�^�x����FUc�>� �ezIq�[A�t���� ��c�P�6���������^����W������:�e������C^g��3��Tv���oLd�4�B�m"<a^^�<�]$e�P�V!�z�⇠B�ԓN�߹�*`?��U����"��9]w_�?}n΄�j;u��4A�C���K��cH��qL�7$ �2�� �8��Б�6��f-k� �_����#%�i<�)����a����i����sg���%�Hv�������4}��2�ٞ �`&0����1�l"�K��m:��m���za)��z���VtVI�UR_1����9e�y5�?�n!�Y�WL�g��l�L�o�#> e`ٯ#�!�7Q�ꢢ2�y�L�Eh��q:Ü�}��g�tV��Y�KY���`����zׯ/?o�WSp���⢕_��9����u\Q���T����A��H�!��{�h�cY��T݅��t���T�������E������2���C�c�5��P�v��Uׯ��?��3wX�O��ƹ�eP�l�c�d�IH������݂*���F�����'Er_�������B�˸2}�;I� @����K�&�bpv$�P�g���E��9���y����@��wM���t�`�z��S^�L���qQ��$�j���\乕�R���HQ��qՌ4��Av��}���|_^_��ΣI�j Wv���#����i\&�m���X1�@��`<�!�')�H`��]��\d��gZ��*٢/�RC�U�x�[f&�O[`��\�3Sʟ�DXW��k�,����Imj���_o�to��x��\�9F��m����b�z�`���F҃z��Y4�ͱx,�������ݿI��#��o�d/4,:��|�$ʾ#��}Rα�����p�M�~69����&��� a/w���(�<�"��_O������U�_�-��@�a=���2���oߓгS9����3�Z��]$�WV��p%D�"��ز�@V��K����MƴZb�[�m���ci�6�cK���̡���1��~�%�����S��?n���}&�0����:�\4��{w!�x��] �/iKpIs�b7OyOJ��l�[/n� �8���h�I��X��O鋓*�~�Y��%H��V",��s���~k'�ѣa#�mL��w��<��xg�Ƶ�r����M��'�x����g<'+ ! �(5���3�X(��A-�^Q���հ|�CJH6~��R�OmR�GXC�c��~}��GV�u�b�f����@9J�p��#�P2��cuX��'��F}hB��ө������d=���_,�B0���A>Cם���!zp��胋As^�_��7��寪آ��|�����d�t�]&R ���a�B�'�J��%#T�VJ�""��G��.h����0!����eլ$�-L =�������"�g'q��L�x����{;`T�Da:g��RO��MM.������$%�>��Ǔ0ݯe=4�ӓ�e�x/�.�{ww���}dp��[$e?��fm���Bn���BӁ|�T�Ta�ފ�i�1M�l�қ���[!16��2o�r����1�Htj#d�X7���� \�O �й=U������?�o5�&���o���QF( ��KؓFToZh���,Y��M��iy7�F��#�2�@$�%J�N��f�{��!!V ًW�.��o<��_v$,v~�]���)��:�OZ�X�m �GH��64���X�{� ښo�v��V��k����hT�hWe0I��I}��̵�{|ʚ��M��s���i�����݄+��0�����̘��u�1���C�u�'�Vu�mɂ}9���'�yܐO��i���C���)��C۩� ���MG�M,�yd3ҥ>���)���XXc�)`���S�f(SD�I�^x�E>������.@�M=%����FUM/ܾ�bf1��ߪT��e�4T �rJ:������J��Y�J뚡�+��*�.�t�<0��j�I���z.u�q�F��7���މ}��s�D�w6�;�I'�v����:z#�O�Q_"m��6p���<~X<fڿ��%��� �|>�"�^-�U��2��4�/�I��`:�0�����V�&�������}� >d|����V2z�t"O�]CG����������Ü4�[�m�8��C�^ a�~� ߿�����������G���Ӑ&��4j��.V[�j��(X/�Z:b�3��@�]m>E�>d��*�%����JW�F��P�b���Oı3��E�$���6eP0�"I�������m{"���ns��=��褂c�d]��t<��q@Ӥ������X@�w�e�W����=�v֛��I��+�A!�B���w���Fsw��n��!���x�'��s��sL*!��'؏+�����<}N`�T��� ����z?9k[>9u�|ڌ���a3�g3�ӰN�"����fXJY�������v��!�� 6nh@�E/���!�/��;(\�Eh��̏y�!�"L��$���ʹC�=���U����,��C��pK ���6#{J4Ͼ��W�q Q�T���._� �8/�3���ڼ"��J���GhN�[4�t��������p��C4���QX��b3?������F<qҶ���6�~�7M����e0�����Q6 {x$2p3<kΐ\��~~u4�QϳQ-7�!h�t�p�%ڒ��%UY�+�Ķ����l&����w�&/(U����z� 3�6Y�={^�u���(�$�+���֩�5���?�Wk��pʦ�3F����,� �:��w��B��W��[Rm�I�)fz�GA����[���\�� �J����&،�o-'����)O��v�i��E��.��&�X�Qx��� �^iq#�I���¶����l~;M�o�P@1��7���Є&��A���| ���f�7<�~>����>��$�T� ���f���l�w� �g<��k2�,�[C:�cPl7�#���Z����>H���1�D�P�$����g�H���>R��n�zbd�j�^�k��pA�9��T�2B��1����UO�
Behavioral task
behavioral1
Sample
ksomt.doc
Resource
win10-20240221-en
General
-
Target
1.zip
-
Size
1.8MB
-
MD5
97083dc79935a11c01ffba26a01da413
-
SHA1
c81e3e964d7341a54e2325b86474a282f3ca70d7
-
SHA256
50f06b89921aecc3a606e0ca64db72f20865766dfe5c5396f276046eba3a429b
-
SHA512
d9a141d233814ed47a260da3e1c5ca9cf639e921897993eba1423fb9adfdaef54488134cf3d003280c53d1cf7dcac2a415460906154c41dcb70ea4ab92ee235d
-
SSDEEP
49152:MEUUnjSCfmgwUnrJUBadl4IHDg45iVRpcXyzDuTlSDEiR:ycGOdOkNs45sv5QiR
Malware Config
Signatures
-
resource yara_rule static1/unpack001/pkcs11.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/pkcs11.exe
Files
-
1.zip.zip
-
ksomt.doc
-
pkcs11.exe.exe windows:5 windows x86 arch:x86
2c740bffa82fa7aff024c0822cd2b8ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetConsoleCP
GetTimeZoneInformation
CompareStringW
LCMapStringW
GetStringTypeW
IsValidCodePage
QueryPerformanceCounter
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
SetStdHandle
HeapSize
CreateFileA
HeapQueryInformation
GetSystemTimeAsFileTime
CreateThread
ExitThread
HeapReAlloc
VirtualQuery
GetSystemInfo
ExitProcess
RaiseException
WriteConsoleW
HeapFree
HeapAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
EncodePointer
FindResourceExW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
GetFileAttributesExA
GetNumberFormatA
GetWindowsDirectoryA
SearchPathA
Sleep
GetProfileIntA
GetTickCount
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
RtlUnwind
GetConsoleMode
FlushFileBuffers
WriteFile
lstrcmpiA
GetTempPathA
GetTempFileNameA
SetFilePointer
FileTimeToSystemTime
GetFileAttributesA
InitializeCriticalSectionAndSpinCount
DeleteFileA
GetCurrentDirectoryA
GetACP
GetOEMCP
GetCPInfo
InterlockedIncrement
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
WaitForSingleObject
ResumeThread
SetThreadPriority
CopyFileA
GlobalSize
FormatMessageA
LocalFree
lstrlenW
GetCurrentProcessId
GlobalFree
lstrcpyA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetModuleFileNameA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GlobalAlloc
GetModuleHandleW
lstrlenA
GlobalLock
GlobalUnlock
MulDiv
FindResourceA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
FreeLibrary
CompareStringA
LoadLibraryW
ActivateActCtx
GetLastError
DeactivateActCtx
SetLastError
MultiByteToWideChar
lstrcmpW
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualProtect
VirtualFree
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
CloseHandle
ReadFile
VirtualAlloc
GetFileSize
SetEnvironmentVariableA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
CopyIcon
FrameRect
SetCursorPos
IsClipboardFormatAvailable
GetMenuDefaultItem
SetMenuDefaultItem
UpdateLayeredWindow
EnableScrollBar
UnionRect
GetIconInfo
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
CopyImage
OpenClipboard
RegisterClipboardFormatA
EnumChildWindows
SetClassLongA
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyA
ToAsciiEx
CopyAcceleratorTableA
SetLayeredWindowAttributes
EnumDisplayMonitors
RealChildWindowFromPoint
SetParent
SetRect
DrawIconEx
DrawFocusRect
DrawEdge
CharUpperBuffA
LockWindowUpdate
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadImageA
DestroyIcon
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
BringWindowToTop
TranslateAcceleratorA
IsMenu
GetMenuItemInfoA
DrawFrameControl
IsRectEmpty
CharUpperA
IsIconic
GetAsyncKeyState
ReleaseCapture
LoadCursorW
WindowFromPoint
SetCapture
SetTimer
GetSystemMenu
DeleteMenu
IntersectRect
SetRectEmpty
DestroyAcceleratorTable
NotifyWinEvent
ShowOwnedPopups
SetCursor
GetMessageA
ValidateRect
DestroyMenu
TranslateMessage
WaitMessage
PostThreadMessageA
LoadMenuW
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
GetWindowThreadProcessId
GetDesktopWindow
TranslateMDISysAccel
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
InvalidateRect
DrawStateA
GetSysColorBrush
MonitorFromPoint
GetSystemMetrics
GetCursorPos
SetWindowRgn
InflateRect
SystemParametersInfoA
OffsetRect
MessageBeep
IsZoomed
PostQuitMessage
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
RegisterWindowMessageA
LoadIconW
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetKeyNameTextA
MapDialogRect
GetNextDlgGroupItem
DestroyCursor
GetWindowRgn
DrawIcon
CreateMenu
MapVirtualKeyExA
GetMessageTime
GetMessagePos
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
IsCharLowerA
HideCaret
InvertRect
SubtractRect
GetUpdateRect
GetActiveWindow
GetDoubleClickTime
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetClientRect
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
GetParent
GetWindowRect
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
SendMessageA
DefWindowProcA
CallWindowProcA
GetMenu
GetWindowLongA
SetWindowLongA
SetWindowPos
GetWindow
RedrawWindow
UpdateWindow
EnableWindow
LoadCursorA
KillTimer
gdi32
CreateDCA
CreateCompatibleBitmap
CreateRectRgnIndirect
CreateEllipticRgn
CreatePolygonRgn
CombineRgn
GetBkColor
GetTextColor
Polyline
Ellipse
Polygon
PatBlt
Rectangle
RoundRect
GetTextMetricsA
CreateFontIndirectA
CreateDIBSection
SetRectRgn
DPtoLP
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
OffsetRgn
GetRgnBox
SetDIBColorTable
GetDIBits
RealizePalette
StretchBlt
SetPixel
CopyMetaFileA
CreateRoundRectRgn
GetPaletteEntries
SetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
GetWindowOrgEx
LPtoDP
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetViewportOrgEx
EnumFontFamiliesExA
GetTextFaceA
SetPixelV
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
ExtFloodFill
GetTextExtentPoint32A
OffsetViewportOrgEx
CreateHatchBrush
CreateSolidBrush
OffsetWindowOrgEx
CreatePen
GetDeviceCaps
GetObjectType
SelectPalette
GetStockObject
CreateCompatibleDC
CreateBitmap
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
CreatePalette
SetTextColor
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetWindowExtEx
msimg32
AlphaBlend
TransparentBlt
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegCloseKey
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
shell32
DragQueryFileA
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation
ShellExecuteA
SHGetFileInfoA
DragFinish
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
comctl32
ImageList_GetIconSize
shlwapi
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathRemoveFileSpecW
ole32
CoInitializeEx
OleGetClipboard
DoDragDrop
OleLockRunning
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
CoTaskMemFree
CoCreateGuid
oleaut32
VariantClear
SysAllocString
VarBstrFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
gdiplus
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDrawImageRectI
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
imm32
ImmGetOpenStatus
ImmReleaseContext
ImmGetContext
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 290KB - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ