�)c,�@l �\r�t�yCnv*"'<���c!$,T 3`�0?f�CB��A�9��I��w\�$�W?�*��.-�����D�����U�G�f���cb�<}9��x�ѳ������f����;�DŽ���1�f��f�LU�a+�TUH0z�\��]��{��=]���Z�.�UdnLj�g���7}��/���>R�����[�+�\B��n����xYG_"���,Ԗ8k\�hK3n�w��O��)��i.�]��e! �]N�a'�l���n��华dJK�o ����T���������=%�ܛ� �%2�j�9+_ e�Dd ���y�if�������[;������Xp�q�MG����Z���;VkUN��g$���o �^aeg�(����i�-��v�[���s����_¬�-��N�x���1�������fh���Bў�/Ji��x�?c�3�0J�H3[K�J� �(��-����H�j��h~i/X���vC�H��EV��L�#��u>=V��#�^�B�퓴�\ls �D�+[�R&Tm�:wlI������\�Cv�9���\+7�w�-E�v|a�0H�2��!rkH�<��=/%E��/G��= ��ocw�Jsg��� ��@��`:��� 9��R�jM�;�\�d�3�f��.�N]7��=Q�w�ga��r9�`�S�ۅ`O�F�M�e���l:�4~K��p��O2:,J�-X�^�mS�7)W��+�����Vc��b�����#7�L�3�I'L��[��U0���.`Dc, ��M�s��tjį F�!]zm5?��ޒ�if%���CV�b�)Gd�Mγe)��r�<�nI�1�Ǚ�h+� }�H2e�S7^@vk�R��b��j%���c�_{/�oX� {�˓�9r��]}���)���PA������������u[ >'��Q�$�FG_�M��C{��©N(�=���t2������#Fc3T��F��ו�,��o Fu���pF1䊿�������.��ݻ���"���03r�*}y���j2�?�n��W��9OB�v���Ӈ�*���s@E���+-JP�F�"?Bf���n<:6-ʃã29)����"��1���0�Dy�7�� ���l�m貗�8Z�:̻+�U9��4��I��{�v�uG��"����D �O�n��y1�~��1^��nE�'��MG��?�H�Jօ�«J���Fa%ֿr(�ꎌ�����u7LLq���ge��%ű���7�b����.������ i8��=bГ\o�,ǩRl�� �Xi�� lz5���My�5�)M�;�E�e�x$蜲�X�Dr�(eK����u�����6���Q� �g�^^�����m��w�@��P�LN����vBk3��6����mJ�R>��������i��32>!��������2��2����yP���� |��*(c�XJŘ����+l�[����?�MU�a�@�{oW���o�U�%-*\,Ru��^�u{X_�!y��wGY��[���������M��C��B�H �`���R�9���Á��S��ӊ�d�!H��m�g{1� �ZӾw��s�����O�YJ�OO1�R�I�M�K��>:�_er�<_����x���q��i��4k$��z�5�m�\ە�@����6�C�,���$\YR��ZP�D��r��G��?�hHN���蕡Wm7�3�-��A��n��f��Zv���P�#�H܂ϬL:ѰQ��s���p�l�����xQ��V�9������0}�����@E��ū�cHK��!���������d8&`$NSAU�,ݴ䟊�4� 81{VPT���](���(�8)���Cq�#��/W�=I�Ԗ���a(�⋡���,����|�:���M�mK���o��l���� o/�?Řq�Y�{���B1��?�K&[�s�u_��V�ē���?�j�8vSc(��~O���y�0��'��Mr�F����AsU��X3~�q�:�}G�f48L�7SO�@f�f�y#�����Wv +�aaq�v���2��R&��5���#s^��4�'P:�]�������,������ W/xa�n���a�}8�*D �}M�?�а<����Q�xK�2/���v|%��dW�_�����PSb�C�^���e|Bc�Y�L�_̝�L����+�����\Y[�t)�v�Pa�m��� ���SB���(�5b$��\!��5��A�aو�j�,J���ͳ�i^�v�o��yGA�K��5�4>�B�J�g���ҫ��D*uM�B)����a�ȣ¬�c5RU�<��@�qb� �3���� aU]- )_��:�w����ΠD�kQ�+=Q�����Rc�y��T,�~�����!�c �jΆ�=�z�Go�rF&�n��ګ��t��'��wl�O�e=�\>�3��'͔��Fu>�|;FsȐ��Do�QQH��z����d�����ik9 ��n5� �m��ɰ���L�덾|L�pd�R����ܑ�͓��{_D�k d�n]�hB�ߖO�k'a�*�b@̪���i���'��YTET'����d��@:��v��4�D<�Gp�'f,���K�b�bv�T��7���*�b�^b��e+ \^i�9V��N�5�;��m&�ƺd�zt�!?�����UrC�7W������a�H�50��W)�o]QQ0���o��Zz#��m]`E�L��I���jڦR��!�����D"�]����DԂ���FJ�H��� ��:/y5 ���c��1o��Vr1��2)�������Ci�/��R���;�A�c<��*��?�U��C�6����b�Ⳉ�G��- ?:ȳ�)8���u�+\Bg�?$v{�U3�0�ɥ�ڳ;?������b�9��~�<������R�L�a�� l]���z+�� �L7��Wsq�~��S�^����hf @w��@_�#w���'�_h��Kx�m�d����Ax�t)�����IG��ʭfF��pM;�# wq���S&U���~�(�N�"��_�]!��۳��
Behavioral task
behavioral1
Sample
bd9694fc714fbb62e98d2ba300ddde6989e8adf9a620d0d9e0fc5287c8f9f211.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bd9694fc714fbb62e98d2ba300ddde6989e8adf9a620d0d9e0fc5287c8f9f211.exe
Resource
win10v2004-20231215-en
General
-
Target
bd9694fc714fbb62e98d2ba300ddde6989e8adf9a620d0d9e0fc5287c8f9f211.exe.zip
-
Size
3.7MB
-
MD5
1ee9250b80bb5e313d11571940a1f68d
-
SHA1
e054af251a8f55defc72792160db9ef9632d6d6b
-
SHA256
221274985c77b9f141065c40a94a9b16f41f9490e9a9a2c584398860a473f89a
-
SHA512
e0af28a637d0b15406786da959ed610db60ffa5e9525f1830f77f8b778448a0c72162416abe78e0a69795cf19d011064bea6ebe43ebb795b90efc17ccbde05e3
-
SSDEEP
49152:vhkMkBapGWF1rifg7yY0dKaGvxTSOaHx2UYvf/5wjzEDeI9Cjk+trU10:y4vF1v0dKaG1vSG/qzECmIrUG
Malware Config
Signatures
-
resource yara_rule static1/unpack001/bd9694fc714fbb62e98d2ba300ddde6989e8adf9a620d0d9e0fc5287c8f9f211.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bd9694fc714fbb62e98d2ba300ddde6989e8adf9a620d0d9e0fc5287c8f9f211.exe
Files
-
bd9694fc714fbb62e98d2ba300ddde6989e8adf9a620d0d9e0fc5287c8f9f211.exe.zip.zip
Password: infected
-
bd9694fc714fbb62e98d2ba300ddde6989e8adf9a620d0d9e0fc5287c8f9f211.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ