&�E��l�a� �Ú�TO��q������D?K���Kj<Ox �[d6"O��R���.~���F�c��k�]�#u�`��Ά* j$�-���1P�['��r�����a���T �>�C?��c[����������ռ;��FB����,\�9~AT۳2��c~Y�t��R�K��?o��}$%c��Ap=Z���r���WI���*���ܰ(���F�q��Y�P����/?L$ˆ2L����{,����C����tmaC[��9��8�o2��Q\��S�nL���t7�@��n�3���� `X��ۢ��˭�dCқ�Jsғ)@�����W@Qd�6�-i�*��y@�1�:V깑��an����"� <+���Ak�a\��e�p�R��պ�¤%"�5����.^��y͜�7:U���?�>w�z>H5i� �-TkS��9��4�a����$F"�:�`'ZȾ�.�^4�]�|aRn��N�Y�:�o4t34��[F8ۊ�^���b��(HV��f[�����p�/[���(��+KQt��Wk1v�Ú!^��^<V�8�Ø%���[8��v�{\27�ړȇv�9�\Y ��������G�̒�{~DJ�W�������p�r�F�s�,��y $��j[G�l&�m����ȵ�����ʛ��`dm��͢����ѝ{�3���/d��WL]���ò2E'��� � �<�/���5۔SGL�c��e��j�e�t���Y�� �F �ѭ�����I�P�������f����@�Q�nH[\�O�%�v�d��F�����㈎��Q�UK����^E)���ݩ����ϱ�z@�)zIꏷ�uu��T�����hyl�廸��%��ͨ��ڴ��]y�w,�m8ǭ]��Zn��{�#�$�f<��ga��|j���R�y3��U�y���hj�� �A�D}����t�~t��;�`�P�}�L.����2\��tJ��1Z"����b�������vn�rQK�?�'6M�:6t����D�lM�{ i�&,H��(E���C�U�����%��'Z�9H��]���Oo�ӣi����xXA�OC�O���ɬWIİ�݁m�(90�+]�s͡�5�}� e7�>b4 $ܒa�@gA�����tVp��'E�s��;��W.�/T���…v��cDC��-K�e� �ͦ��FWV҈�J�v��+�\�sXu�9��4Z�T��e>X�&��ؠb�J/�-���>�zֈe��]�tU?\�0&��-� ���,,�_�R�U5Ot�������le)�&����okH�x���� c ���X�b���S���Se{'8�(*�!�#� hIE�X> ���ث�h`��S_��,�J��F��s��%S5������e��P��z���R�XԙZtA12���=�Rd1�Q~�s߁v�� Y;��0�df��볊��Y����i�H,ff�)�W��p���P�o�uNS���l�u���k�E(��8��SDc�P)ZN��xuґ3dg�\y� &�do3m=�������H�G��˅���8�A�rv˅���$����@��z�Z��9����0�eyz>V�IS�Ɇ�J��y7X�o�L:\�#M�ÌM�Nn����<�g�֖KV��X@�ry��wHNMr�E�C�5(��LjńZa�$�V��TT��u5�����kX��Ā��&���F\ �ie��D����-�A�Y#9jS�(��_Ca'6��*`�,p9'[�o��z!]��Ҿ�h!}L���X�1��q�������s������C}M.����#Z�tb�v������B�� f$S�w�B �`��J���eH��>�eJe���-�Gj�t����׳�:��km�;�~��� �fΆ3����l��� �-(m���#>�������pQ}���e¥�����\����˭m�:� �՛��!����Z�v�ȺȄ7��uԍ��������ё�ϖȟ�4��G�̤� ��P�DK��Rx*eAO��Su�Y�31 �K?_�"��7�#γH .�������g���0�Pa'����8��V$���$�i��E'�f��&�N�����1 ��NE�-�D,]rL��n��.v: H���IGj��[v���lkQU�e�ku���9�2p��� {,G�m/a�� [ȹ����.?�S��"����RN!5{�7K���=��5%3XR9����6?$�ŋ�Ԣ���WUi��u�<������Q���D����pVc�9X��"O��Xχ��TV(]{��;��F��9�1������n~���"l�1����H�u*�x�(��'��A�6���S��������d�F�x-K|���:�����8�-#����p~5v�s��W����'��l��G��Q��I?�R$��/"y#�����K�ł��c��ڶ��H���^�>��go����)���yNpC�|�{{� Ъ����! ��m)�Qzz�!�c�@o9���Q�wFHxkզC>�/���9���=��W�c���BЖẗ́��>��p���ѳ~���W�)m����˵�Sю+��ߑk@V}{?�_f��e~���kB�l��������2�.;h�(� ���8�>������^� �0�����Bz�� UFS�z?�5Z!��u7X���\���2٬�[M��~�.�\��ӟ�P��S��iyN�4�<��4�f��4�CO���m�kt�L����i�,逶�J���<��5&/Dg�����}Z����H��?�ܒO�����9tL6�P���DAR3���E����=Ra��v8�8gx8�^�X�F3��})V-y�qi�oy�2��Cۿv-%*M�v�L���prws 6���� ~_��9��F�v��x}�B��H��U�w�|����_�/�}�.�v�e�∿����~�<z�gʙ�~j���/� Ƿ���*�_�_��m��W]2�9��Gr���@�l���F��gƑx#���yo��;$6������FW�� ��P"pg���i�����3�[�b]����
Behavioral task
behavioral1
Sample
eagle.exe
Resource
win11-20231215-en
General
-
Target
eagle.exe
-
Size
5.7MB
-
MD5
7a030147ac5649ea5772e4f3bafe6759
-
SHA1
5e7ac16b3749fd06fe594ad67a376203bfd9e794
-
SHA256
85c55d19c00d3924954d05477b6ed7083b1d70677b222f6d5c833edbd732a815
-
SHA512
d477ba1863cfdc7e26756e10c78e3fb9f2eb9013055add6f1f4334c8007fd904a157968ff5e80613d7a6a8604aaca9a9d7a5c1e8e00e87ec71f70c2776bd47ee
-
SSDEEP
98304:QWbpFq9+sQ+jDBhhkErWplu9vbGPiujpZuCCwzM4QEOICxUJsWsOhglRoi:VbpFS1DfhP4+v6PiujpbC4QEOKJPDyPo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eagle.exe
Files
-
eagle.exe.exe windows:6 windows x64 arch:x64
69e57baf9f3d9390d0cb02ef35adb67c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtQuerySystemInformation
kernel32
VirtualAllocEx
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetLayeredWindowAttributes
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
RegOpenKeyExA
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
userenv
DestroyEnvironmentBlock
shlwapi
StrRChrW
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
dwmapi
DwmGetColorizationColor
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
log
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ws2_32
inet_addr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 641KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ