�@ ��4t����!��0�a�L�+��p�H˓c��Qb�Y�H���9�@�'�����r�x)��\��.�0*��:J�w\�#�Z�oEѓ���&6�����u��$(�� ]K]��ޟ\�IG�=+���8�.5�ݟ�w2�2����������~���5����W8�x�7��3l��9�R����P��Q��|M�#����P<�8/���L�f����o{���JU� ���/�(�K�K���f�|��A����5+�O(�ʰ�t��dbt2+=��s+xC;_N���5���kEb�����A�qttk6/F@��^��G}*Kja/�c�K:�l���7���P��DB"S9e�t�ϯ���j�w�����I93�����Z�n���,|�Zt�n��=-�QT(l�[C�J��>�#�2%�P�����0W�l��SS,��J���c� 4k$����IK�.��%�S��9�����%��&W(����@,�q��87��zPDت��t���G��"���O����#�4 �F� � �i��P�X:���*���g�z����c^��9��v������b-Ө���ԗx�pC��My7i'����2���8M*Ys$\����b�!��fD�n�jEʗeL�w*������N�|}�B��m��$פ%JQ���Pc�e.�onȾvL1��>��=X��#�^��O��هi?�u!��Ɵ�#��V��$��c@\�*�� r�'y�Zݫ��8��,+1P�S��l 0���%N ?Zm�d��6��~k��\���'H0Qi�n>�X[Obَ�x�a����;x�ޗ�!�6���D��ptT>����Y_���b&S[�nQ��{���|#��B)l�#җ畐?��&��֙��Ex�_���1��${��ͥ.�͓t_J�ҏO��%0^��㿏����Hk����C>�i#J�Q!M~�3���x�p�����_W|KJ]�ܭ����M��*k��� �A*C_%�}$.�@k�<��8`j�U@[<�g�m{��w �Յ���,�`�d��?c� ���Ft���q3�%�4� R�l���=�;);P�����%$T�rqŐXA�&���L�:Y�����@����:Aq67��ӎ��>�Ѣ��]�ށm�W���)�dB�1\`�f��!��(P�R+�r\�<�A�W}�q��{�AV�9S��F%~��:�������U���9s�]£�6j`ߺc�ܽI0��e�Ng���o=݉�%�+�R��@u$ ����kE���; 1I�ar� �pZb�?!F��`�,�m��PK6.����z��l��v������ho ���#J�z�Gcţ�h������ij�w���(�[Μ�K��/ƚ��s-� .K]�B�eq���$K�\jI��>)h���~�L�E�6yp<))� �Υ����G�!���w�����/2�Z&���u�E���r�I�z�:������2+I�N��g}3\��B�v1a����$��z#=v� %*�䰏*�9]F6�и�p�ZM���t+9;�#�փ��Ҥ���q����{���`�Gߡ�Im�)\t�!务v{���jQ^9=P9)��M�N�N�Ǡm�[d(I������r�p[�R�����/G��.�ȇ����n4�+�X��,tL;t�ɤ�Hˋ�n��VE��֒rw�E��":Qe�ڱo��P��ϒ#$���d�x��������;��^���t���.l��Vj��3��gLL�o]�v�?�p���}�?c���j��#:���x�1]���Z)Zqk�W7ы�5*���������>���4ڌ����l�y��C��(���L �lIL]uM'i�9L�<z�;����+a�����2��&j&�@O8'f<G��G9C��� ����P�����K��\��;�@ ,�5���&�S��PŬ ��~��-�� ���^��E\}�=y��v�)��U�)^ɼ9�~��(�u.E��nBD|ES�������oBШDpKS� ��Z���B`B����#43;�A���r?u��\�:�H��q ?�%��� �+P�լ��H����hd%�bL�v8;D٘�U���)�YN�(u�re�w�_�˓_�t7䚒7���+D�\k��. T�M�k�qT��UNEP�\�=l���#�.�K���[R�ь��*Ħ,#c�����î�?l�3�]Z3�7�G���@��^�z�)��v�V���`[Ԋ�s�`٣��Qr3��C�|��ά��R�sIr���_��0��ց0�{}�&[f�q��+%�+���XH�mis&��?�Y��O^�5a߾0����8!��-��gؓѯ^��i=�ͫo}�3����5�a-�8N$R~�5 ػ�i5����e�k��+��Ư���m�9�'�}/T���+�i�6υ�rd,â~x�%��N��a�> M�ӳ����#G6�p~��cr��8A������RN�DYp=#8���7� �4;,�����ǿ����ם��W�s�t�s�if�ij��G1*F��=Sί<Od�UµH<��?�I�ee/�r �Oև�թ>3�&��Ej`�<n���=�������sE��86y�"X��r��j����Ȏ�H��6#� 6F�X�6� ����ړX[!ͩ��B}P��N�����g�4ſW~��oy���P*&�u��69�՚qق�o=B"I���~#MB��3v}��s���h,>��o�ݬ�Q��q).B���x�u5̨�R�KkIg�8� ���� �n�i�7pt�{g�f�E���q��Rp����6�;q�w��5Z3F��D�}�J%ݫ�%8�W��S�6\FP��~�ͲH�W�(̤����@Y|����W*��K:���I��<�e�n�ȑo�og�E>\q��>��+X��|��I0��ԗ���Np9�,G�U�{Θb�8���F�=&�^���K�����n ��4B�h6��E'�6=6�:W����PitFR瘍=S��^��mD���J��4@�9�?Ŵ�g��:�������z�j1���0���tC�r&�=LC��Y��0���#�<��s!3�
Static task
static1
Behavioral task
behavioral1
Sample
vcpkgsrv.exe
Resource
win10v2004-20231215-en
General
-
Target
vcpkgsrv.exe
-
Size
7.1MB
-
MD5
1d58b0ea9caf1e30270e4a09600e806c
-
SHA1
310d277d42d9cbb932f18c916b84d15514d175e5
-
SHA256
ef86d5823bbd071800975944e73b5bca5035bd66e87ffcb769b567855dbd042c
-
SHA512
0504fbc8491ac03a31c3ab3cbf26adb1eec0f89e50178a3316156b816fe4f8f48de75305382d3e0ad4577a1e2f7466827944544b2e64d21d8af912246db0848e
-
SSDEEP
98304:5sJjL1liBCAdoX/iwGD+bD19W8wyxiOUaElxxatmw8aObqJqoNuIYjQr9NA:CL10CV7N9W9yN0xx8mzADN8A96
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vcpkgsrv.exe
Files
-
vcpkgsrv.exe.exe windows:6 windows x64 arch:x64
dcf807b2d3e5d586e34b3fef5ddff514
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDevice
ntdll
RtlCaptureContext
ws2_32
getsockopt
crypt32
CertFreeCertificateChain
advapi32
CryptHashData
kernel32
LoadLibraryExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoSetProxyBlanket
oleaut32
SysAllocString
imm32
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 667KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tzx0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tzx1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ