� ���ֹ!4gd�a�hS ��P�fJD��t�G�x�]�auk�ԚJX0W�IS��?�A�h���|D;K��@�\�<����4 jdp�9�P�a��������<�-տ�<4H��\�3W;��/ꀶEt=�y9q�XL�wd���Ii��Q���-�`8 �֟v����[�n��� O��1�����W��cO�{'P�uJ y ��_0$a+����=���ư,V}� �����-C!EV�@��J��i4��)5#�d>��fI'V�R���hy�}�V�8������B�N��Op�rz��W�ȗq6�;�V�d�g"���b�8��kGMxnАA9��?~? �"��爠��N�w�gKI�q�y��f+��?s�X� ޢh�zj��̓w��v�� �5�g��Ą"[�\A��J�ěJ��!�/FG �B���}�-�v,V` ���m��I}|�ֶy�sTY?��K�p�k�Į�k\;�N>�U�g�r���U]��A�������R���ﲫ��_RyE�osՁڗ3���J���3����Th��t<~a~`�L�%(��Dh�I��.A8�ͯ4~Rǿd?!��@Y��n/�T$��������Q���`<�aͥa|�3����?��W����|)����q��D�(�YmA;��'���b!lΊ�۔�#_�hj�R>7 3��Ü���t5(���&�A��� `T:h�e�`�Z�~x�1���E�Y����}��!>��� K�ODx����}� &>!M���0í�{'�˷YE@����0+z����b�+����(W&��AVV�rU*����m+h�"�;@���:�:����c�זU�� ��+�Lq��]�k��r`v�ˆ���E7��a��-����G��g10�$�y�Qz��Ii*�L�j�z~er�Z|��p��ل��}������%����5�{q��U"�p��ݾs�fz�y����:\R¨���!jI�,V��ʺG���O��1�/����9";��Em��8�n�$��NQB�J :��~��O>�2+E��y�b0�^-����{Z���}@�y��2>���ps�' �Bq��+d�y���* �deu��,J|���L�^�>-����ZS�Ӂ����f :K C��c�O������=�g pE�S��n*�%6��DR��)��d����d�8m��r�������9�繟#`���Ԍ�(�uւ�Ꞌ����Ӯ��A�뼺$o����Eh�T�)������Y�Ϣt��6��D�vq+g.|��e�T �٬��:��M�n�N��֑f�I��C��x*�����z}�GM�|�T�HLc�Y'����s�8/��5;�Ct��#/��n��lݳ�Z9<1V��R"S D ��r��l���Zi��l&4�w� �H� `���tK���㵔��+�m�Xd����`�G�*(O��Ƈ�6d�cc��A����Ε{������F���ۆ��-&�76;;��No��(YO=�r|�?2�Q����!"�"y*��F~��k�m~��Ⱦ�]S5BI�Iz����83��OJ>Y�j?�!�'��g�5뗓��n��m��[�\7���-�$���*��4��1�$Z������^HPct�q��ʠ ���7��(�AkU�3�e��wp������ip�������i ��� ��2]�b���<E���-��PIkS NM{bU�b/ޖ��žu���co�{4���/��3#��)���&>�b>{��R|YU����x���6cceB�+ŃwJ_�K(���b�c�l(�Uܑ���<g�B�>3H=�2�dHB�LD@s����[���P���_N�t�s�,�Q�f��y�n썏��R���5����3Z��]�C�7�w@���g��*�Bu���sw�Xe&��̢S�| �����g�K������E�$��f�A,�J�9E��|x�����"Nv�����lu ����~@g[l��D3=���m"��Y�щ�G�O�Θ���9��L�Y6�1��l|��6�8�����b\��wpt-�R#��f�pV�i�d~#�>4����� k�y��RjHU6I�����T, ;/���������?F�@����Θq����O?� �2r��!ƭ[�BZn#\�J=ޚ���,h 4��xw����A�<[��O���֡�!��ӓ �f_rW�@_��Sf+k��~�f��s�Y6p��,���������2���o�t�r���e?��u����ڏo���-+�||�P�� ��4�(���[��M2d:�9Ơ�����P�oDoY�4�����F�.��6���+K��2pG'B����F8l貢 !|����6/���ā��� ���B~������{��s�eR�Y��!ñnGX11̬�\v�[�˭����t#�4��ji�´��\��LT>[��0t=��GU���ᦌ���(�Cjm3}O���t��ɂ;[�F.�e[�����<-��y��(M�����p+j_&��0��s���w٩q[��/F"���3��^����鷚I�~���������e�%�������V���D�7}�d6��5",~�Q}���Ϯza�}lĢ���VE��� ��i]��8�z<�q�5��mIzB�|�*�̧�o���V�G�����4 �]���)O]������Z}� �¸���ҋ�c�/���b�FD����w�Σ�s�ɱ���� ��h�I�L�N��Id��W̎���L/T ���4�Ic���t����2="ڎ�2=X3�W�^�CDew��n�����9"��� �� M墑�a33��.����j����48�$�>�-w�(���ŭ���`��F�D�(B�5� ��E�!;�]�&��+�L��J|2Λw�#��i@�\����@3�s����-��4mu�D��)�R$y$��2� �� �J� �o�j�=�Yl:�ԓW��q��F܆��X����8Q�]b�����C�O�s�4w�/@�u��ls���n�`�8�?� �ߔ�p���2��z c?�q��yIx�O_v�@x�oW�ɯDIo3��V
Static task
static1
Behavioral task
behavioral1
Sample
Promethazine.vmp.exe
Resource
win10v2004-20240419-en
General
-
Target
Promethazine.vmp.exe
-
Size
18.0MB
-
MD5
dc4e359618754348d36cf3cccd469995
-
SHA1
0beb81236e28285fa09fd562cf494379c670d2f1
-
SHA256
9a346a8fb9a93f97f1e9900f656fc73401e78e2f2feb8ad28aab64d755c04b5f
-
SHA512
50a7bb71c2f637edb5d3a2d6edb3c653e356b3e938ddeb0d950d90f71fad10d03a0f2bcdb1e298a61ed439881290bbc14eb190c956bb8c254eaf808eb71e2153
-
SSDEEP
393216:W3rE43IYLrsNkTKzMjzWtdpr6VXQ+9ZNwPa4VYkSmcRoFnt7:Yw44YVTKzEydp+VACiPanAnt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Promethazine.vmp.exe
Files
-
Promethazine.vmp.exe.exe windows:6 windows x64 arch:x64
fb49cbb3a5048b68a6ede55435ab5646
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LocalFree
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertFreeCertificateChain
ws2_32
bind
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
Sections
.text Size: - Virtual size: 498KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.?c= Size: - Virtual size: 15.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.XdL Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uj. Size: 18.0MB - Virtual size: 18.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ