��|2�V�$&T�u�߲�֢刄�BI��)� �FI���s�l�S��<~�ִM��3����DW�ط�����D�����/dyn�)px��ff]��N�V����1�`KI V*"��u�?���F�A���z��N�s=dWc螧J����\�]_�ed1�6�I� HO�Z9�n|��y;d�En}�"�~�é��l�G��H�� i�U�#s���M��$z��*6P���\��=C�l����Ť[5��C,W�|��Ŧ6`�j+I#�*�Q����5�Ǹ�|�" ��m�O��?����A�Y2�Bk��i@�i�|v���B�H��;���=[w������=������pm8$w ����#��D����N�����qGk���4�)5��4�*n�p;(zY+�ֈo�DF�ь�t�՝�Yإ���lvp35nَ4�ρ9�xRQ[N�N�wZ,�����[dbu��F,[v�ެ�������$�w����P�p�e`�$k �(W�nZa!��e����S#�D/>����c����F�L�2oP��#�Ԡ��k���k�RD��r�Ȟ�y��֜sH�<�9���&��c�G� 1�S��@U`��N��BL\IܵƉ�@�o(�t&����}(F�+ #~���Wj��ܽ��]U��X�)�_H[7��W�/��=u�k@x`i�;�˝Lļ��_ �R?լ }?4�?�]|��L��������!�҉5�bW������8(]��ufc]�y��.b?���bD�F9HK2Y�]�,��e¤�x倌�t��)-ɑNk����OP��Na:�K��8��unV�a&X�i��wk"sڙ}�Bn 6M�R��1�Z4���=mE�gNP���}B$��J��d{��h1�������� z�Q&Cޜ��L�Kr_l.C��)����V�'�٠�=��k��� �k�6��µ�Wg� �e�:�b�`�}{=��Rpy]8����A�A��Z����QT|��I./5�\P�gP�������>��F�����FHQf4����4�`�c9��⸪��o?��(d�f�؋q�t���`�U^c������7�0Q�㹳��úJ���Vp�<�¤�+������1���G�����ҝ����$M)ジ%@��$��`7g=N_/��"%Y�%p I&�^\IIR4}hW���kG��IHl'��&��9QZEE@߀�n����{A�f�+�8{��8�Iz;�^X�U-��]��N� E�1�4?��J�f^�n�4�F��U+�?�G�ђ�h�\�)5_�{�a� {܋�߿��~�.lj������_��V��+r���XK��6+�̢��du�+�_��(�[�|j��J��z���CH��ZQ4�k�ǯ/ˉ$oA��m��d��.��vh���IМ����N���e����������������5����~������h�5M�<y٤&T��[��y�}���u,�i�������)��R�{ �}z+DZ:��!c$.͑�-7�4�fӍ�� ��Rհ�>�J�*gx��'��ܼ��f��Ūi��L�gk$=���:J'2}(VsFAl�x���پ���čv��[�`!����f��P����Kϥ�l�~d����GIF�M\�H�>�U^�$�- zN�x7G.�B��$�hNyy*�`�zã��F4��:Z����DkQp�˦!���#{1P��5^U�c�7���K�T\kev2&����:m��ꉍ4�\�U�"����҆�ߟ��8Ǒi��GhC�0���Zo�xk! ʌ����&ק�����n��������'�vC�s�����r��&�����+��)���|��)7������5MR��<a����J6C��/G�]b�����h�H5� u���� �v�F�d�͕�;��b�Bl�؝ Xe���Ɯ�%��a�ⴡ��.�cN�AN��@�!�u�i :�5�����h�� ��p_���"Ң�O�G * �2����ՈlYJ�s��m*��ލX�}zk�hԙZ��C<a��m��p ��G����v+�ݦn-&> JD�����f��#��٭ ��������g^"}����C�"[;v}d.��:���-�K�'�8�2�����t �����߾��U!z����� ��� ��E]��I�AǮ4���X�p;�e�Xgn��b�T� ;B�i���8�vbʋ��c�r�{���� =r&����N���%pg9��uSf�6m����?�rB�n5���*i;��,.T�ż�q:�C�'5�����������_z��t�8�k;T���P R�œ\��V.��u/�P�iRqX��[s�?�@]r}�/��BL=6G���S�5��GhF���a6#}&�`U_�3QBz���� ���b��(i�V43i�ɨjX�-ڕ'����At�%7�w���1��5�A��k��ӷO��S@Y Z�ݹ�����t��3��x ��gҸ(��8�-��ɠ������[#X�Za5b�R��L�����:Y��;<?4b�u��Ye��_���)�s��S�t��/�I�h��ɿ�o�c��Wy5X�A��v��Y9�s�(PE2�/��L�А��\q��d� �%p��S�^�M�tJ\Suc<�߷)�]�T���zk��87-��2f�T.�L�(_��d����&�[���; ��ȵi���(\LP��>����r܅ֶ�L�i���aT.sd:�OcG�PB�f�)� �ж|ݘ>+�8�H��Pzsօ9�� �#~90��w�L����5/l4: �����QR�'��9�|p��E�Ş���"@=�G��@V"�\o�8�f�.�2���O���fJ���'��VgG�ǚZ賛���&^�-'�J ȉ�hM�8���C>���oPy�~�!��ꮘzn&�s�##��e����9�g ��>��dϛbÊ�o3��L��s��p�� iK��Q��P��9��T���x>@�{�y�*D�~��7��M,!B k���rMb[ĭ�73��ž�F�"���� 9�����(�c������~�J��
Behavioral task
behavioral1
Sample
New folder/2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
New folder/DVLPERMDRV.sys
Resource
win10v2004-20240220-en
General
-
Target
New folder.7zip.zip
-
Size
5.1MB
-
MD5
efee11e15bf1eed205143e0e679a95c2
-
SHA1
3947d9806db883b3094406140abe151310ff8236
-
SHA256
bf7f0c1917d75a93119ff72a220b3ec5312df35c7ff5bb1bea8ec23931e3a231
-
SHA512
2ed1facf2ffec6e6cf0010e236cf54ccdce6e1acab05060ef18a3d09cffd0eb3b8d82187ae3b7cd546c3c39c78e5e677b0c416f464580ad5eb2aed704c56ecd5
-
SSDEEP
98304:W6gwYcbpjGQRV7AokydvD6sKd9O8tWCERryhPGX/3WCzmBOWcwAIkND:W6gwXpKYBLdbBQ9NtL++s/WCzc9cNIiD
Malware Config
Signatures
-
resource yara_rule static1/unpack001/New folder/2.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/New folder/2.exe
Files
-
New folder.7zip.zip.zip
-
New folder/2.exe.exe windows:6 windows x64 arch:x64
54138ed0901a1726ae3658e18bdd1115
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
user32
RegisterClassExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
New folder/DVLPERMDRV.SYS.sys windows:6 windows x64 arch:x64
b05ee5c816a30bc52378c759486af0b9
Code Sign
61:20:4d:b4:00:00:00:00:00:27Certificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before15/04/2011, 19:45Not After15/04/2021, 19:55SubjectCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:caCertificate
IssuerCN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=USNot Before30/08/2017, 00:00Not After24/09/2020, 12:00SubjectSERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate
IssuerCN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22/10/2014, 00:00Not After22/10/2024, 00:00SubjectCN=DigiCert Timestamp Responder,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before18/04/2012, 12:00Not After18/04/2027, 12:00SubjectCN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before10/11/2006, 00:00Not After10/11/2021, 00:00SubjectCN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85Certificate
IssuerCN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before05/06/2019, 18:06Not After03/06/2020, 18:06SubjectCN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0b:aa:c1:00:00:00:00:00:09Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before18/04/2012, 23:48Not After18/04/2027, 23:58SubjectCN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
d0:52:29:92:52:f0:f0:bd:70:b5:e7:c4:6b:9c:a7:1a:99:a0:52:b4:7f:69:35:82:be:cb:6f:0d:56:7e:82:45Signer
Actual PE Digestd0:52:29:92:52:f0:f0:bd:70:b5:e7:c4:6b:9c:a7:1a:99:a0:52:b4:7f:69:35:82:be:cb:6f:0d:56:7e:82:45Digest Algorithmsha256PE Digest Matchestrue44:4c:e1:60:87:68:88:4d:1e:97:42:f8:0c:cf:4f:53:e0:aa:70:9dSigner
Actual PE Digest44:4c:e1:60:87:68:88:4d:1e:97:42:f8:0c:cf:4f:53:e0:aa:70:9dDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
e:\work\dangerzone\flashdriverwin64\Release\amd64\amifldrv64.pdb
Imports
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 394B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 954B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE