`� �%��`�M�&� ���߭�(T���5��4U���8�F{a0XEd�Zs\�p��H|�<���i��þn�@]�'m�F�0�6����=��^ŐB�&�_� G8��Ax��,lp~(�b+cbK�1�U���D�����p�v)��ۊP�`Y����x8b�uֺ�~9Զ'Vv���*t�5ܺW�vSg`v]jy��y�+�+ n���xP��[{1wG}� 3%g��+J����l����!n�K���@���y9oC;��j��rv�wߖ��`��H��s)"8��(=��!e ��R,q��6���r率8a�,��O�_W-P��2:շ�ɰ��Xk:o�CL��Z�gn���R� xZ�fٶ�ZV��[�g�(��-�ƛV�M�L�=�����NŇ�C�=��P5��ţ��B>�DF��z�)�4��?f�am�D��s?�꠷�c�@B���u8�U�5�W[\�E'ț.�#!�� ��{�����Пtr�B�������bD�@b�.:V.F��~Q��/�恿sx�n�'oV�wM����x���4�=���z ���U��<����������߰�!�@��s���i�=�8c���QlY��Ip���Y����p����:;5P_�܃���u{���T���Ej�¡j��Q�($k��$ W�Z�Xޓ�~�� *�r��%Z�Bi�j���a0z��4H\�.�w�@�kH�D��"��U�_<���^��_�E�K�6���Ge⫙r�3[Ff��m�g�����nHߎ�N6��֏�y�t��m��C���&Q,)h�7QG�W>G-�2�AN���G�gE�Ff�%�vT�.%��U(}�s�� %��I���<Y��~��关��z|`s��)�y=������q�橅�3�!!��$d�����>"$7��ΐ%F���"�C�{r��,?���V=��?�����a��$ ]}���S��acA�����d�3�p2Vbz�}M��.��C5*!<H�qk��L)�؍Jk�R���pr"@��W.^�ד��_�DiHUst�W\�|��;�<��Taq Z�N�)C���d6�p����/��ɭ)7̴�����P1��n*1�z|�s@��/~�ۈ,���T����W�����E����X|�8Ӳ�����e|��_/=��qʔ~w�����F����4�%����U�oQz��*���y��=�5¦�mD�K$����c��P�m�bw,7M��n �w 4�S7����=��)��>�n!��A����v�O��߹�`e�Z��6�O�W�/��ю��f�*C�����p���_2M�u�ٗ�2���ۀW4����5�0��T�Nm��V�V�G�U*{��41h���%F�B ��#_()O���M�R�K��6�~�ȇ��+�ξ�$l�m�Fⶋ/���bO����>_^�@V�cD��- �4����X��)�⒤n�zQ��@X�}�Cl���-��}|�Ln���s20Z�;��^p+g2 �W�ݍ[�,�W24��j�̕��T-��a��q�)����6���C⚯Y%�#`�S��ڭ^�r����&�rgS�ی� T�Ĵb��*���a�������ؖ}yxP�>ށ��f#����URH�wb�/0���o�K2�-��?(�\�Z!�g�+�{�u�~���кۙ�sWs����_�v����lKG]s�z���k.��ri|����ߏ�K�*G�������[t���r����I3��}��G\��d��x[nW�lʩ���i�+ �l9%;�@���;�T4���B{���e,�v���?%˹`>�=b� �wKѡ�Ls-��1�`K��� ����w��S����{�P�>���N���^WԹI���A����W��w�2����~@�g۾���� ]���,��:�I�K�j�qL�CMtF,V�tյ ��hۣ�Z=P�����Uo$֓�?>����k ϓ��^�����C|�4xs�,_�9[��uN(�;F�sL�0b�-���m ���91�9q�I��N����^�)��83�q$�&%����?8�D��'��YDj|C ��w�}�e��t�������C���/�A�O�K����S�`�A`�b���h�k̙ע� ��@����t>�q���342�"9/?q �!&�aؚS�x�J bB�͎�j6VNF�j�w�C�G�A�A����ώ�W�k��RM$����-���ޏ`#h3k����fCEݪ�%�7� �*�v{g�\[&i���d%}Ac!IʍƋ�&��E߶-��M�t��4���D��P�ڏ�R蘫��Po���Q��I��}|=�"��!�+W3��>ߜZ�K�C�K��>��b�������Ѯ��IܚnXKL���C��[�O��Ql��uY��ŞĜ���M����JƄHt^�d�����[��}V�zK7�C��p��,a~,��RI~��kC;i���G�D��o������4�x]�A�Q���8�K��7կdp����/$ȊT���|z�V�����B�s�q=�w�y�7Lsa�<w{�'�}�sS4�،��#�՛��a�<3�Y�^���ڛcT=b���$mT��Av3]a�i[>�y �A���d���ֵ�:B����&�t%�RG�j=@�e�ݰ� ���BӤY~��p5��f��%]Waa��gY��I��7ig�Ze��r���J��/���� s9T>j��l1 \L\������k��#�ې�L�]��N�[,E/���FwL,�:J�?\㦔��p��h��z�M|0xes���ŏ_f�+���3 �%X)�k�][VfF>{4��nZя�|��dDM�'�m\�F�"f#�ʦ��G+�p�>�G��M���1��E+�d$�,8ܞI�Xb.�m�LN�ܷ0#g���k����.���h���ӡ�3��: 2����@��y�Մ�g����vU/i��Ϥ9E(g �j���ͩ V@��<�&�y=���K��E��~R �6$�0��'|��p̭���?�/�+�
Behavioral task
behavioral1
Sample
faee0919269371892d80c8a9ed9e96edb74b326a70d322e244a3a04c7f2fa990.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
faee0919269371892d80c8a9ed9e96edb74b326a70d322e244a3a04c7f2fa990.exe
Resource
win10v2004-20231215-en
General
-
Target
faee0919269371892d80c8a9ed9e96edb74b326a70d322e244a3a04c7f2fa990.exe.zip
-
Size
1.0MB
-
MD5
47651723c4d7a39a6769b461a8de7150
-
SHA1
b354fd0ba8de175316c47471c73267dfe5f10604
-
SHA256
6699fb38e27c4335d12b68c521c20d8da7a8154e3cbfef082f7b138ba79b42db
-
SHA512
b9de9695be600776d9e7146e99005d46369056f8329465cc26457fb8d1c133a737d2496bbf06266dacc4a1d66ca43c5cfbb260c797f3c95316b17e3574cc369b
-
SSDEEP
24576:Ru5fYpwAg5bg0VwfWxW9zNvnxtIhitfy6LMY1E0j4T+f:6fYpYJg0VwuxO/xtIhx+k+f
Malware Config
Signatures
-
resource yara_rule static1/unpack001/faee0919269371892d80c8a9ed9e96edb74b326a70d322e244a3a04c7f2fa990.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/faee0919269371892d80c8a9ed9e96edb74b326a70d322e244a3a04c7f2fa990.exe
Files
-
faee0919269371892d80c8a9ed9e96edb74b326a70d322e244a3a04c7f2fa990.exe.zip.zip
Password: infected
-
faee0919269371892d80c8a9ed9e96edb74b326a70d322e244a3a04c7f2fa990.exe.exe windows:5 windows x86 arch:x86
02049513ec782d2b0c07f3d54cf75b4f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RedrawWindow
gdi32
GetViewportExtEx
winmm
midiStreamOut
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
SHGetPathFromIDListA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_GetImageCount
ws2_32
inet_ntoa
comdlg32
ChooseFontA
Exports
Exports
Sections
.text Size: - Virtual size: 548KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 784KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ