����?oধ#��\���.n_��Ȗ���aC�t�τ�ELJU�3E�Q&�%�t��O<����m���w�@�1 ~�^��-���gՇF�ӷ�8`7CR� �6�0�n�w�Tl������O��]���ƒ�@j5`|�j����K'�Q���|�s�0�5��^W �|��� ��� �047�P�ڻ�@()%N�H�퓦�u��k���Q��ؑy�}���@ ɬ����~� ��>��L�;NY�7Cϒ3Y��_[�E/�+�D�Ƒ�~7��z�St���R�>�����| Mk���Ñme���2I5K��!)2�-dR"nJ�w}[���z�<��yށV*��1NI�ӯR�7�l�,[\r����}�`���b��$��L6������N���x:�-�L��͘|m�%��Q?e�K�`!����TȜ���"G�y~;\�"��K�]�Ks����2��T�+�qm;��6�U?��e��S�}a�&T�� ����N*������}�M܀J�a�s�K�f�#��֙����s�lz�� ��YlbiCSy9`v����"j��%>�d!�lfY͙]����h�U�Q���Z�����55ٕ<���cڶő�p:�Sײ�$5�{�a�-��~d��V'�&^�2�����C��cN`o�)x���,��� u�ǫa�c!�I.l�Sܻs$��x��N�ăjVc %��>�]�(��/JT�Y���ͅ l{�-�Fl_H�U*�&��M�R���&{����#�ޚ]��Mx�ʵ[ua�sim�5�l}t2({� �?j]�]H�(�b�}�$$��H�P �i����oE/��Rιq����X&�4��O�'����i$Uuka"=�%���:iή��m�Qn`����a'�i���|�2v;��|�'�r*�!�= ~Ɯ�`yq��/��r_������fBI���WS�|����)��P�� �E�#�g����ͣ1��>��-��mʡa�{�gQ{#$�h5���[o/�8<:Ux� �긣w�oW��]�[�}ln�{�P�� ������8���`(����S]�[�w�x��/L������q3*ws7�5ú�-� ��hZ[���`�E����� ��&����T� �i-ʋ����2�8�A^L��J�Dy��?!#�s�2B�mݱq��j ��x6����.\��7_�X��>���n>P�o&F���Âw�r��F� ��T��7 �������>8�p�i�/�<M�<���u��W����6�g�Vv����� @�����̤.�\E�-G4&��H�|Zm2tY����:��� �����#k)�� �/O�OxDʆ}��4m�(���a�������)�t|�I�Z� �+�}��%Od]�@e��w���=��? 1�I_@�4��S���~�o+��4�'+��M�ظMo�;���00,x2�Md3��Ԙ6�ZS�5���o5��eC����+]�_et�����c:6u�ի�"�����8�K�g�Z�4�uf��d@��dJ�y(p���m����j�� ?���RR����%HM��K �W��V���ڵ3��<7V���Ǻ4۔�G�u���la嫃߱��_��hDDt���9�P���๒6�վ���ךU@v��4y�+(^y��9[����V�L'gG�#a&��~���.���U����+=҈���"�^뻹�g����� <C����6��He�1�����Zǝ��(/��g�{.�H� '�����&F�%.o���nQ~�P���k=':^���C���\��+bp2i\��U[��u[�K4~hR�yb[��E��, ��8�H��#hu�ڦ}'���:I�"������ ~�xf6{ـ��y�`R��O>8K�0,��deŚP�Tq�SI���v�<�Ԓ.e����C�>�+�O����Gxͅŗ���� eAΑU�zSݯ���9���pq�����3`�pp=�>�����eaمB �9ϵ�g�����e��A���U/GC���u��<r��ep�)�����K�@�S���(�sMYAY���h�&g�b�椴�Ҏ'�����Ai1�9>������V��5�jʐf}[F7Afc�Ε[�p�`Ns`/HZ�NJ����a�pC��HT��� B��O98^رuJ鎪%����Tu��� �3�}ڋR�Jxd�œL-e�6��=����l"�g:Pڝ�g�0*�7<� f�6Y����~!p�����ãz�ف�J��s: VY~�A�!V�t���Ѽ����q%,�~���7���$�y��$-��s��Tۑm�R��Qv���ݑ��z�)�@�[̶�R��̙PU��XT`����Ȝ?�d9nH3���5Ѳl�7b�K�Z?M����B����tA����A�T�vpv�ck1$�s>H����EEe�$�3�z�<����sn�J:#C��V���63B|pa��~A�������v�n��%���W�,��ǰ���+<�֩���k����,�0�R�����ĸ�6��]E:�C�k?R�+q�B?��L<�i�O�GI��FN$.�O�F�h�v,��#J�Ӏ�ᱡ3�L�u�z˾BB𨀡��݃������6xji�u��C�;��(��^��+������To�H_��Z*GL� �Ͷ,�y�6eQ���F��t�[�PnF�黯Z�c�q+ ��X?v���u�#���M|ҝ!8���)m�w{�V9ֿr�������e���7ڄh-�֙����٘��}���N3��������#1�Jj���L��I����'i��a����r��0D�"q�%��K'n���gSgr�F��f���qwV�;,�n�l# r��],�(״2E�����͐�to�K��N�w98�~<z���Q�Q]��n�"x���0>03��tQ^.�����b4���,�Ԝ];�+d1O_����<Tq�g�n�/a���O]5����h@�N����Ԋk-$x-��Cl��dc��$!�#IH�p��'��|U��^x�})��y����T0n�P_��]s��XN�%IZ��j�cEժÖ���
Behavioral task
behavioral1
Sample
点击此处安装语言包.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
点击此处安装语言包.exe
Resource
win10v2004-20240426-en
General
-
Target
点击此处安装语言包.exe
-
Size
684KB
-
MD5
d5620f185a317bd0f7ab1748a694fd74
-
SHA1
76a21af9f5633025529a01840f8df0beaa28268d
-
SHA256
8f02c6e234cf3b3c7b5f44f666095093bb1994ffdb9b7af8a4493245718231ac
-
SHA512
a136a321978ae8dcc4a37a1159ea94bdb412f07184028b25a35a24b660813afd47554c8502fcaa57370242a4c597a626fdf054a0298ae1b70cf0e7ff2cf9fa02
-
SSDEEP
12288:LpmaUPwIzTxi+el926/2QHuoKzSxy98GxamDvW3Lj6wpfnyaC+6Ft9:IHwIxi+02oSf6kVDqLltm+m9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 点击此处安装语言包.exe
Files
-
点击此处安装语言包.exe.exe windows:5 windows x86 arch:x86
cdc815f949641291d4c6790b27e6aad5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shell32
SHGetSpecialFolderLocation
ole32
CoTaskMemFree
shlwapi
PathCombineW
version
GetFileVersionInfoSizeW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 672KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ