm�N^6�_��Ȭ�X����m���+���@�"% ��^{�n��ͷ>��Y�O2��Z�O%�����W�Ohm#V��^"���n�sE-9h����/~й���^l��+��%ҧ "�<V���� �lp�-[��ӻ��̆�]�ǁI���s����߶��om ��i֭�sPyX�� �v�~{}z|����8k�7T��7��G�+m� ��d�ݼ���z0�㥣 �9#\��cv�#0��E|���u|�4F N��OƳ������l_W���?*�.�"8t@,�a�������X~!�OLBHÌ�V���R|E��L*����\C^^偉�7}G���(�3ًAgl@|�k��(��LĘ�^R�9���9ח���eRK@��)ǀW�s/l�MI�Y�~�'�Ԉ8%�"@�8>'l�� _�MҞ�PNԑ���x������jN;^�IjN��)ڨ'r�+t0���p��TW�K��}����k3���b��nVJ����Dɸ���z���p���o��쇩���Rg�U�tb�� )C��_�r���AW������l�]�a��wKy9r'N[
Static task
static1
Behavioral task
behavioral1
Sample
vlone.exe
Resource
win10v2004-20230703-en
General
-
Target
vlone.exe
-
Size
6.6MB
-
MD5
66a21183254b6434a39b51422ee5113a
-
SHA1
e0d7191f6607eb19796442671582dc8ff8aff39d
-
SHA256
bdea412c77eccd09280f1688ceb891ac6785eb9557380bc899a264eb84587e3d
-
SHA512
7ba09d2df5dec3e28f9d05445b773407e07863101e8dccdf46027a831fed39f5db0f482914540a1400a24b6be01fafb2b55623e3d98f75749439cd323d39a046
-
SSDEEP
98304:mFv+rsy+E92D7X6kTNl+HpKjsEh0OATYzQUyKbp4NwIO4fA4qxX3NhKwW+qMz4dn:sv+ruEYKkkBES3mQU1YVO4h+NhdaM8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vlone.exe
Files
-
vlone.exe.exe windows x64
07f4a6925b249308870ba65cfaaf0637
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTitleA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
CharUpperBuffW
advapi32
CryptHashData
oleaut32
VariantClear
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
psapi
GetModuleInformation
wininet
InternetCloseHandle
ntdll
RtlCaptureContext
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertGetCertificateChain
ws2_32
connect
userenv
UnloadUserProfile
vcruntime140
strrchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.u[l Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DE^ Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.^"% Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ