~Φ�P�/�7�ç���Ղ�����z#d��h���-F�Ɲ@�!k�C!�_>&�Ff����uBQ���V����w`����� ���@�˟�H.K�ȏ#��{n�o�o9��zԘ?�2�О�� �9�3��Dv��Nd��r�e5�!'N#��j�&X�W� �6K6h���@���7n� ��q$�#\ܝ���u?Jj��vu�U�t//�kD>3r7#����NO��#1���j;��H�s�uS�2�_^c��:��U���F���*ԡp���$��b@�L]�k��^���wݛI(A֥� �pc&̀Z��9�D[��nx"�ؘ�rAL��^-G ��)���Z����`Ao����KԱt�&~qY���K`;f�.���O����jޞa=*���dzRMx��G��8c�(�~�>��c/�x���V2ب_�"n��+u[���d��&� z�t�,����q��N%�|�\X)U9I�*�����kz"�q�?i{~:&���_��<q1��q��@���� ~ZĮ�w����慤VW���忻��F_��3k����JO�����~�Lj���H����z�J0������>��t �V�w��"�հdᘫΔ-��u��>���9<�-���&����2�Q�~Y��m�?E���cg|+͋�[R��Jrt�ط�!.Ya�ns(��_��<چ���<��)������H0ڙ����|���Q3t9ߓ&��V!�>����a6U,RLG^��us��}�U)`y, ��4N�/7 1��U��h�:���D�`9�ӡO?�;hGO��k��@;��o8���8�M�l�穥`�Ө< �>�&�b�]:�3��m����v�P3 ���<Evyk�Xُ�d?���:����5T�ޕQ-#�{����m��!�^�fI%�.�Fd��x((Y����MmS���s����ٔ�37�`q�"(!�����ڴ��i��8f���q�M�J}�S�Jj��w6�@V���'�eUS��n��C����`{ ��Ud+���Td\6ҏ�μ����+k�����M�fZK� |�lq.o���Y;��z~.8�X����G����^,ii�>~�f*�?|��2��3 t�@�u��K��B��1$���hr)#Z!=%?"�����g���2ɗ�Zms�J����w�D�����vÄ3�����z���L��V�o~�:f���P�^)����������TZ���φܗ��.��̢P��8<�;�/?�m�z�»R<�m����c�]��B/�V�Xvr��yF�Z^TT ��'������V:���B��@����o���_`�*��XVپG4s�}o�kUă�V�+�m 4,;�� S![��+(�u�Jƺ_��!yWY�r��A��/�I��j����6D���|��3��o>�u@�����5�9$ׄͷŧW��'����oE8hFݿt�-�l�̗�z~��T�o4���J�s�%`@��VuI�a5�<Pc���Њ4�oX�-���o���N�}C�,m�F�q3�$�O>����e�H���O]���Г � �́�p��-�у�"� �6v[wJ��:��L��jـ�ǵ ����m�@�^����� P!��y��������a�K��"B������p�������aBD.?{�Gu���r�������c� ����d�o�S[C�!}`�A*����٥e���ϻzab@��1��/��V��Jj�F��D>���.!ŧ~x[")P��]���U'"5��T��#|�?�w݈u�J��]Z8���Ò6�$�/8�jhiJK+��XN�'��^}����w��VJ�tg���I)yg,�(�~l���*r,q#4ΐZP,r"��j[є}�;�ҏ�p4\�V��Ȗ�~�)�ic��c�a�K�|7��X�CU�4�0�:=�]�.�w��rN������t���h�8�����K�����||@�rr\�v���q��t�_�]���Zy��S��G�Ў�7��m�yO�(���=-�/�rC���kar[�����5vɃv�g��w ��l��P l���ys�;�t��;�fĝ ��ץ���WMR��1�c �J�sƴ�x#�""&3 9�����h��͋A'��h�T�~v���5��WH+*�?��s �����;�(�z$u�[���>]�B)�ﲭI�������o�JѶ�?����D���]�,� �x7�?҈�u��ة��V�Ab�������SH�g\���a��(P�uo<^Yz��p�cs����}�5�YGz^�b��_�v���w�*dA�@À�쀹N9y�d�T�"���L�C���0��$���ew�p���{����$3'���~��3���f���f���殇*�5�a Dׂw����{a�ķw��m�|�6�4�&k�#��xz���ٻ9��5�5�(��p��<�4���x�:s��ÍU�.n�~���,�)�l�W�q�����\�f��>���$#݈%�,�"i5�b?zPW?Γ��@��Ő��Y�͖�ckN�_$.L��v���߿� B�"�[�=ߛ]a�5�~�'0`���A?� ���6�i�U鑶P�e�&Hu>*���+Ċ#��A��[M��]u'��i��T p��������w�*�Ͳ��' ��W�F�s����� ��2Π��D������4)#R�ΰW��D����T��h�ڙ�S��Q�+����`$9�لQF���Dl����g����b�� ���r�d� �@�o8�f��9���r2�.���3HܴnAGj����1�*1��.�&�&{@���us�����MEQ�����O%�>�07�0��@H.�X���r?nR�teΫ���\&ï<}2�מ�D{��u�Ze$� >R��ϴخi8���_L��6�hQIM�k��UF��zs��C�ZA_�w*AcݶO[�5n���5����8 ��M��� �M��G��AW%�~�R�!�OS����67� 4�(W&53�� 3���������s���� ����x-Ԍ���Fi��XQ
Resubmissions
22-05-2024 19:51
240522-ykz6fsed27 7Behavioral task
behavioral1
Sample
Win.exe
Resource
win10v2004-20240426-en
General
-
Target
Win.exe
-
Size
5.5MB
-
MD5
e1903d873efcb36658a21ae625822474
-
SHA1
dcac6763e7f1bcb7150def4203301afb66109864
-
SHA256
aec7db86a1812ea6153fca1bc43bf51fab9f85f04fb986e17bd3b1e86a10b8dd
-
SHA512
79330127dbfbde554b7120dfba4ef5cd85253d29fd62a674a1ed65cc96ca2236e5c564bc8e2cc59ce1f7df049e63e1ef768a29194351150a0102e77a09940e8e
-
SSDEEP
98304:9v7GhqKOcpJ+kZ2EgXwrboOiBxtgog30nGfYLkY3bOnSIWiFZ2HSTxs:9v7GhldpJ+kG4fiTtVHGfUbOnTWivZ
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Win.exe
Files
-
Win.exe.exe windows:6 windows x64 arch:x64
1b29978613c0c06e3e4ee05bb3b2c857
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetForegroundWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
shell32
ShellExecuteA
ole32
CoInitializeEx
oleaut32
SysAllocString
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
xinput1_4
ord2
imm32
ImmSetCompositionWindow
d3d9
Direct3DCreate9
normaliz
IdnToAscii
ws2_32
gethostname
wldap32
ord35
crypt32
CertFreeCertificateChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
_getcwd
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-filesystem-l1-1-0
_access
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 656KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ