����)VI ���{J�_$2e)���ѱg����{��V�vD[����vXT�c���EOJ'�H6&&��$����2ϳA�����Jڒ��㚔,�f-F��l#5�w�7�l�d������1�7P��S�������8&�W�+z���if5OY4�oe�(6��T��:���[���{ba| �����ڱ�HA��w���Eu��7�?C�) �V�=�C턲j��v,�te �D�a�?��5̻�줿0���������^�F���t��5$�(� ��S�t|n.�Zh{�@7r[��<���� s�ǔB��yhs�*7����*�c��s�a���8�C^������C^Xꏦ;�a<D)��sgH|���y�\ [����}[4�3��j ԩ�t��K��U��W�L1 @]�c��3�ܹD�:��0�V|���gpt>�lҖI�4�&;,���k�d{_3��U��vx|-��fɒ����%�,��PT �?����L%�M��L�{�ZF0إ�'_ ��ԞN�N��a 9x�i����w�jNկ�l����T�H�7�� �W~�1�-�%: '��e���1DQ�$捧S8"����0T,t�l!\}�!:VeD Iyo<�MA�AP=@m�{�D�C���f��L�����X� :��OuD�q݇#���Ю ��]ڏ�*�$��[ݠg�l��˺�n~-�m�������D=�����r��f~���3�]`�I�ߋV�{6r�9�H;��O4�R�5�L.Z��:�kq"C�R4�^hQh�5L �P�4`�����"7i��K��)*@�*RSQ�}N�S��;1���,�X�Zh�%@>e�<n�([oi����5|麗%Rb�NR4�#2�?iV��9�>�����E�_�'�mg�>�1�����s�6�������-rX���"�rx8?U�PLX����"ܭ����Y���Y��,�U+ �L�->$%� ��qBՙ����疸�H�����QN�?EژN[���h]$�uf��i:k6�� ����̻u��6Ĭw�ZZ �Q)�b���0�1��%�������Q��Z�'��$����M���j0�Ds)�{g�9JR���LE�)O��=��0���v���"�� i'��⯴5[��KI���Z~&D�3��ua� ��b�M�]��6-�{�R��e7D�w�\�O�y��r*��� ���7J � ����D��|Y�OO�Y���U�'�W2� �,`���X(\�s@pRt�3H�p�N�X����tf�g�M�j���W��c���H�K�):D�;��/"=� �I�����0�x����5�y���B�$�$��?�s���f:�_�"_g���C/O�"�Z@Y��"����ZЏ,��0�U���R(8�����-{&���{��:wr`]����s������}���Ρ$�T� LY�a %Ǯ+�4c������|ʣ�����xÑ���CڽG����1��i��������=z��E�g�R�4��!f��!n{���Ld�v2�kX�RZp���J���W���>@u S.�VHd�.�Q���t >�zA�b��`2��J�=��R�EgFs�`��BiQOI������������ H�x�`��:`���3�CW� ��o����7B����Ģ���PG�'y*G��+� ����9��5���=T3�"i�}A���f���LT�.�)�i&�a�*�r�Oa��t��1�X����)6�9�v`��#�h$k+R�5�C�nTw���D6�B5�*Ic��bIu ��C�a�t�=���ۼo���(6����{P��z�r�Ӧ.2=d���@�DC���TWi_�Jh�K�RW��� �A+���R5u%�D��?oy�(�%G�7�O8�U�7��ѻ��CmA�l����V��`Α����O&J+���.s4�����*d �{ߗ{F�5k��\�w�-�<O�A�[�U�z��Xi�a��2��i�Z%B�0�_~XI�F�2��o>���Yf�$1����A�� f�L���Jp�~�=I]Po�;�B��&D4+�kH &����\h�'��,B1+¥����K�Y�6���d�)��}��d�;��ps�;0����^�|����),��E��Ԃ� `��]}�U8�t͝�Ty e3�8X�[��B �)��I.�E�q�<�������lw�vw����w#�җv'[�I�c5P���;�0.,.QO�[@%#�PXp����u$����b�=:rh`s�����'�5Y��;��E��2�>"�x?eN�����+�:�����ثcI�9����a��2���������f�gh�^���(PZ����d��S%�C���AI���[[�u��k 7�2u�Б[m�9���' ��{�-���^�9*[���(�M��L<B��lqq)�#���L^�ر��O�j7�E�����iƄ���9���k8�~p�G����<��9�!����QL&����T�T��'��Sd�SD�eF�@έ���dD#�� 3X 5E���)�f� .��o�哴��&�"���t��5�?}�K���=>Y#Ѿj:���N�n�-\KԙBǶ�c��D�i��{�⳰z[���'*v/)��*�v�3��)�i��I�ƆJ�s'���M����p�ӵ���r+�Uk� ��B���2��_�dkm��s�a�?��r��4J�ݤK��b�f�ZX���%��1���:��&$��l=����h����7�2�=���t�i�If����=�K�y�n�A������� ��~� �#Hv�J�/�jx�)���?t� xT��Z�����e��#�)Bzb^o�( 4���v�E|�Sl/���+�Ӈ:ɝ�ׇ�rr�'�`G_�EXn����O m�U��q|���������C�Gj���z$n�̘2PLQ$R���j����6��*3��l��ʎ���r��0_p�wԒ����@�xу�sc��8To��9�m��p�7�>���Ǖ���W�U�ٜ�d�|������V�F�ٿ�Cz��{B
Static task
static1
Behavioral task
behavioral1
Sample
Promethazine.vmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Promethazine.vmp.exe
Resource
win10v2004-20231222-en
General
-
Target
Promethazine.vmp.exe
-
Size
17.9MB
-
MD5
dac77e14897d4dcee855ce816daa5e26
-
SHA1
d2c080b6cef35c3c7419a8e863683571d99d64f6
-
SHA256
1ed530677746bea4a4b7026d2e4e1df85277c180469e5bdd0e05657b30297175
-
SHA512
5630aa9f404564061f8fb74d24b5eab55dc511d1afc332d01230824fc822edc378b49cb3767e5e0b3dc98ef5e0275e9a49e465f4048bc9ae72d5187d18a8e2ed
-
SSDEEP
393216:9dXzAwBQaVMJHE6LkoCKycYfdkRSZE+LKpmqVF5:IwExyn6qCwq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Promethazine.vmp.exe
Files
-
Promethazine.vmp.exe.exe windows:6 windows x64 arch:x64
fb49cbb3a5048b68a6ede55435ab5646
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LocalFree
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertFreeCertificateChain
ws2_32
bind
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
Sections
.text Size: - Virtual size: 498KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.`h" Size: - Virtual size: 15.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.{?e Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.u6A Size: 17.9MB - Virtual size: 17.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ