��|2�V�$&T�u�߲�֢刄�BI��)� �FI���s�l�S��<~�ִM��3����DW�ط�����D�����/dyn�)px��ff]��N�V����1�`KI V*"��u�?���F�A���z��N�s=dWc螧J����\�]_�ed1�6�I� HO�Z9�n|��y;d�En}�"�~�é��l�G��H�� i�U�#s���M��$z��*6P���\��=C�l����Ť[5��C,W�|��Ŧ6`�j+I#�*�Q����5�Ǹ�|�" ��m�O��?����A�Y2�Bk��i@�i�|v���B�H��;���=[w������=������pm8$w ����#��D����N�����qGk���4�)5��4�*n�p;(zY+�ֈo�DF�ь�t�՝�Yإ���lvp35nَ4�ρ9�xRQ[N�N�wZ,�����[dbu��F,[v�ެ�������$�w����P�p�e`�$k �(W�nZa!��e����S#�D/>����c����F�L�2oP��#�Ԡ��k���k�RD��r�Ȟ�y��֜sH�<�9���&��c�G� 1�S��@U`��N��BL\IܵƉ�@�o(�t&����}(F�+ #~���Wj��ܽ��]U��X�)�_H[7��W�/��=u�k@x`i�;�˝Lļ��_ �R?լ }?4�?�]|��L��������!�҉5�bW������8(]��ufc]�y��.b?���bD�F9HK2Y�]�,��e¤�x倌�t��)-ɑNk����OP��Na:�K��8��unV�a&X�i��wk"sڙ}�Bn 6M�R��1�Z4���=mE�gNP���}B$��J��d{��h1�������� z�Q&Cޜ��L�Kr_l.C��)����V�'�٠�=��k��� �k�6��µ�Wg� �e�:�b�`�}{=��Rpy]8����A�A��Z����QT|��I./5�\P�gP�������>��F�����FHQf4����4�`�c9��⸪��o?��(d�f�؋q�t���`�U^c������7�0Q�㹳��úJ���Vp�<�¤�+������1���G�����ҝ����$M)ジ%@��$��`7g=N_/��"%Y�%p I&�^\IIR4}hW���kG��IHl'��&��9QZEE@߀�n����{A�f�+�8{��8�Iz;�^X�U-��]��N� E�1�4?��J�f^�n�4�F��U+�?�G�ђ�h�\�)5_�{�a� {܋�߿��~�.lj������_��V��+r���XK��6+�̢��du�+�_��(�[�|j��J��z���CH��ZQ4�k�ǯ/ˉ$oA��m��d��.��vh���IМ����N���e����������������5����~������h�5M�<y٤&T��[��y�}���u,�i�������)��R�{ �}z+DZ:��!c$.͑�-7�4�fӍ�� ��Rհ�>�J�*gx��'��ܼ��f��Ūi��L�gk$=���:J'2}(VsFAl�x���پ���čv��[�`!����f��P����Kϥ�l�~d����GIF�M\�H�>�U^�$�- zN�x7G.�B��$�hNyy*�`�zã��F4��:Z����DkQp�˦!���#{1P��5^U�c�7���K�T\kev2&����:m��ꉍ4�\�U�"����҆�ߟ��8Ǒi��GhC�0���Zo�xk! ʌ����&ק�����n��������'�vC�s�����r��&�����+��)���|��)7������5MR��<a����J6C��/G�]b�����h�H5� u���� �v�F�d�͕�;��b�Bl�؝ Xe���Ɯ�%��a�ⴡ��.�cN�AN��@�!�u�i :�5�����h�� ��p_���"Ң�O�G * �2����ՈlYJ�s��m*��ލX�}zk�hԙZ��C<a��m��p ��G����v+�ݦn-&> JD�����f��#��٭ ��������g^"}����C�"[;v}d.��:���-�K�'�8�2�����t �����߾��U!z����� ��� ��E]��I�AǮ4���X�p;�e�Xgn��b�T� ;B�i���8�vbʋ��c�r�{���� =r&����N���%pg9��uSf�6m����?�rB�n5���*i;��,.T�ż�q:�C�'5�����������_z��t�8�k;T���P R�œ\��V.��u/�P�iRqX��[s�?�@]r}�/��BL=6G���S�5��GhF���a6#}&�`U_�3QBz���� ���b��(i�V43i�ɨjX�-ڕ'����At�%7�w���1��5�A��k��ӷO��S@Y Z�ݹ�����t��3��x ��gҸ(��8�-��ɠ������[#X�Za5b�R��L�����:Y��;<?4b�u��Ye��_���)�s��S�t��/�I�h��ɿ�o�c��Wy5X�A��v��Y9�s�(PE2�/��L�А��\q��d� �%p��S�^�M�tJ\Suc<�߷)�]�T���zk��87-��2f�T.�L�(_��d����&�[���; ��ȵi���(\LP��>����r܅ֶ�L�i���aT.sd:�OcG�PB�f�)� �ж|ݘ>+�8�H��Pzsօ9�� �#~90��w�L����5/l4: �����QR�'��9�|p��E�Ş���"@=�G��@V"�\o�8�f�.�2���O���fJ���'��VgG�ǚZ賛���&^�-'�J ȉ�hM�8���C>���oPy�~�!��ꮘzn&�s�##��e����9�g ��>��dϛbÊ�o3��L��s��p�� iK��Q��P��9��T���x>@�{�y�*D�~��7��M,!B k���rMb[ĭ�73��ž�F�"���� 9�����(�c������~�J��
Behavioral task
behavioral1
Sample
2.exe
Resource
win10v2004-20231215-en
General
-
Target
2.exe
-
Size
5.4MB
-
MD5
4e71245e4efe50b537953a48ceb2b915
-
SHA1
224d47598f92fde3b51fc0046261f037e11aa2d7
-
SHA256
399101cfcd75d49d0025832274d295bbd6df5bf86aca060705036d4f85ce104d
-
SHA512
a09a473c221bf71abc97444c8d04f3c4665acc1253bcdcf40231c411a34b4222abead6cba0dad6d7c0ee14ff20e6b67c859d9b90fc065d8a1fe0c9aa48b48ccd
-
SSDEEP
98304:/kMxWW6wQXV7iwee/zR6OKnHA0tYCsbPsHIZ7HLt/q3qSDONQTX1Rx7eCA:/vxj4dD/9DUHPtdqCIZ7rt8qdijRA
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2.exe
Files
-
2.exe.exe windows:6 windows x64 arch:x64
54138ed0901a1726ae3658e18bdd1115
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
user32
RegisterClassExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ