��nyR+����9��p67������Qd�z��2!���1��g>�� ,3�<�����P��l�9�g����*�-Ⱦ��#w6��m��K�Χvq!RUD�7��x�D�H� ;�5῏d^����c���NJm�,�\P��� �?%�k��&r�5���>h��h�ל�pqRŤ(!�~{}:r����� I0��!=��@��g�����w ����OR���I' ���n�vݤZP@&���I�B���\�P��6z�\)�2��2I�����漳��ͧu$I�5�����<��"��=�"e�S�aN~�z3Kǹ��q$;�F`�l�ߕNpW� ���m����Ɵy$ zw����p����y<��`=/��z�,-Ʃ��,R�2�IzD?05d�D9D�]$������5&�Nj ��p_Zz`/��Y�Uޖ�̏'��ao�ꑑs��I;�����ґ���D�?���qR����C��4nb��IÒ�W�aOXǨ�ċ܌���0ܢ>u��Y>�1����T��VY\�}8�)PA���"�u��!���wp\���/�H���N˞��"��Æ����2�?[7D����l�SX����X�8`��qK�[��ʧ�q���F�dz�-i��^BJ��[������"� �R\�$rf;z�:Gn��粿v�K�� �����9aܒՀ��`mkMlh5�1�������#�[��]�#+��:�cK�ץ��և4~�#�1<��I{�^$�u(���o �=Nv�a��0���J�FHo�{� 9]r�$��0�nc���Ca��pFa�gF�KR�5κvP z�S�y/Z�OZ�������ȁ����x�1XYԀ��D����)*��6��n:����&j� �D}�`�|���.`�'�����J#e�]�R���.� u[E�������D�_!�|h�q�f��?��mF�M�q�XD����R���\���v�%�w���\�����F*�����P�ȉN�����L�=�����7�M�A@pc��0�IB.�L�/+6��:�qZkA8����톑r�xM`;׆ ��A� ~/v9E��^�O��~�9Z^N�������\d ����h!_��硈F��vb�i����i Z��:�:U��@kj�&�Ł�qq�5�l���㲃�2���9�{ �"�fP����O5@�چ� տ&(�W>�n�S0�"T����j %4�1� ��S�ԟ���I�\��GVK�Lr�2F��۾GsW��&��<A��������9�����s���<�H��^�q�^L;��?�&����^O���5GH%�x���X/Ƴ�����.!��o��!��I�:k�g>�(sqƑ�_M3���S�{�/����i.��J�P�yz[��`�c-��n�6�^�b� �&�@A={T_Ou@�D(c��EH�:�V$A�Pm��,ݔ&984;���0?>�����h3И�@`è.".41��5+��:��%"��IuU� ���B���duy�D��L+��"�.�Fe������k��_���R���B�V������1� �&Udr�T���Ü��j�-��91�g�Gu�0.T �U�d|�q���;��m� ���,àg�-���s��|�_Fr�ǵ���� ����0SFz�N@��w�|zB�F��K�D��a��������qN�mBS"�d��n��` ��_��T֒� p�� c��z��#i��w����m��?�Y_�)oa������p32u{��ۀ�E�B<�Yh�N��F���_쇱���˘/|�� �e����u'p���F�mK!�p�)�G�=|�z<�{���3�Helc,+V�m����ƛ=5:m5�!"�ը�r���Ȥ�������dJ�R���l����3Yt����:���_EnO��J�E�Wq���l&3Gλ�`'�[����h��W*l�����ΧI��������M�\��o��D~���2��?7.)�^�Ê�!Ȣ���軗_�����~��L��"�/n��r�G�-����׆�璍՜�n���f�����>�߰F�B�S� �,}�G�&PNYm�h�j(��uu����K�-7��F�Pؠ�ēAcY�bCQ�v�F�c#q <�f�A����⒮���P �k9�\8�oF����wp�.�������5'���~�яZ�P:E+�M)�5�զ��{ b��������ss�g�Z���7P?=�Є+?C,��2�B_�J����CKd��D;�89�� G'��l��gh$ �ht(*�?� p�Lz�'KC����{8?��Qň�Z��M�L�JDecn��'- ��*�6��p4���5�����諔�mg�ڟ8TAT�u�Ɏx*<�\S�j��`�M�ܳ��nlzl[8v䯬�ac�/ڑ����i�G���m�l����.�N�]�U���f�� �J`d'S�\҃���( r�P���_;$��r+�]���GI1���:�6h�Wb���R5����dH��Aj5E�����#�J">8l��N4cN���[%v~�`��1��&�fğ:�����з��\�gR���/H�H�Vj�5��*�9��9hƾX��PG��*�Q�`��Z�}��ד�?RZE�So�x3��a�=>�Ns����֖7��j��=��@�"B ���8�kO��ߤ��V-�.cd_ʗ]P*L/K �����n�F(C k�Q]�o��G�>��"�)s���幧�V����}�NP�?��wy�/����a���i`4�s��w!�\���N]�C61ȕ�'%+9�c��E�h��JeT8p���<HNvt�=�I�����')�w38#�9Q{���m��<�7�J%�V��EZZMMV���������o�G�zf��t��FH9��R;�J�H:t�Ry{+p�g�@˗��p=0n�E���y�2���,�O{�/\��'�1�����$��(X�Y��&DZ��] ]���p�`�;N���.)����:3���i�Ya'? ҋ: ,��Z$�7+DŽ�_+��KTT�rZ���Rc)"m�`�H7B9���4
Behavioral task
behavioral1
Sample
EULA.docx
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
EULA.docx
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Fly.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Fly.dll
Resource
win10v2004-20240226-en
General
-
Target
b665a9f336116a0724a42f95de0d4cae
-
Size
6.1MB
-
MD5
b665a9f336116a0724a42f95de0d4cae
-
SHA1
cc17c9b0fe6bbb1b8d2cfa4305118ff4741550d0
-
SHA256
ac073e614ab5e889f1949c1bcbad4280952047e8d6524e46ca0b20fa958d5c38
-
SHA512
4000221411ee5c9d06d1e410f3f65448745fcd25e05171eb0dc1cf6fc2b084467d122cca033c61736d9286e6e88163d5ce57340c46a24e07b6ea839921648b8f
-
SSDEEP
196608:V9xm+M34JM5I3Zi1pVNjOrocwBeCM0tG2olivcqhC:XJMWpi/Vp3cwACJtG2olivo
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Fly.down vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Fly.down
Files
-
b665a9f336116a0724a42f95de0d4cae.zip
-
EULA.docx.docx office2007
-
Fly.down.dll windows:6 windows x64 arch:x64
fd4172d3706d4263175b73f80bd909a0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
winmm
timeGetTime
msvcp140
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-utility-l1-1-0
srand
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 498KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
FlyDown/FlydownTheme.ytd
-
Read Me !