�|x��1{a�A)����e2�iZf4���i��~ᤡ1� 4 쀖��뚮z'�v4�6�g��9�u'hVA��4f}2|��)���Vޖ��Z�Z��~�EZ~�~��c�6��Z"�ڽ���M�l�1D� F�D+'�He���హs��46��b�9Bv��A�eL�Wl���x�֓� ���쨮��Ȕ���e R��Lʎָ��h�\t� ���ޚ�q���~X�K�_3>CM1���^������rub����^`=.�h�N�p<�Q���͚ q͇k) X�ʻ F�mO�:S�:l���"���q]�f��=.��6�Vkд��EH��9��S��������&k�8�p#��x��Z��K��H���lF��h�x,���,�2�;�D���;�TB�<��Y A�U#r�y�[ ��P��CK�����x�"��u��W��Z��{%��Pئ�D=��a�ch�(v��{�G9Z��?��[��t&�?)B�f���������u�/;`��E��hj�J2Zm�\�¦֪�j8/3����l���CҜb����� ��V���F<��T����A�pw$3a�#W+�0��i ���4�������~��i���&� Y�e ����`1ƕ�j��� �0&�[[��k,�q���r�k��R���u������?J����H���6eS��4'oL����Y�_��M�~n�j�ϯ����'��I�pv���I���{���� �ge��./ȷz]�/�j�~�0�w��_(�ߗ���1��֮��&�/I�9;@������U��UB@��+P)�C�!�DY=�G�X;��}gW�X�� ��K��k^r��#�~�k��AiĿ�\��Aކ�|��&_55�X�^EW]5���: %H�{CӚ�0m�f�u��'j�\z�6p8�S�3t�Y2ޑ��F<����U"�$N�E�G>���@ �z��8� ���b���QNKF�!?�$��m�\���V�����c��Mg��p�c-�b�, R��̎W��������K�+��Nj@�rIa+�JDU�����tl 6)^j�1����һ�&� �Q��AX��4��`�T�=+���E`���Pip|ߣN��n/���/��w��_%�C�@kf�Di⇱�Sb^)���:a��x��Sk�O��+��? ��n`�����j�fA�{�/�b�UwB58�,��^"�Rf偧�`��r�g����[͓ r�_[����_���+s�jޣ>�����4^x>3���h�xG8�� ��?7���ꚺ���8�R� l��^<��ɒC�/L�n��bw����:�� "*��ބ��̴�[5I��ǚ�^�~�[�m�DuՇ�-}yw&�����j���������im��|srx۷���b��H@����z`p���m����j�{wY3R�{d���\Ng�,�0b��������-�����C�W S�|s�n����ڠWx�;�� ��u�WNc���lw�|Gw4w��,�/��_!2`�� �": ��7��0���A`;��� *�����������"P��V�B���i7HHN�7�J*(�{8{��ۖ�Kf��n�)�~������bV0i��K��l:Z���ܫ�>��8t��E��V�r���,�ڶd[�p�fy$�r��j˄6�q�P�?�0���p�ہ�4Ǩ�?�nJ�ڦ��6�Ӹ��&�9�9�V%F�q"���e8$z��?3P�,耋�����A82b�cL��?��RT��h�$�q��d�/�Kv8���$�<L�����8?�5�x�i���� �~��khN�s^�;W�;Pwll�*��-�;#Ո���}vzn<��;t���0n�и"��Mj��h5����3�+���E7�^ ?��*��; ͚��rh��"�I�ͣi ���&3͗���[OU]D��CT��v���x�9v�xu���M4�PO0ёp� ���V���_�T�=1\���=�]Nv��KU�QH̕l��1�[����@;�+�5tׯz��|cG����aE��`�s�fB�=~r � 4�|�/G�:��0�mOM���yp�Nt�5vd�"&NvXn"2{�е@Ibԉ|"Js��h�??�?Vb^�q2I���0��x�߇pHJv��g+���r��b��h5�Yh�>��Y��Y�E��wRX)��3����`"x-Đ;�|�s] i����fery�9Q�;X`��8�.��X�K렚r�_����R�5�5��B��橁j�Al��]wJ�,����4"� �\��;�:�]ncF��W>D8=��?��u����Lù��U����Z=�?W.+ 6���١�������:������������D��B���媅#���d Z�������a'�h%F�I�F��_�V�52 h���ݳ$ͅr����E��Ov����I��3�?�ڎVF����"�&M�ؿ��#�=6�7� ��I�Ԥ�ЯT�#����)t����T!��+)\`��l�x�{]ʍ�z��������c�����ь�u�hB�ȭ��������q�:Z��w��=n����'���q��q��d�Cz��4yM�',�ԖȚ��Gng�v9� 3��hꍿ'g]�\L:��'��a�T�Gi��uB�jĥ<� S�0]�(�=#Ŕ�ܻ�eY8J��fXV؟@]�h}E����4r��q��gMdy�%% ��-����xX杲�L@9uVϠ�I�ٕ'j�Y�W�,��� �Yҡe����\��bMTİ�����b8�������~�����M�w�kQ��ɤs�[YۄE��(}��L�g�B��FD���w-�X����4{F#�>O���2b���F(d��އA%|B�p�P�l�1&��� 2��|��S�~r��F�kֆ)��3o�Ɍ�[L���r}�FgXO �e�Q�&���u��� 4)�>ݲ�,:�Rʜ/�֚)�b��o^�(˕�����˖� ��S�T�j'�Sy��������,�v4�ȎQӠ��N~1Q�����O�f�
Resubmissions
20/05/2024, 09:12
240520-k6gpcach32 7General
-
Target
setup查6013.ex_
-
Size
556KB
-
MD5
a765c3d97bf8f3d152e5717605d1e5f0
-
SHA1
e02a5e18b81292a41bd0fd54e06556df73d28022
-
SHA256
f35846a408f689f391e863d4aa60babebb770cf1be54603baaa2365144af9d1b
-
SHA512
cdf551c9639abf8cc07863b4d24b0721232e40731a1e0f3b74d2337f7fa39e4f4a39c2a627576337f031729c410eb966a2a2859220aafc1159a0b5c069841ba5
-
SSDEEP
12288:y8AJRvlgwO7RVPFRS8dFdJxeJSVZB86ds4YojpgYW2YCd3lf2qiyWBM:yG15nIQm6drYopg3bWVj6BM
Malware Config
Signatures
-
resource yara_rule sample upx -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource setup查6013.ex_
Files
-
setup查6013.ex_.exe windows:5 windows x64 arch:x64
1aacb940e1e344a531c545d7fc2daf6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
UPX0 Size: - Virtual size: 416KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 386KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ