P�]ZN�`,�(ߓ�G���>��S�M2C��S�Y��+0)��{�"��LW�������EJ�}� ��� n�LD����^��8��I�_nS��9�� I� �k0�1�ĕ�ᡑ�p����&>�5"�~��U ӈ`_���Uĺ*O��`���po����3�x�,4�SڊW�����lp o��?��d���A|�8�ʈ)߹O?�u�_�9�Bv��R�� m���)�Ö��A�J���)�$�����I1��Y��:=�p����$sܔS_�vM�"��7KV�h�����_��X��$a�yɝ'¢�g�~���C��'�4(�i��-\�}�5����!�r�+n͈#:"m����6'�e6��{�J6�o���������w�!\��q� �3~�8��&���+�0�8�=�W]"�s-V�R4��#����B��E���I��;�ӋN��Q��08�AA��_�i鞛���#�+ꌪ���`�`�c�����M'�?���8�=������r82�"4~�s3��d����� ���u^�Ɉ?��4F+�~�Ґ?�\cY���Q{ �he� aD�"$��md�Ui�>C4H\���MQ�0�Un��e��c�O˳��� ���j���Y���F�і�<��U��u��e�.'������Y/N\�/s��@�t�� ����X�QaK�&�X�����9Kҩ���*p ,$d~�w^��5��v+~U<���eoqT�p�����`���Xj����g-jџǃ�Q��lʲD�oО�b��5��$1��EFo(��ǧ��"�A�@=��)�G���u�`���k����/�ó��`Gye�k�/�.�V�vj֔�d@f���:���юz���qD�]BSB)������Nj;@���N �A�+��O[m���X 0E�*����]��scŢ�GZ�ω^&�4}5�L< C�[�1����O晠�J��ƃ^Z�HjroYR��k�����y3> ��qN��I��E:s3Ml����tGOp�)�hƞ�K���Hv��p��'FJ�Dɉ��`7�v �Z�7�U*�߅�Kf^��Qf^/�)��� n�D�5����N+�$����S�!&�I&6Bn��sD��<E�r��+���8��?�t[�G�6���y$�a���ٻ)�V�_<����7#�qL��gH- ~�7=T��m�U5q%���<���}�,���X�fZ+&*Ƴ����N ja0�8�|�Nlg^O����+�]]LmY���<�WA������,�pAh����뵸j/��y�|�p������o+��X���<^���7��8X��=K��^?kiR����C%���g��ؙ:n������p���|q�Ք��\��2�2q�C�e%��(a٦|�E<[u�I&\�P����5�����J�_��+��R�~�r_I�?�3�\$瑬�IJ�1���'"���$��I�k��4���#��p8|M}a����2��� ��),r})+���j�s��q�"�l��KQ����4!Xh��b���pL<Ҹ�h\�w�Oq�ٙ����� �{횯�2{⼶�A��cT��Ҽ6�f�ގ�m,�O^C�{Wg]T��@C](�di1V��7lŔ�f�����:�N��QiyV��<��eҢR�o���W�����B� �����-8����U����R��/�~ (�^�˨��R�t;��] ����1%��艢�Ho�^���y���7O�}���4v4w-I�������-.u���1�����a>C<���_�甭�]��Z~XcSň��C"��0�UU�$Y����G�~��:�_�����f�4?C=k�ϰx��g����]Ƿ��"�͵=�p�t�X�,�J|?���zM��/���d� �]�7�`љ�и���c_)�y�m>ﶿ��3z��R�RO�&z��bY�KD6QR�W�tK��Lz�_�Q�K�D���ܔ-n�a��-,�F�&غO��0�-�Ԯ��4C8���V�m�:m�aW��1��z��u�nC!���O�5�����pM�1�M���#��_�g��hܼ�b�� :��^����mrN���#ܕ�> �lk�O�λ5��`�xW���$�A�T�"�����C{jnh;����;��[E!�n�)`�:�f(�6�ތ�T������忁�S+2�B|wi��)>o�=1ǒ৯�V|� ��%�V�*�*t�rm�3�2�B�����e'�$Q�PXo9�Jq���Z�x���N�����=g�O�mv�q>��iŧ0��x#S��>�[U���d��v�^���}�!�md� ��G&�&HU��%���K�Z�i�e~;`2���bN���Z�>�m�.0�ˁs]&���Y��\��Uy�vp0���)�P�����e�� �P?��m��ܭ��j�0Y��vg�`T��%a�]k��K̐��3���B�hT�����O��� ��;�{e�B�+���0w�m����,��&����)��a�i�'��|�ٴ��ə'!���43g8��ׄ3�����X��y���1<�d�$�����W!�^tp��� �C#x��T���<����LIX��t�Lr"��.�,�J�^����SfSE��!y���.?G����$�b�����8mk�g���@C���f�%��pU/�fT�6LU`���!y8ν ��JV���C_{���Ҙ��(���b�S[�#�Ŷ8�n��?�aχMpM���620�y�O���p8ՃkzY1/�HO�.������h�'�o~08y�[�آ����o%v�?F�_��|��������EM�����b:i8��{��a����q�L4�Ӡ���P���v�%�-|�e�+ �(�1����'MK3҉��^Vv����)&���P�eH�%Ϲa�����b�ވ.�6S3�w���y��ex ������G$Lv@@�|4��W;�eӫ����!΄����"˸�!\� wa�_w�H�`�}D�=��]2���D�����1��u�M�����̲p���Dvg������CQ1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen22.30929.13193.27650.exe
Resource
win7-20231215-en
General
-
Target
SecuriteInfo.com.Trojan.Siggen22.30929.13193.27650.exe
-
Size
7.3MB
-
MD5
31dec3658807943dd266a267b2b53f20
-
SHA1
2db8a340928dce07b18125165766edd2d4318543
-
SHA256
fface08296450e4700534e876b24fe14f3bf6d071cb8f45b3043a2dc83837db9
-
SHA512
0b5815577307e1a2d3347d1a8003b5564f9de33ebea4c5673f178eb1b3be5659e08ecefa9ef2d78162ef5ac2c4a4354ca63b88ea55701f998ccb02ecb53769b8
-
SSDEEP
196608:352VZrJsI/f5ljzKZNIGRbFGHmHICc/AzY6Csdnr06oLTXxG:3UV5qqf5ljzKvISbzICc6vILTc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Trojan.Siggen22.30929.13193.27650.exe
Files
-
SecuriteInfo.com.Trojan.Siggen22.30929.13193.27650.exe.exe windows:6 windows x64 arch:x64
636e6ef7f03bccc16d60aab1fd00558b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerSetConditionMask
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptHashData
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
ntdll
RtlVirtualUnwind
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChain
ws2_32
recv
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtol
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 644KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ