_J� ��TO��)����*fKY��tkAc��m�Q�����SoE�PE.C^렺"�U�Č�8OG�N@�wH�D�����y�|-R����Sb��8��P]Z�<�ţ ��m&� �g|sy)���n��(})IU,B?��ǽ��1#&���������\fȥ05q��}(zG�����qu�>��5����ZX~��� U`AC�^�t�ĺ�C���'���#���O��o2j�A�P�I��A�� ����A�2(��ğ���Yi"��&�o�7�����+���ޖQ����4?VI��1����k�Wk�~�xS���k�k��i�cu7I�RioM�ꊕ�����k��7ѻ��#��}U�W�����v/�#�Έ�8r5xO�Ո[��F���C�0�,ABr.(�Ra�ښWXr�о�u�N�B�˫Z�;��g���ٍk� �4?;ҁ��cL�k:iU�cP��5n���~� �'fJo:_ h'����We}��"����A���p� �v+fSy4S�j��Ej��O㫸M���?��Ţ�p���ƙ��G}} ���#`U����쀂+<R-��tSg�q_C��O��p=Lz���R <Y�,$��]3r������8��W#�����ɘc�Q^r�ևu)��~҇��Mh�D}��XЂ�h�`~���e�ڼ�����m Z2U����o�p���6�P#�����o}օ��i���29aL�b�� ?��:��<����^��E*m��c��q"J�����(�6�JD�>�oDT�^DR1^�(f�:/vwaR��l��E�����������{ņp���{A�W�U��o�5����G䊁���12��Q��+l�b��I�E���/Էa�}� �.ص�kڜ_�G�hiRr�C'L�Z��O�8���>�A ]w���&SI��4w`��& ��+����[{��ay��B���V���x�CmY�q��hvypFx?�7�n��L�+�j=e����Sv�-8�|Pc����#��)�����{��j��c�e���J ��ќ�/���ڸr���ELT����^�����Cv�/��yF�S��hY���e��{��˽��-��$�ז��%_)�M#��0�B9��LB�vQ8Ŗ�]��n==��X����S�ý���U�e��x}k�O>�a����q��^6"Z~��7wƅ���z ��Ac<?c�r,�e��(��<�i.֒��Z�i�Hʁ��ul��+��o�0M��=K�ރ�>G|��*2]�T�^�ڇ#.�X�$���H�ţN"��[�|�`��u�r������d%s���F�Ɨ.�@����ɀWxەTN�ϗ+�(�щ��)��o�C=��9t���v��u�L�cs�|BB�� "��<�e �A�c�0x���E��Ϩa�k� d8L��%��0�����Mik�*�2 `��� 5A��\B$�����<���D������� ��z�R��л�b�1��������`� �S�ur����Р8�+������=�yX`�*&Ζ^3V]�wj�/�Ϛ]b��8���n����O�İ��f;�hUI��=�6g��} �9Jx:wA}�0�k/�)*��tC���vYd`,�͑���e@g+�1��;K�v�rۑn�wا%��z����S�zB`�x��%��*���ӦkX��r ����M^L1�{X��.�`�fg������@U?~t�+t߽��������<Ig�7ę�������z��]��~5tPe�ݷ#L0��vpA�����g݇vi�3#8�C�3����7����c����>M�#c�i�NTJ:�V1�(�نq z�>V���߂����̙_ާ����<8:,�+_x*�@�'�n������h�0�N���z�v������_�jj�ArV �>륑 ��D�x�y���!����q0�G� D\�Tt�8� �Q�B���h�?�*�T咬s�B�uW5��R�����/�6Ǫ��A���y�m"�z�0��oL%v�?.�oX.�5ʄ���Y���§ ����~����I쨜�!�;&��nƤ���Sa�d?����j1����Kr��|�˰�,���GB�aH��*�G:�d�?%7�֙�L�����.�YK�-%ׂ�'+�qc<t��p;I��X��U�#�~�����>|�77�����*�H%��lO'-����]�Ѧ���f�r�?�� �2����c������2L��9���?��0F��Z��m�)��������� H���%�� �hR��}T %`�bD�ګAYl��j?Mfւ�[�����n��:NyGr����}��p�׆�|?0�6��]���R�$*" ݞ�m0���2��Po�)5��Ѐ@T#\�D�O0���-7ڤʁdk������WU&�7ˋMS�ux�?�lX��jF�0oO��-���p��d� ~Q���V�ϋW��>���`��Y�����O��Z?ggEC�]�6�=<;mlk�O� ކ�^�*a����UՖ+B��o�Ҍ9�3��%z2�Yyv����v5 GD/g����V�۽ܺ ���%��`B�2��X��_k��b�6u/w��ax��n93�Ru�b#�Q��m-�� G��NKVȪ@\ ��:�]�Sd��1���֠�b�]��t��z�nAe�ëZ Ê�{�b��Y��� Q,�@�yi��������������L(X�A��k6se�7;6ŝ&+�Lݔק�w��Z1��`� �QV�澗��,Q3D&X�XZd���^���H��s�3�$�c������qqo�ßGմ���G�z�^� b��6;C���r5� ��&J�zn�fn1��:z�:5k?ƴ�����)f��qj���=U)�'��@p�ǔd���hTɏ�7���U����][�=�z)�n� ?���c�uպƐ�.d<�ۗx��J"�I�rM��K��9��s�� n����qaQ���H\�d���Sv�`mKB�=v�f��:���s%ͩ>E[���P ��"�I'�2!M8����@NI� I-I.Q;vG�%��s�[��a�L���C�"$S�F8��$�S)Iǟ���/U�M��k�
Static task
static1
Behavioral task
behavioral1
Sample
untitled.vmp (1).exe
Resource
win10v2004-20231222-en
General
-
Target
untitled.vmp (1).exe
-
Size
5.8MB
-
MD5
c749c3569b2fbb936f3b659713dbf65d
-
SHA1
f908814d2388ecfec52f0a9f1b7db15ea162548d
-
SHA256
0ceec89d1bd205eeb8112741df6120f0caba2f5dbfdff81b0d6c202f9caa0607
-
SHA512
2adb5bd8ee88720e61e683a7b0345ab1ad2ae116ee404126a598ac478d6fd09d866c27f72e9e443ed7405d9b2ea4d7a1d52927f59fc8231e587acdd02ee1d1bb
-
SSDEEP
98304:0Wl1cyalgTj/qVB3CzqkoPF/Bw7RtLNQesu5lHqbNQ10TjIt+Q6BNzJaQLXJyL:0qmPlOj/BGTdBFUq60TjIIdIQbQL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource untitled.vmp (1).exe
Files
-
untitled.vmp (1).exe.exe windows:5 windows x64 arch:x64
55e91d8ba9ef85b6c00b43e9f1110025
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
d3d11
D3D11CreateDevice
kernel32
AddVectoredExceptionHandler
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
___lc_codepage_func
ole32
CoInitialize
user32
EnableMenuItem
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
ws2_32
WSACleanup
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 922KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE