W_=&y��4���+!�_V>���Cԓ3Gz����]H)��`���1KC^/ѭ����9�� R��C�3����v���_���,'�<[�jg��Z���.nv�����^�"��*J�]�M��7�z�T}��@��ˎ(�ЕJ\/(�h��`%C#LP����ڌ�O��bUгn�UW���xxX* 6u�>��K����GC�� ^����ޛ��V� ��P�kj��#_u�!H�m� *�X�K���z�}�C�����t*�8ҽ��6I��?�=t�jD,+�čX��T������A�Vl��c}��5��\re�I�d�2lP����9���}p"RMr��U�2���t&5-T�Y�^GkI��uD�(��d*��5H�?�p0��f�I:H��<�[����3p=E밇U��"��D�5'���6�����h"���%����8���J����TV�奅�̞iK���T�x3Lb���v��b��ڐPu� �Z�k$�3��e-���~��ЦE@A����[9���X*�����%���u?7o�3a��:�H�L?���2�SN|�����q�Q�Y�ָ�$$t;N��@}�b>uQW��V�n��=o�d"P��S���������k�C� v���*���b��]?�N��:���;"��C�B� �쪩�l:�O��z��>��5)�Rhb�c�f�/��*ö�O����%>Q��DPf��+m��(�k]�P��%u��m�K'p�@�^ڲ�A��jx����.��Jtt|哂]��oq�>JK�ph� M�=� ���{,Ϣ�l���M����J����]̤�2f�c�"�%<���j�hA�Ȝ�8]�UҲN>�����q���o�/L"�h5�v���H!Q[��ۑW��+37��ғ8S6<�\m<��=L��� �Kԏb�$�@V33��Yu��~���d��qҮ]�Ǭ��>Q�u<*��,S쳬��dm��$��]@ɴhe����%�A�-`��2Lp�M\Fx�ށ�ƱU��}��lE��h!����bQDO#��� �j=B�|�U��x��q;h���rw5�-إB!7v��#���(�f1r�k�ev萜2x�c5�@/V�~t�%,V���3�z�NJ�4��������6諞g,� ���� ���\��9l�f\��t%��v�~}9�DW��xB��R3k�x16�4��4�~4O��R���̴���4���\Fp�Ue����jKﬥkw]:t�'L��T�/�wO7��(T��U*��Q_��Lh0-ѭ?sA��I��2^k���dC�{ ��)0;&#Qq��sh�Ə����@q�����yxqA�'ם�p�#'k ���3��o�4��܋�����"3%����z�WK�y��sq�ܡ]n�h�`�(PkĮ�ugڔ"�Bn$G}Rb�8��l�S���Q}lj���>��?;��8�K�Y�m�!���f3��o�J���b������� ���p1�3V�����"�s���Ͱ���+��vF'왢�L��� f�_�5���W_��xi=�s��C��j�v4�GC^��Mao���/��hȤ�Z�C�p��KV��[�E�Z��ͰT�r�7��2��)<��.����V�Rx���S���������0�j�`������W�G|b;���V'�g��A�R`�@��a�{6ɸ�t��M���ʐ�Z���6dt����eu�rg��\!B��ͪ�%G�uk�g��?���Ig�~R��F$$��_ӫEQ���� %�U�7>�g�}���4��$DW��{,�#�!��&ij��Tx�[j[�FBV�u���^wS0Tq�B���a�����2?���Z����ـ��:�Y'����a�����ÉW�2����_Е����ރc�_��ڃjȭ��4�a�t��R@� � ����3�3��L�������X�+������mn���(%j$�.�J_�����-� �h�8�3���#����f[�E��O�|(0�O�����v�Z���ӧ2� Q ��K�}9fi�<d�G�����,i[�0ǔ�y��Ʃ�'ZA�I�s����!��T�մ{>gS$ʼn��\fp�g-7�G�<s��z[P�r-��~t�J�D�z��T<���R���v)i=���r�k6��0�Ր5���t��J����`� =Se�'�'�N�n���W�M��[���u��Dž���0���xX� �)`51(���䵘(�؆�YEom|V�ߠIt���p�E�dI-�3�okFaZ�̎�=�P��MJ>]��F�"�k�*0Z$��C�K�m�Y�%3���ⶴ���Sҙ}5q�B�Rp��t2\���'+��|�b�a�W;I���M<h�XK�]��z>�����_���^I�E��Lh���e�d�3�� �H.eI'����ɼǤ�D �U J�{qU]u(t��\��{� :>'y��>�%��C�mݷ�m�r^���(�X{�^��Q�����~���3��T�-�߄�L�'b�ƾl�a���GTS}*��xu��&���GJ��<�驿G��p�s��t��h�,gQ����z3ӏ�<����P�p%�)-�~��n�8c~�g��5�[]�趒����0Fs@���i}�j��O"AAOf���q�%p��W�/ـ��(��1��)�j&|�䮙�d�H��ҍ��C���)$ �@�pZ, �c�)P�bA�c�ְ�K�v�v�W�J�{! �K%#U-���Z}k����o�o|��R�L�DZ�&�Gw��ܦ��L�j�h����єVU�^Ͳ?�Ma�B��K�ˎ�r��b��~�U0�6�<"p_�����mf��>��c�� g���ʋ�5pF�0������� S3�b1+��E>%�_��76�"�B$���1�~F���2V�f������D��WE���ܼ�ŝ�CA��g'CNy l��E��iy%͋Y=5=U~b́C�=2⑿��y�n{v�rn2�1�\ݝ`Zkc�$*� ��Tyc0�a��N�DQg�k������]f�s���ý��ϟ� ��m�8����,����Jh�,������Y�z����H���k�q���p
Behavioral task
behavioral1
Sample
ObsidiumUnpacker_by_winndy.exe
Resource
win10v2004-20240508-en
General
-
Target
ObsidiumUnpacker_by_winndy.exe
-
Size
1.1MB
-
MD5
e6f56738c08e66c719ee0ba707b8d2e7
-
SHA1
ef56e679779d29c86923fe64c054ad6f06f17350
-
SHA256
6e9ceaf145ee5d7a5318a86fcadc7f68618e3ae840480134a19531120b28227a
-
SHA512
a8051399870e2e425f1637a6ece4ecbfb9f08b33080e0cb2dc49fdef66dbed58cbbed6ead2c9d9672a5436a7b44fb51328f93cc5b549bb1310db3451a91b551e
-
SSDEEP
24576:UyMmeo7G8kZK0Dg4VUu+bVXPZWz30J5cypeKt81Iw4c/m:Wzo7G8Wd/SbVhWeJ85
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ObsidiumUnpacker_by_winndy.exe
Files
-
ObsidiumUnpacker_by_winndy.exe.exe windows:4 windows x86 arch:x86
109631928df3016cc5eadd556721bfb1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnmapViewOfFile
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
comdlg32
GetOpenFileNameA
imagehlp
CheckSumMappedFile
psapi
GetMappedFileNameA
ntdll
RtlUnwind
Exports
Exports
Sections
.text Size: 124KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 728KB - Virtual size: 724KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE