W ��d��/��,��]�y��g�����)փ� !M�)�ݠo����|����M����p���b��e�}�J_�W֮]���p�YCC�� ���A��7�>?1�v&h������uH%�۩Z��'A�\�vɭ6�/�Q&P�<�%:#A�Vj���)��L���di�b�<��N���Û��+8V��r�!ٮ5��}����l�M��������T{\�7�R��E�7p�� x�)��u9.�~�RҸ,Dc}� D����g,���s��B�:d�rrL��� ����m�����Z�x���$A��R������Ƴ;�o ����*z/��/������u��n�o�5j}L#�}�X�H��ÿ�o�*{��h[Y�'j�T���;�+���D5;��҅��qkw���ʓW>�����I�]�F`���(�V���I��>�Bm��\�ok� Z�'M��Ƣ����O��z�E昼g�뼪����;���3�#5!�q�7��ұ��{�jŝ�S^���l���Ո���$�^-ڲt��#�6X�Д b����N ��WU��Esw�U���:�e=��&]z�@��l�*&�o�w6�@��^ObX���2n�z6�6��k���C�S@�Ѓ�!t����ʁ�'�A�_�����l䃗2 �M��<�#K��N�Q�ۡc��M��]f}��l,�=���1p���!�5���o��{��\k\/�S�����f�}�?"�����Z�����昆���5���J�~�Di2K홉�Q��T�p���?߯�K��g`���l'ϵ�����Q��Xگa2mSGxx�������C5�4���u�8|G9��g�i��}m#M����Ȫ�[���yR��|�weA��p��� � �{�<�A�kj�r셭��D�xSfi���2��9_�ޗ���#E`X䲷�d�k15�%�,}�vC#OG!rݧs�c�X��l�4��==B���sh�L�%����N���̎N1�@�XtCU%���]ekIڟO��)ӳC�E����4����i@u�������z}v;b��\<h�����ϪnŰI�q��^5ܬA5� Q�j�(����hnDAkcԈK�#��c�9C!ok�t�.�No#���f1vԝ��}/��@y7����%;�l�W�m:�ܹ����H�c��\����ƕb���D)��x ���(��W�����N-�P$5f c�:~�Wq�4�(��50�Ίa��,d�n�Jv����T�!�:�s�)W�5�*u�^{��'����p\;H<Ɯ� H{V^ᇬI0c��alS-���ۡ�բ9�m��.�U�`�F�鮤Iz����|�P{jK�Q�&{8�"aUƜ�C\�������j�>����@1� �<C�^[сh����*��?��5���<P���S���Ljc�]��T�x� 1�HԷ6�M���/^��'Uk�%�J��<w���I�7����������� ��@�Im��?�%�Ƈ���L���2��G��XE�>sj�bD� �N(�>j8�0%-2 \��7�m��D&��Ժ06*I�jz܆H�d�!yDW.��v�>��8� �Fu��������~'�e���ߑR6���Cb+�W8ѽU4��]���/7b��uV���9Nh����{����ص����f�樔s0����Fi�NS�3U�=�������9sU���b+ d+��\�X��n��24]2���(&�������&ѧ����z���v��Ip˂�Q��QBĸō���`���(���q�O���W�6�#^l��˚�K*�? YHh�$W`T�����Lv?0HAC�\��0�����>���!�&Z9�J���{ؙ�?����]מ���W୳}ڜ�`��A�w�b?�|C�)��Q���'R����7����qeAӯ�b��;4��;�\����o���Hk��= �����sq]�0��=]��/�d�.�M�5��6V��R3���7+a���v�����\I�������Q=�$�P�����A��-��h�:W���'2>����%���U�2�~��i5)T��OP��cgR;���'rcAX�y�l"d|�8� w�`���Ӧ� '���y`��"eƆP6���p��aG��a���"��۩���c�� :����|i���� !�LT�cF�EM�x� �t���Ё�z�����]nC��KLR�3�:��Q��v��V���C�1[����auԉ���>m��j��c�$����t*K�;"����r��f}u�%�J���Z/�x�����OD/_�_�%��8]� <���6�n �e�:RR���"NQW�K��j���FRe"�=�`u��Mc�zάqr�L#P�jX[�lD�)^�xyO%GEe(Ѩ����[� ��Kk*hc�����z.��C<Cv�Iͮ��Jk:E�!��p���4�MY� <�U&��������։x��%_S戾��ET\CwJDi�+����%���� =��䃬0HrGo�g]\>.G��Ӧ�YL0c0��7u���n+��E�}=Q���m�rC^��X��p���P��E���Flo�RT���� �QO�4ײ�֫*��:�S������*�<�_M6:�-�8ʁgW�����+�Y��Y!�r7���{_�)�u{ q��/! ���9P�IINY����2h�n��e�Q{ݦ��a�-� ���� F�,�l㥽!]p3A{0��h��&��\t��5R/�_�����^?>kp�r�yw Y�T%$yM1�m�=zC$L��77�+% %ɾ#�:��P�zo�Dr,?�*����C825��-�fw�����:�; �)ۈ\�����*� #i o(O����țSr����h:1N���je�Ւ\�Q<�p��KP:�B05�ӲE��:�Qxk��5��L+���V�ts 7�[cy�9n�j��H#�zs8��0�s)Ԯ�=����W��#RGRWgp��>��`~�|�"�9�llIĉ���!� R��aF�8��������~���qe.�4��B8��v�|���ւ�ZQ;�n^�����u���2������=6$�۫'
Resubmissions
09/05/2024, 09:18
240509-k9l38sdd23 7Behavioral task
behavioral1
Sample
Yonder_Fivem.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Yonder_Fivem.exe
Resource
win10v2004-20240508-en
General
-
Target
Yonder_Fivem.exe
-
Size
6.2MB
-
MD5
bc7128e9bc6cd871e9d2c287cd717d39
-
SHA1
b19ac0afaa4d93f9469a4367056b62e9ba49f094
-
SHA256
ed5b5ac658a134ad7f62d115510abca2850459b313d53e7d1742190a9ea60d14
-
SHA512
12dc613eda0f0372bc40c3ce74c3b5dd5cb1bf01d43e6786f7a11c7b9d89171aad85c9b2a813072cfdc73e511d192cb60be8effebd3c1c35d60a2a5ed20dd349
-
SSDEEP
98304:ZjWxDXRGFyZftzByQ6/Sw87AB3bq6p9OJmtgiBnuNfXWNasKo+oX2hsfBo:ZjWxFG2JByQ6/g01q6PiNiB6y97X2/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Yonder_Fivem.exe
Files
-
Yonder_Fivem.exe.exe windows:6 windows x64 arch:x64
c4e7824fd7f9ddc938315e45ed914d62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LeaveCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXVec3Transform
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertFreeCertificateChainEngine
ws2_32
ntohl
rpcrt4
UuidCreate
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_unlink
advapi32
CryptDestroyHash
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 780KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 942KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ