�,x}WQ=T %��un���l���y���?J��+WA24K���ij�\���aIr|��j��k��w���w^��{�}.���>�P�X��/La����U�ZڋjVǔP�"R����v\h�C���n �v��mV�^O%Y`ӻs�"��� �{@�������fU"�l4�~2�Or�N/\�D|���������N��`��T�h�<�d(E�����Sܑ��"+_��eO x�����p6���Y,���x�o�~���Z������O���"���]�3eU�7��M�iK*����_�P}=�����\�/� �[ �7EBP���<��2����y'f&�g"��*��Ɠe�S��P��D|��+q���α�*�����ʖ��ע�+-�C6�y�m�ws������L�R�Yn.�8[Ae�%J�Qj vq��➠��VX�K�v I}��{S�kڪ��ao����u������?�r��K�?j�z}�weMʆ�\�K�mas_A6�I)�5�u� �W�۲�� ͗VXe)����?B���$i���8E��D��%I�R�2y��c`B�+�Q��W@]���.)嗪��M���6�Aَ*L��dq�&�ρ[G�0����\"�?=�ӎ�Y&�s;N�ÀE7ț�t�m�u'ؠk�J�-DA�"��oפ�쉝���[Ƶ�i�.�d���|�P�E�1oQ�y~]J� �,��C���)1k�� ̇��C��+_�� hqyZ�K+���&p����V���k���gۥ�TL��oB��g�/�yL¿\q�р��烅~L�x�Xӏ"�r��%BtEĺ��J"�y�y��=R�����m�N�����@�3�Z\�O� ��F�� �91��g�� _8M�8 ��X��N4Vo��Q����ք��pf��/��Ⲳ7��*���r�5tjpI�E�و���3^�����N�Q��� ��zT�] I2u��*�������U��e�m��f���$�3?n��a�F� �X�����1��3Zw+mW�(�{g����.�)7��Z�҈/H�J �j�m��O8�欏��Q��Cg�4�B_�\`P{�'yD3��\��&��Q�+�n�pBoҧ�0�J#��Q��O�����n0ݿH�]�훉o ��-� X� o������� "冷���Ji�1���?�"��ۖ�ʱK;��Rs�C|�WTcq��*o-��b~�/�Z[�}�I��6���o`��:64�����XH�Uc��B9R܊v hq[Z�N(~�v.IP�wD �9&�1��J�J����ܿ�l�M�����5�r� �!K�Үh2�_E*8��U� -<���B�^JN�K6����QH$���u{ ����N1}�t����z��HM�u�/�aS3��c��@��=��]�?m�<႟�֠��0��ّ?��QZ����3Z�"EFd�yp�� T��(ށ��f����������i� �����%�����)zV*�5����8�G�4��l���a���}K�-̪$�NZ=b��It&������:���GY�Ņ)p�2n��Tb �������@|�g��S�Ս�.���dz���`��=�MH|��9�Jc�&�N��<m,M9�]^2��B��x8t��� ��.<�Zc蕮�6����W�{���E��Q4LC�,��\��8�CJ�烻Tgt.�ut����4��5Km��>L]�z��6a�]����((d�L��#�4�,a#٦����.�u+{J)ɏ�'� ��Fg]<�J,VB>�گ�V��s��`+�>J������$y&�+�D��g嚩�ļh2�����Ȟ��48\�W��]P��}+��ƤgT����I�2Ml@[�#�3t�p���9����%�*�.�]�t�����Lɣ�;��$� ����x��[8��=����aBƎb�+��û�\n�B�^��}`��� ��dݳ.Z����|*��P��Գ)�1E�V�3G������Jꛠ E�{�+���xjid`�qFT���P> �䟆��=�*�]sh�A7�^��j³��2�D��;��ke��A�����a��+f�Y3�Ts�c#����|����:� Ȃ��o����W��q��/�l��UG�a������:�`�4#�ճJ*��Ҟ�>��, �a���5a���$4��y����V��S5kf�����]'��g�* -~��cVU���}d<c$4deOB�]���n`t�����_cz��W_�ݫ�l�X�i��R�p3楱�Lv|%P�6�H����E��j�m�bOz��py�M"���,V�϶�pJŒ���P;_���9����'E�yv�H�<�����V�n����ڥH9n�^ ��f<�g��*����4ܯ���R6��%�ë�ڮ�d���H@lW �Z1L�r1�P��I��Q�Z�����F��RxOQX{�aɭԙ�؎I������t�"�xʜO���*&]�� ta����p^j�珣*�A�K�<������«Ao�w�ϻ�����8}�w���®�&��z�ŵe�J�i�Dk15�s�����ζ�ܚ.q�� ,>��yu-�S/{]h��� �aƊ3j���gG�X3��䎀�FP�QD�<XjP����B�b�c�yyS��D3A���i������=��!>������UK ;������R�_��4�I��^�������^���j�g�E�����M��Ү-�)Ѝ��1=�u� F){����4����"�Tʨ^W���F����T,& w����\m�<b��?�����-mBMy�"���g �(7�DH�O�#Ċt�m��@��Q�s��,`���M���>�?�SvZ�D���4�/a�6X��Ȝ�MiX��9n}�E\�� d�����a������g�P{�V��9P�M�+զ`�+Sp��Y��ܤ �q}�&��[SO8ݯ��ơ��o������l����@j+>�#�c}3�?�a��J~@WS^>�F���<JQN�(!`��V{��!��0�S٢� N�F��(=�?��$���%��C1N>gйG�>�b;Q���
Behavioral task
behavioral1
Sample
Yeni klasör/aUGHgUfP5uUTa1LJsXW.exe
Resource
win7-20231129-en
General
-
Target
Yeni klasör.zip
-
Size
4.9MB
-
MD5
37f446c7245f0a4046c5fe2e91af3645
-
SHA1
809deb43ee01b45f369e5c118ac9e603857574e4
-
SHA256
04afee12ca1e37ffbe0701001ddfe4f61e85ec94d2c3d061ba0d4860c88dadb7
-
SHA512
b8f247d6eab7470beba3ac13c6c6e698e2b4b2da70e481585db26bdcccb36f29a662abb5c87fdf8ca3d02182dd9d43f0d5bda6bf7b2857115d9d8a653bbfc950
-
SSDEEP
98304:ctb1nFT7wTBE3UYw6Lnxpxvetm/IAQUvCUKrxS3rjcPTiFs3TB:qp6CvnLnZam/FCUbjMTiC9
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Yeni klasör/aUGHgUfP5uUTa1LJsXW.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Yeni klasör/aUGHgUfP5uUTa1LJsXW.exe
Files
-
Yeni klasör.zip.zip
-
Yeni klasör/aUGHgUfP5uUTa1LJsXW.exe.exe windows:6 windows x86 arch:x86
e12958b9291a1a1a47d36b8fa6f6f723
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteCriticalSection
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowScrollBar
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CopySid
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
wldap32
ord219
ws2_32
send
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
bcrypt
BCryptGenRandom
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
_fileno
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-filesystem-l1-1-0
_waccess
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 500KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Yeni klasör/open.txt