��"K�5�y���`)�����1i��1ٻ?��Yn�=CH��������:ga��fG��C=�Q�f/qP�ԇ�3z )v�q�� ��U�GI�F$h����m�D�?ؽ� �%����Yb�7�_�����J�G~3^.���A� �b�hy�~a�-��a&����w)Urs���r����xi%��rw��/&e1��6Y2�8T��$h,A۶9�8B�]�Š6 6�_�z:Rc*A��.�7q*��f�[�k.f����"���PC 6�����fH��c�j�:RW���i��b���K���k�X��v2H*�~���{U,� (:� C���Lm�F�-�ؿ�r��{mc��mGqu���Zgz��a�j�`R��x��.`>Jq�@9k�+����M֖�a�Mu��&~��Ba}iU��YS�>t#��1s���]`��0�w=�$,L<�����_��Rcܙ�}9�����I�� X"׃B� ����RK;����<�$���k���~�V�����Cw�Wd�|��qi˃+Mb�������a1(R,A��s+��.�`���S�dA`�{���j�VdN�^�O�Ͼ�G;����m;�-��ץpHb�cb�M���|�y) �V����Ǎۖ�B��܂��{��tY���� V�A�����MX�r -JYMHgP�ߏ{����Ug�4��o;L�����=PǦ鉨:O#D/V|���8��2^s��l�9�����&��&4H�Ri���|X���Y$�����>���J���}��֖h���d�(�9��.1��I�_.Η��/گ��/^L0�����������RW�J�P��%����HM�#��U�t��3�,��PL�7QH3���.���p�9�~qa��i��#�?���L�<Y�(���}�3��6nq��Ysfbc�9Jp�)�H�i�Hf���P"��X�m�*4<�&��{���>U$[xb���m=SUM����N��Z��T;̟�����A�6�@��<u�sID���]�z�}\w��01*�j�#��D+�oV��3��"��l��ZO�^�$� ��������O,m� �^�˨�O�� �B\�`�*c6]�����A ���\��>���S�Eͷ���1�.E�8� �Z�L@]��e�U���X��{Xؿ���1����V���@�H@V��FD���8G��ۛx����ޒ��)�ÏO�Yc�_^!c�RT2�ݔʤ5���rd-�H�wvъ:�B?�~'�4ć53������R�2�Ũ�M1�H�`kI6 !�C2������ 42�u������n��ەZ��n�H>H��ɽ�"��ȸ��`�p���/��u`,�1��c��T������~�|p�Ƭ:�؞���2�EK�.==��'�[DYHRNz���&���w��t}o|��=v��Q{�t���6����WR��kj�%L�QUm� ��Qn2��1R��?iR�����p]����+�H@�6y�bE�f�Jz�g@m�,$����r�v������\t�`$]2�\8��_I(��S��Ї������E������K�a�� �&���8��Ԭl���7�����J�W���nT(���$�%��J�k _�ʂQ %5&�Z�Z��������N~��#-%*�6��%���9hY?� tc"�"��}3HOpO�z��j�_4��.)kr��$��j���M�b\ ��@�+Y8̄�U��+D��ݢ&A/^�GE���(w`.��t< i�&�l̝H6��������Q%����Ե d���oT��R�y�r�da�$�<|�at�UYBumh��{���Xӱ���Ǔ�����0{����(YU�f��C��h��r������Q��,0�"��*r�|��(U~��.Y��A�t^ufn��5�1[ �"��:��5_���^���3��fZ肃 �������O˄�(��"�����x�L:HX��7?b�֍[���R6����p�?$�fĢ0�e������5Ʊ��tZB��p*��Nz��"hd�@��32,���jhR��{��WB�A,Ƅ����̶w:%U$�Kt��W#ذ3�5���{����Z��s�]�`,��q/~����oja2�6%�������H�Gj"����b96v�������\�խz���Ԯ�^����H��s(������G2���΄��=�#D#�QYiy�o�sXEF�X�%G"�IGvVp,qE��Ⳃ]fy��B43 T[M�w�ކl*a��Gs"2PQ�7��_h ��q�k��I��9u�.3T���#�t��(qG����((NEUje�rMt/��������N�R������.�p�R�LFb���-�ue�(U�фڱ[p������"�LW��W��5U�5���BDAk�O]�N?�-f��a��<Qa����kQ�j֓=�Ī ax���DC�D�94������!+�Cvg�XA��x���kFÖ/Ƙ0��=k,�B����" ��S�4u23����QPq$��$�)W��kK'�D�& YU�K�nUPaQ��py�{{�T�(ƛ�)'����V��Ad�6l�-H<���C�I�S���GjU��/ݞ�P��?p�(��B�=��,�B}_� ���I�ն8�J).AVSk������U����Qn7a�eF��yb��`B�4*ȈV��V�2'"z�w;�FZ��9 ����' �ک����i$Ѐ$^Wo�s�<f�j�����MD�L(P,B��E�T�w ��FB�������=�]��i��\�������ӡ�b���5�=��_{6~�� �%�KA�>q����%u�K����/.2�hs/�-5nM�� ���>6^+���(�8�@~�k�[����i��������{��("}-�$�I6������5�~��E7C�i�@0ϛ��h�T̟/P�TK� �0��˕�'_Ï�~�>�y�,�8����1�r���m�S�1gWa�̟҄��B>��_�K�ϡ� I�Q�Os.�%~W�K���]������T����WCB��,�60g���� �u�R��U@��ar�_�A�9h���B�H/-�U��6
General
-
Target
cOOla_unban.exe
-
Size
5.6MB
-
MD5
6857f16046fd533188f28606ae7586ab
-
SHA1
230bb3ad33960731a4ec637469197fe07d8c3234
-
SHA256
b3cbb74a4236bd44bb4bdc9d3ce5515a52abb470804de9949818d5d4989cacc5
-
SHA512
a5d8142c80d10cc9d5b4607ae6f6dffb5f96383e07194a226a575cf4c11b81730a57ea4c8423753c4cf7dc02cb2598fc2aafc0c4b0b695bd4c947921809ca3a6
-
SSDEEP
98304:JYsLCpbM7aFsTiyrkrGKsSdYNTQqv5uCtL2FdIjt4+gpitlCqg67g7xLxRWY:esL8bMRjrPKsSez5uIjVgpIlCq7g7XR5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cOOla_unban.exe
Files
-
cOOla_unban.exe.exe windows:6 windows x64 arch:x64
f5165775a6a7b20cdc2129025d9aff1d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetEnvironmentVariableA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
shell32
ShellExecuteExA
msvcp140
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
ntdll
NtRaiseHardError
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertGetCertificateChain
ws2_32
socket
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_exception_copy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_stat64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ