Lk�ʬ�����S@n���d,r��܆p�S(��)�_K�����憐�vq��o(̩u��W�n=���,����>����@ :1Ȇ ���}!����ʮ�P���X�.[���4�IZ4��q0��F'��bE;�5���l�.y�7�j9+cUI��5�Y�X��Z��R���lA�|���������=B��u����w��J�-�*g���x�+/D���Z�f����j:����S�d#c���g���M=�Ǡ�k�. �u"����� ;xU�x�&�>-e��Am�f����l�o(���t;�`��5�d?����mp��r�[�n-������u��A>z���WG&�t�p)�N">��4È�`���n$ط��H��������+���'���>��;�L�Ư�1d���a1��Nd���b �����_�O=���i2 EM���$#]+L"9x�˴������.d�eխL*]�ڛS� B�,(�4�ӕ���L-Z�%ȧ����@���n�{���L�u�0���\"T�p�ts5]������?J��~�=j��#�u)�s�H=�}Р�����w�:��8���iE�p� <������%�pռ&��$�9��1,����&}������ �M?��Ϫ��K�%n��OX'�u0Џ�.�@G�H7;�d�jz�CR��shv��*����m�=��>�B�*7:~�`�2;~IWrj6���t_do��k$龪6��$2��s�����Ո{�ߙ�0����{�S�����<��� 2w��x����,4���DɅy>�n@�2��1,��v_�$a,��y`\S'����#qf�7�˶�~X[:��O�ɔ��~A�=����X�Aאַeٞ$���&MQ�I����Ǯ����� 45M�P.�����P�l�HŻ="K��'��Q�8'd/����n��g��,���n��z{�Cw��"�WxXd�Xà=��>��#��$͇�u].�//J�� �ԀV��]��'�p����p��I�����R��ƮWkv�Ԟ�]H�t�#-^]n�7aC��hq*�Y�ǂ��9�� ���}pv���� ����x�7�?���W�J}-�ʹ6}���!�>���EO�R��'�1C�����G<*�D>��R�����-[��!B�0a��ց8��l�j���G���[�<n�)���������i?=$�ΜK����(�r5X����"��'<��0���(G�����[�B �0�������]d��� ���Vޝ�rAB����� �U������V,��^˺�[�/��{�A�/z���J��*�s��"�ܼ��q��5[|%fl�E�C#�2i�I"dv��s�����oߡo0���N�l���H1}�V�.KI �ޞ6Ug�D�p�z v�^�K���T�e�6{� ʾ�J�Ύ�_-�A�d �WE̮�p�����@'�z��n��v����i�k�T�ʗ��s��V����p־�d#.��a �ӊ�m��� l�5��7U�/Mja?W诽�ϒ���T��#�X�%MM&�����CTCyq�j�o�*����OT�$��ʡ�˂�Q�\�S�Ƚ��^[;m�rI��_�<<U�|�'/�hQ7"KQ��}�ш܆r��|���lW͕b���7�]�.��%��4n��ݣ|��}����Sʝj��%��`�ʍ��F��n*�wH���L���{�Y;��g8v�c�&��y�@ ��\��� 4 ��\=t�|���*�+�7"Ѕ�g-(��`�^�����7ڞ���=��¿aiz��<:Q4 ��� c���,���j�,����X��_��DF� Vg�._8����E���d���|-U�ٮ'��r��~=m_E��5�6���s)�|���9Z\o�+��Y,<���R���<C0'�?p�!^>6�>J^7�z�;��~>�T@#��Ҷ��[�L(��l��JR{�w!)��Y*O6w��^�]1Z=���<��߇��ð3x���/48�p�`B{�/��J�7�I����s\��Q�&{� 1��io��n�o�~zOԨM�l�]-����Z�y�����踥Uf����'�m��n����RW�zG��#��� 0ͬ���е�R������:�N��`�h��L!��a)Q� �G�2zB�+�x��d�e��:���`���!�6���B�� �Ԓ+��� d�@2'����`k���[����Hp����H����hޜ��è8 ��XkR�:��NcK�W��W�{F�E�-�ClUd���fq��/dk^{��v,�f����#FYw����P�}^�Rx���)�(l�3��T�Ɣ0*����+0�<��� k���c�p��[2fnź���C6�JsDž�D���lb~G��.} ��kX�-���F��.*���cIo?��9�$sEԿ>Ⲉ@��jO�@�rWlJF�#�� �9�kA��(��_o�T���au�_�}�Z��QD:��g>9 !EV��+�A�����'엀�zo�h�P_�"{��x.��#��3M��B_�%�E�8�x�(� ��k�K��v��H1+�bh��n$E�h�i 0}��f m$�t,��AA��w���K� uI=�����V�,V6���GC��qۅ$�ȧk��4Y��*�kr�ǧ=tQ�.�aˬ�R��/�LJ���yW�m`�������dVŋ�W��a%��M�Q�|� uC:P츋 n*�T�:�+��p�*x���t��f��c�8z��X(r��#�n`߮�#u�U��*�̣�&PB��ڈq�1�j���ơy�[»��[��"]��|T@��p�Ή:���]nA�?��ǿzE�X�O����F�(wd�:F�(i����I�V��(�ąh������B�@V�u/�S"(���mō𥳐z;���|�l۲pA(}ջ��vH]�J:��ԓV�z-hRS�\��aا�d@�e�t3���e3he;��t3c��ꁉ�ǝ�7c U��-�(�x��B�TA����(Oct��寣�a��B/�"_�c�?Mb�HI;ٚ�,�U5i�����$t�ܶ��@~�
Static task
static1
Behavioral task
behavioral1
Sample
04c277e11c7bc3e24ee7df0008ccb13ba642ea569a4606d43a0dfbfca3087e79.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04c277e11c7bc3e24ee7df0008ccb13ba642ea569a4606d43a0dfbfca3087e79.exe
Resource
win10v2004-20240226-en
General
-
Target
04c277e11c7bc3e24ee7df0008ccb13ba642ea569a4606d43a0dfbfca3087e79
-
Size
1.7MB
-
MD5
c24f5e4b91c35b65b2605467ddaf4d8e
-
SHA1
58bd467083b42aece2ec35da9531f3cae7e3b318
-
SHA256
04c277e11c7bc3e24ee7df0008ccb13ba642ea569a4606d43a0dfbfca3087e79
-
SHA512
eea090e2e2309ad9653e990a6b0ba5dd985368a4423b590e7a5a044c1233ff330342f53af6d83308e67bee7f92d2da89b929b3c26a66304b513f3944659c2f0a
-
SSDEEP
49152:QtC344hlOP8RP9EqpoS9V7keQTBCsLbb03tmf852+r6uvt:iC344f8YEBuV3EnamAeuv
Malware Config
Signatures
-
Detects executables packed with ASPack 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_ASPack -
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04c277e11c7bc3e24ee7df0008ccb13ba642ea569a4606d43a0dfbfca3087e79
Files
-
04c277e11c7bc3e24ee7df0008ccb13ba642ea569a4606d43a0dfbfca3087e79.exe windows:4 windows x86 arch:x86
12a70aef6cea9352e8f5aea22eebf4a3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CreateStreamOnHGlobal
comctl32
UninitializeFlatSB
shell32
ShellExecuteA
wsock32
WSACleanup
msimg32
GradientFill
Exports
Exports
Sections
CODE Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SKY0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 1024KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SKY1 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SKY2 Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ