�X��ۻ�g!R����{b<m��L=��?��D����·�-��#wu�ۦ��}����#M�����ijRcp������LOp$���M���������[c��4q��0�U�9R��m������ oȵ/�����ć�bK�U���1���3eF���z �)/�5a�x���YC�,���#�|Xods��/p������q�OB�&Ug� %��^�Yu8u���t�~:ۗ�6Em�N�j[���%Ǵ*�U��)�G�`M�}p��om���Xb��f��L��'�ы�b��N&�2q�Eh�!�)&��(*�g�!V��x��yZr�I�ѹt� \���m��WmN�Bj�����8Mf�J3�H���9CGa���H��W�^:O0��P^"����|�L̲�+0����p�?a�mAZ�\�[ ;P@p �0)m��QC&��b�ƀ�w�0_|QzH ���\��C�t������������Q�������;�����1��=��֎����9j9��u�����#L�����$E�4Lt�I��U2����6@�n�P�H�5���*ߏ*F,A8���ؖ�� �[E�Np�X�.j�����T��q�`��66UPy���ې}*ذ#�5�'2������R��"D ����=x���_͗��l$�pzH��;VM��6�P�dđ�(��`�*�!���d��3�_ni�W�i�)bv���+5�1�D1�����e��C�Q���/4�{Zo�^��^J�e�pf=0T��� �Yl����og����DZ]��_��e0��>�qȌ2����ռ-#j��rrf�&_֡*��܍���F����2I+j?��C�4��H���J����`N�%�|Z���tk|i���"O���4TEqWiC��uV�!t�՝$F[�1Qc{T�ߓ��'X�%�zA�B�g��#^��@ZK���0����Jq:X@�x.C�E���k8`��3��c�7sJ��T��E<�QKs��5O�'WL��tyF��o_�;u�Z4�m��.٧���C���7�!xo����6� ����{EK3�@=�bB1�T�:���� ��Oo%���[o �7��|=�vBE�\�y: g���,5���^k+�������� mC4���X�eh��y��D�Jr��34���� ���9���7��=.��q�Nj�7�g��+f��rF��P����J��#�(�S�vM��J�/{��\E���`9�*�?�%����\�^�Kv�"!]\൘�z�|��т��QS<{}n��������"x�-������S��s��q���|��w��h���۲ڙ>@��S-���C���!�$24�;,�]x�,e4 |����FLD ��P!3n�l#"}ݩ�P�J����HOd4�pz܆�����q�婺���r6|&N��4�.��o@ϧ�q����T�?�k"T�v�Sm��b'��̪��a�/���)hh0�P��+����҄����BW�uɗ��@�mG�/���}͆ھ�O���`��ou�J���ND�!�V��Xr����z�AL-�OW"���.���� N��T�k��[Osm��p#;���v���qFfV���������������w)��Z OP�r������U2W4e%�7t�ObZ�m��[���ƚ�%dEN����=$����� �#�9UՏ6�ͯ�� r0��˽_����Z\=ظ���%iI��Z�k#���AǼ<uh�!�f>�^@Z8Ô>�s�o��I���Ш=�a�8�8uy�����먘Mm��f{�3�S�R�r�p�{c��l�T�a�A�I.���f0ip�ȯ�Xb���K��#�L_:����y�ͼ&�A�;|i���<�J��b��M���h����c+?�9���Q6�N���4�Uu,�1�Ϙ���tf� �WK���t�`,�quȜ���.w���)4=��� ��k���Fh�ԋoe���-��#�M:�ߦ���6��f�6��"��%�F.5�s�=�l!t� Q��XU���}��p��Y.:t��NU��dh|I�Lʹo�r�r����Վ+����&��eGU ������/���a�m"��� �]C�/�4�@?� ��Zi?g��b���_]�������C^yzﴙMR>����D,n�S�+G�a����c8 \e��&���w��J��-#Hr^gA�N��Hm�̛��H�HP����Q-����oJv��6�m�M��(��F{���0d����e����[�H��h���`{��N�����D�% �(i�?^w��%i:0Ʋ��œF2"�D�p�ά�R#�� 1~��I��=d�eFw��hLG2��;�ϟ`tŬ2�LSR^[v�e�.a���L�� �v>gQ��!�o�Çİ��~���fs�F<\�_"AO9~R �\pр�}se�<ER�Ǭ��K��I?���t�e��u ��kB]z;[��-�� |��a����w"��F���o;�=�\��?���1�O"��@��ɂ�րf��rP��9��L�����l)0~���D�g��KO4����6o�X��Z�h'2 [��ڕ�+k���y�l6������mx;�̈E�>����u�Èj��T�i��W�O c�Tt�F�%����' sֶ݆M��m����44�WTq�y^+��H��H"���X�O�p��6��}�^�= �E#n�z����g�7y��J�\�H�j�O�$����ϋ-�����*�.��\5E��ޙ��$�C��M�7|J��$3��v�6\�e�7L:r�q�+��G��s�:H �3�n����|�At)$�/)����r��m�);U�S�Q����}�����2\9���Kb��p��/�k��K�6�,*#.R���p٩(y�Y�S�z��ꩀ���/��:�n#ȓ�h�O �ۊ]m�����ۻBfAW�Dr^� $��@.ỰwXV��Ԡ��Վ��A�1!9^w^b������\fd�ibK��kÕ/�A�Ӕ�<��Ě �{��m(�I�0��n��ļ�1#���#
Resubmissions
02-06-2024 21:08
240602-zzb8lsgb86 7Behavioral task
behavioral1
Sample
eulen_xd.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
eulen_xd.exe
Resource
win10v2004-20240426-en
General
-
Target
eulen_xd.exe
-
Size
9.4MB
-
MD5
3e0626776b371dd6a66c3b4578e78163
-
SHA1
b0aed638b9fbf390264d83b96e4e9541a590d71b
-
SHA256
1eb354f77b02b77742214adb31c9ff750bf354d2b550f1abab87321b822c480c
-
SHA512
032f19b2c20c52dfb0ba1858a7bd9ccf0c24b2f2fd103e6bc9185275920ccaf4e3d9e2ee08fa50540c9dd1f2dc4266c90527d9ff3c5b1de2c2c1b434e03de45f
-
SSDEEP
196608:YuDyC/FH1Vh4aEE5sek6+eFqITshwPIP1hsd4cQDBUBE6sqw:BNFHIE5sekyfghl9hsd43K+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eulen_xd.exe
Files
-
eulen_xd.exe.exe windows:6 windows x64 arch:x64
e654762e74c2c21fe2804e58dd762426
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GetQueuedCompletionStatus
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
shell32
SHGetFolderPathA
d3dx11_43
D3DX11CreateShaderResourceViewFromFileW
imm32
ImmSetCompositionWindow
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
getsockopt
iphlpapi
GetAdaptersInfo
wininet
InternetOpenUrlA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
remove
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 623KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 863KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.4MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ