��x52h�����o��� ���@��;.:hs�7�sS[����Ő���{\(�Q(�4_^� *x�˧sJF �=�T#����S���T�!���t�/Zo��)��@�x��Z0J�ނ[@_zQi\���D&٬�I/N��q'���i��jt�t��/'!�U����� ��O��gHLJ\�S�D�F��2jK��8����������ۗ���%���������J_���ͬ��;�%%=��s�/+Ǵ����Z�SC�� ����: �z�t�1U]��W��m90����_�`�-�@y��c�� g_��t����O���sz��d!8�T�Qu?�ÂG���;���`A$��N�| �cQ)��.����Ol<W.-� JgRW��dc&����O'��<���#z<Z�? Im�t��0 �:���w�4Z�������!C ���}YЎ��J�f{�Q���dž�B��8�U�Dm}������i�X�Tc����S�t{��`�KW��D%��qzˬ��b?uU?��q+Z�9PK�����|�iȔ-mM͗N��qd� �| �&�jլp�߷����zQ�S�;�x�C;Q�Y,!v�d��u$ >+�>�%�F�R:4t��1С���/[����@�����?�������3>6����Qh�,��)�.�ӓ����PxyO+����!&���3@E�s�����'Re}�Ք� ��Fe ~�^ܘqfZ��`�������!^�]��Ő�n1(Ľ����OJ|�O���p������%r��H���W�}�ʖ�$�a����f�T�A��K��3\ȫ-u}'��R�U�%��@prX�i�ϓ2�!� �x�q�$�ʝܮ�W�͘>���.1�Wv��:Je�JX��2�����]�ǰxV-�(�Pr���uq���[c�]ﭼ��v`!�Oy�p�4mD�D��pѡ�%��Ƚ\�?1)3g���i�v��vaqJ���4�#!/a����_�&��N�X(�! cv�4���EJ/�,!�2���0��X��Ei�2ֶ{�1\�g������T�y[L��\X˕�ƪ54a��v�S�O��r?�ϵ8��n$�� �.���Iq7��]ߜm�Cl���!��M�� &V��F��~��#8q �u�J�FX��J\���N���-��[U���:2k�fv/�_�����M��]���iL|��(�U+��|s����ceS��쨚�!/[���!95����}���I�zS�� %X�c�F��(���!l���<�A��p�a�s�G%`��\MwԺ�D����/�,�۪cn�F�Mu1r����a���@u\�a#���~���F!Q~[�,�@�[��൩����a�d��^C6ǡ@"Hc;Pp�F=4K�Pֲ�YMw6�2 7"�]��*x�w�����������w�b��0F��;�dM���X&�-Lw�E���I់b��ƶX��rj�R÷���9�t0r�� Ki=c86PdTX~��g9z9j�`�<�����rP���K��*����%U�iGMk����F��#��u��c7܉Q�ۻ��(��� �� p�/Mű�~���i���N�1��2�w��(D^����`D�# ��K<�����%Jr�.��qCɲ���-B�2z��@4>[:q7�����}Ih�`�"�;l͌#���݀з�t?��BVJ$⻰�/��ﳤ����k� ��,��\��m��&��%PG�:D����Z�Ә�̨��R0�`M�v�7S�Q�ѡ�,��z�c��]9w=7����ͱ�`�G* M����v͜�tv�;U��|#�#J�W Bv�A�7�Le��[]Px`�H z�fq��q� �� �8�k�7�d1�]RF�t�e5�)���d�S@>�x|,��4�VB?R�lRB=A%c3z3��?�����u��w�I[Y��?/��(��a^K��B&@r�����yF����6�z�7��U���;¿�������ޅ����G��7�i��v��8�����`����SRw%{r����Y�jQ���xɖ�y�T���3Fw�"{n��we*�i�{��MvZ���K�99�2�?�]���BJ}yo����4��s��f��y�z2����W%֕��[�k�4PZ�~YL���y:Y~��K3�B'���wf�թ*���mfA�����s±�xy������|^g�3������X�(�Ĕ�AO�ﯦ����23�KkzBd��1�O��5�l[a��$}�}�8����e����A#����1ص��`��W���9,�� �Z�d�b��XP��τ�,�E�)�V�J����@�l��5������#�p��@!��ȱ��=�E�~����Y�x.?�Ro�0�����<D�E�a�6�4y�&WvxdWu�%A�]a�eU�k�|F2���,�bGRpMxĎ�������F��9V���>��l�O���F�K~d�������捾�-3�3�5Xy�=� ¢��Lܲy�w9]õ�Ф"%)�ORߣDI�t�~*�e <��{��v� '͋�y�81�A���\A��:����K��e�3�ϘÝr��*�Ҫ ���)�ӓ���S�3�@�6��K�U�"���~���,�/�U�^'�!����l�Lb��`W, �~e�u҇��s9����6ܩ��@��M��q)ιj�?pw�џ)�����Ճm;G��/b�}W�H(�8��pqG�Ւ����������U�cq� @|z��P��d06 7��x���g�Cȴ�F$�i�*(�;y���F:P �.�A���O�B2Wͥz�ȝ��� s��e���@[Ay��_rD0n�ph�I�Y"��+e ;&"��la�b+�G�_�(d�p�w�Ձ<&W @�����Eq�f��z+�f�����Y]�V�T���~އ�����lY��t��adU �6��_3���n�ژ7�Œ��dBF�#W�!���T ��kipV���|e��i�J7� ��8"ԎB;�D�3"C٫!=�:�c��8u�O^��m5�M��7W��r�k.ηN�ɲI�,��^0��v�ɺ�ħ�{�6-�]��UJ�~
Behavioral task
behavioral1
Sample
Forcer.exe
Resource
win10-20231020-en
General
-
Target
Forcer.exe
-
Size
4.8MB
-
MD5
9d7f6b5a015a6b6c4b662cab81516f35
-
SHA1
132c6968d98baa05394a084669d9ac541262fe16
-
SHA256
6aa903849c567148f51cca6b6fb380714c382b4eb8d7bef8a42e6dcbf1be5bda
-
SHA512
b814c1af42c924498291a8e7bb68b8181eeecda7397f475c1a7b2a5ee4c7186194ad774d32c5a619ee0f5c25ff69254c8a8b5499427fa4fdac9827a351a642db
-
SSDEEP
98304:obQWlOLeB4SF5OOPj/kGYwkbyZW0vAwBs54ewNMSBRz6:oCe2SFAOPLkGYyVAwBs5yNMWR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Forcer.exe
Files
-
Forcer.exe.exe windows:6 windows x64
da975b88cc32e6c464ceaaf41d060ac9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32First
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ