r�����%M�t���.���AJ- �%�v6L]b�g����8���'�y��6��Zβ&f��>z* b7Je(�WQX 8Uu�O � �ώ���� P���=�%|��6�^*��V�:6�=0����t�TM���)E����6�E�s%Z��=�k(mh��9]��Ly�܅�UKaðU�+=�i�'�斜K:�+����j��dQSn��)Ul��msE����q7���ч5u��Q��.�ٶ��\U�Y)�C��;}\2k"n��b^��X�q2���@���r P�aٵ�=��L^K�Б��|Kaς��ԭ<&�?�V����,s� �=���DH�o�I1�:�9ُ7s��8n x�*R�giR��}�xw� �)9v2�_�y\���b��x���1��+_3�;�T9=�E+o<�Up�S������_�/��F,�g�pq�����vnl��o!�a���r:�K�&������q+��3l�k:[�=N���a�|=Ln��&�M��4���G���B���)��� ��gč� ��a��(�6�<�%��){B~v0��� t ���J�w�}ɬ�.���옆����l��QTcu�������l�.�K)f�V%˛��"0�/����<7���Ԯldc}��Ž�7�����t��+M0)!�e��v�pr�1ۄm��2,S� n��!�GF��st��o��D��o�dE�M�>�&Gz�B����7Ӎ�0�=�9���(k�U��i��wv�>�Y�.�n�ڋ��\���o�8�.�/�5����c���:"�D��&�`��m�����W��f([50��ՁVd��#�y�}7v��Q�z>@��4���ܫ���`��R�C愬�����̼@�U~��ߤ�\�D5z�w�_��}��"�C�j>ܮ�ߞ�r��?i|��LL���o��-�J��"����;���4��J�ꡄiF� D%w�}0j�7�(��i���)�{8�%��#����QC��2K+�ؘ��ZK�������3NB�Oi��h���-i��V����5T�T�>X��TQ�qk�F��xY�)���\��3;E���*k�sS��:�2���ϙ�$��MJ�)����C'}��,�Ҹ������L�_�]�:tϸ��bwW�9� ���lW�'=,�oQ�S�� MF�1o:QNX}!�u0&��T��e��<�3�4����L�� ��B���v+��w�����ϻ�d�?�#n�?~�{[�UW��<�������0r��s��Vg��^q��m��u���nr.f9������M@z��K���WrP7wJW�-9}L<��+,�p����(@]1q:ȡ�2_QO�(��j gGp���HÂ���D�����5�q<�����`ɾqf�z.g�ԟ��!J�������v�e�G����Bn����R���_�P��X+��}�]�<���e(;Ŏ��Mew�Z�-��&�|�e��@f��+A��-Mi�fP�:6n��+�7�ϒj/�r���Cs8>r�?-���^/Ym}�(��=��S���^��jֵ�Ζ'�aܭ]Y#��2�?Y�Dd4ee�B������ٟ���_S����Bǘ��RbQwf|#�����R�F��e���s���Q�!/���sB�|4vI?���E@I������-v�IrZ��te�����\ʩS�YHU|�a$[�g{<>�#傯�ຠ^E����RʷʡQ7)���GK"e�I5"�7Z�+�I�{���Ȓ��6���S�&�r)|w�^S!��0 ���I��A�ۗ�kVG]/F=�%0�]�$*s*�Z&7Nj�Q-[��K��[Ø��|Τ��;}?\a�]k� IR�"�\6��8p`%%b[�[V��"��-�E�$����.���/U�j�˚]��ٻ��n�J�O�JD�i��aF<�����y��`|_O�����ݫY?��S��7���R�I�D�`��E���D+_Չ��{g(�,!n�c�������E(#�|e�3(���{Ӏ�uRoKkJ0j_%x��X�`��_��ԑTz�3S���:�0T�����J��$����8K���U#\ �Mr)�?c�$3�z�t��Z��ڟ���S�Ǔ�Y���/����G�!�px�ub���4b�I �TzR�vv�*��2��Y�,�՜pAf��]d�_ŅA�6��H}#��/�(I�qvT@F8��'����Jv+�2�/3�T�&�gʡ�H�<Bra���������S3ԥb����K��Q�`B͛[�_-@.�`*r����Q�����_�C�V����~v�OG��U=����)��{�`!G0a�� ��t�7b� ~�Z+e�{�(�p7՚�,���� X9��>�(�O��J��ߛ/�g�d:� 7��0s+�/�fJA\�+�>˳�!��Z&QY�߶�:&>&XN�B~�`QT��b��A��vh��n3���K:g���6U�f'@���}��R�6!�Ifrq\<nA"��Ι���ӣx�� �>��e�P�����G-�9>V��خסa6�"��K0��zX��)�:��V72Ԡ�����n���x�1��|�:@>���Ay8fy;RW����-Q��%ُX��<l9iQ=��z�DQT-�M� {@���4_E�|K��O�,)�~#�� |��0N��wL��%?IiSL�Q[��K�����?���Q�a���í�0R�sk)UۺVr,�G���ĉq�� �X {K�m��� �u��>5+�Z�d�U"�έ�%�~��]j��F=&gk-��q����p_&��Yv��}� /|H<���?�oI��9W���?XL3vv�m��Z焕���$��·�_���F���a��$_�4�F����q�sou���k�!��dcX�A����G�'�64���r"A�hr�������!7X����O&M��! �^���5OXӐ/�Q��<�3���\< �#:Gk@r��9~� �|"�gQ �q�;�/� (�a��L�f�G�Z+ҴUk)��ksy�����2A�����7έ
Behavioral task
behavioral1
Sample
Fanta_Crypted.exe
Resource
win10v2004-20231215-en
General
-
Target
Fanta_Crypted.exe
-
Size
6.2MB
-
MD5
a3f60cf65f209f17ba1630c6aef48d6b
-
SHA1
6ccd6fab394659e68ccdc4143645958af7a258ab
-
SHA256
7a6cbf83e9314f737085966c78d7dab8c1bfc067fe55d35c4d33e4cd0b39f3e4
-
SHA512
969f05da9a2131aecc0a70014f9c7fcca946df93cad9c650898842bed80b70a699a780469a7eb999a6bb84ce64e1b73187a1e03f9671a99f293ed4f7b117efdb
-
SSDEEP
196608:pJrhrwP8JHut+KQUgdT/u6hYnQUToloFaw+:pJrRJHut/QUgp/uyU7j
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fanta_Crypted.exe
Files
-
Fanta_Crypted.exe.exe windows:5 windows x86 arch:x86
1c3089afeecd11feebb05bc59eea335a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ