M�R�S�3� �T��Q�ױ��O�QuǑ�!ItuW�vZ��pkݓ^A��۟о�����/�W/%A�Z�o~�A�&_H�@Ʉ=���М�nY_�{��$p�A���]'a��筂e`�rC����5Q��?i��������k Hdf mD/�����QPZ��gE{�P<�c��c��_��|j�+�y�� f�W�c#D�Z��P�A��|Uo�"+��]�v"�-P2��SV E``��u��]���������$#i��D��4ވ�� V�w ��ه�*"w���V.G�����k� �u���>�����JP)Ѡ�z��P��K��$1x����� ��h�+����:Z�Q= ,�r�AcI��*�<�xM�fEM�BZp�:����9U3�p3���P��Q]�cљ�K�K> ��z��Oo�}���,=����P�Ν��sR��a�_J��@����]��� Ϫ�� ?�u��-��h$�la�;��_�4�|�&�(�+�@���dp�q�e��"���]��J�Q7Fh0�L��!�f�7w��`Ԓ����������o����e{�S�}�� !mf���(И����]X�ebPS@�z������C-_b�}%+�YRV�>'D�ͼ&�Hߏ�=�ք�#;��z����<�t���މ��;��4ܷN� <_g1ǝ���/?�T�+m�>�.����Q�)�w�wb���*�J�����5�;���>hN�B�&�Y�+ �+���k`) �� 8Jf�5D"\9���}�b�Xx���'�bɣ�v��!]��Z|^c� �ǝ1���4���H��� %^4�k�W��r��=Y�t!�������}8��~�jђ�V�NbHZ��m`g&���@��A3-�yW�+��8�ӄ5c7q�q� XŤ�<%:s�X`���: eo=s�� o \�!���Ah7�YUBM�m �����H$ݜj�'9�A��?ru�����Ū�ID_�pM�;���wl���� �`/�{����D�j����ё�>�4���B�b�ƈ��jj+j�ʱ*�v������\�~��$��#f�5: $)���=W��5ʛ&4����A���w|��|�[�����o+����� � պÉ>��3� ���|�L�dS�K+p��&̤"��-t[���8�@ ��8m�`�Ex�~0$2���W3~n(�j?`IE�͍x�Ȍ��?����j���@�a�_�����\tt����HYaEl��*��N�#)P4(���zG<���X�|�Q�"��% A����� �,�L��$�n^�s�m�쬿G��H[l-R�&�殛����Y��G�4@o�*s-۬�E�:E�%�L���fZ�n�ڞr�Y�<�X l��ïV�z�LNTE��=��мJu/ֲjC��s�g�W�b����4�բ>/ �73(�<�S,Q��0-�EF�m��l��b�$�q��[Z4-�O��wz.��ͭ��S:� ��e�-��2��k^���������c�2m�"��@��?[ V ��.3�rrF�����W#���z�� �x�}�,#�i���:�g����틦�.��#D�X�>Ϸ�����TlmH��8��"cy��J��f0��xt���?����5����GΨ�p�� ���%@̦u��P�\ՔI���6�/��=; ���f�P���%���.q;�,3O���� ��#c�n���>�����@��L�����A�Hݘ�Ƥ1���?B3��irLH�j#G �+C&��uF�):w�Y4�?�) ��ƙHN �w1�&(*�'���k�]Qi�}0�Ysm����&0�SwA�x�3;uv��� 3nw>P�-_����KN F-� ��j5�@ڶ�"�( )�/�������7GN'R�����O���M��v�(�&C���Իo>|߿�{����d���)�U�X�U�0� ظ��!��_���cz�+�I�0X?� i��C'���n��j����dŽ˝���u�ѻ y�!��o��4 ���>t�Vol�(�_�f�fO�H��q��^c�\4Ls��Z�l��� �P����l?�2�S����jX=��M���x������-������&�??ș�bR�8�2 ��� H�E��RL��.߿�cx�X�},ּ��`��\Ν��2���0�^�P������EX^�4C߄� ��pAP�rd�T�����)�s���"�rix���|��WI��Z������G( �TS-L��ο;���]���ėng7 +�T�?�������Wo�fE����u�jA,\�=�d[X���B�OM1�cgm(P�pS7\`��Lt�T�Iԍ�J8�Ƀ���fh�_�<�o8c�H��Τ�����ֶ�.0N�Gܥ�����ѽQ�{�t.*3n���N>��V����e��H���O�����L��,�Lu��/�7�IkJ��ʞ���{�"���%!�����q��+@^��q�E�șH�Sv�6?����X�kvO��5��e9��H��l0)�JҾ��u^��Y�,���_J���X ��gڂ���q��/�� �=$.G��@Rgs��"�S����{p��\Џ�%&~��C�[k�=�5����ɥ�iVt�Y����h~���'���T�@��@�E�F�����f2�S�ңA���1���VZ��5��bBe�/�d!*�OI���v�k&��7�ϖ:�^oA��SD{;��:��0�#�E�}-ێ��{�g�L+b>'�*����d5�����!��v`۔����j�[��r e*\�Sɿ"~#���zҩ3���^�[Kd( ��P�!�{�x��L����gХKm�ђ�$a�5���oC�S�Q���n���W8�I4hփJc����F>k�܂��\k��SIFͽ����:Ʉ��Џ��9H�H:Э�2��N��?}�W7O�z]����'�L[���?��'�Nf���Z%�T�Q^��"�cﭢ��-�����}?������Q=2�^�z���q@�����̓� =%^��#�a��(n7Zq���?W��AKZ�M
Behavioral task
behavioral1
Sample
eb205950986d6cfe2928cb3cc4934b745e932d6f073e8927f55302322ec20ce1.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
eb205950986d6cfe2928cb3cc4934b745e932d6f073e8927f55302322ec20ce1.exe
Resource
win10v2004-20231023-en
General
-
Target
eb205950986d6cfe2928cb3cc4934b745e932d6f073e8927f55302322ec20ce1.exe.zip
-
Size
5.6MB
-
MD5
bce21629df6b378ff5c0fe5754807cb5
-
SHA1
1fa7237096a1142923c54309e34a5a3c8fdfd42b
-
SHA256
635496deb361fa89302527585e58ebc78f50f69118ed2a2491625988de7c00ad
-
SHA512
6d3ae99fa8691cc557682cd0e037c15cda59f79906c44f0b4a69651f28d866b0c3f6a712e0b9ecba0706043728055f08a00aec08d9fd72c450420c588ccc1b85
-
SSDEEP
98304:mx+dvgV3yf0GRIExDe9lECJSrkqETnqIZjRx1e38IEsQ9AM8ik4D0f7gvejXDPRh:iyf0GRIcYlpuNWqUjRx1esIIAM5W/R7F
Malware Config
Signatures
-
resource yara_rule static1/unpack001/eb205950986d6cfe2928cb3cc4934b745e932d6f073e8927f55302322ec20ce1.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/eb205950986d6cfe2928cb3cc4934b745e932d6f073e8927f55302322ec20ce1.exe
Files
-
eb205950986d6cfe2928cb3cc4934b745e932d6f073e8927f55302322ec20ce1.exe.zip.zip
Password: infected
-
eb205950986d6cfe2928cb3cc4934b745e932d6f073e8927f55302322ec20ce1.exe.exe windows:6 windows x64
6414ec81f197039d19515b066bcf9cab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ