p���h`��6v�m��^c� �tJ�(b�>��j,]QBF20���G��JTt%@��m�b�&�&��p���JD��&�x@;%��V��ͪ;�)��s�z|�{�a�7fi���@�����|�w�3�@ �l'㻘+X�̓��j�'T7#d���`��8�3�i�������� ?�ш�S�vFڅ�䪻�s�CI��&��[6����H�+o��2BK�����i�HP�Q��%ڼ��\h������ѹ��'��f�kH3�-��@|��W�T5`OyN���J�� rJ�+,��e\��`���y��n��;��/�%���F�Q���G��f��^���y���F��A1�L��"g��x*�����w���:5LM��@u;�3&-���ሺԂ�v�<���~-Ϥ� �s�e�q*��8�pJ����ҽ��-��da��� �=�����UN��g�fA�HIr�������6�y�8��DNi�h#@�� >��9�T?��l��ʣ���յ2P��T\���#�m ��@�HPK�7�����PǀG�1g��۪:%+�@sx���Ir�C����b���ډ|�]��,��Z��<��x��Xi�����r#��6�!����N���ٰ�V��T��K����r��� �%ֹ� ���9hXd�j�+�D��=����D��������xv�Y�F/}1��e뫍��Y��N�G�x!�W��Í6�N^zȘ��z�5����ɳ��Uf%�@���#��yL� �5��2><y�t� L�m\��އ�c��X���ߋ��8�5���M���$��&�5���)+(�cI�X��vĊ� <�3�lK���N���,�v�v��䇟KBV��g�ԑN�/���0rFR;fa�\o�,��f*����٣^�Ӈ/��U ��C�1M=D:L&��Y�-?_��P��@�n ٦ՄD��`,�����ר�1�F�S�����Oϰܒ\�{p�n��wQG�aߚ_&����l�9@�3��֣Y ���瞓�B�$g�yr�pu\*K�����"���R���A�#���Zy���'��02���ͲT %�fq9��ɠ?�W6e����˘S'c���\��Î�PhY���䲃-7Ŕ�,�}�9���L�_��I*�1���ƒ�ta��LwfY������3�`�J����Ɗ���ĥ�r��3��_����|��M=�4��Fu�а��̼�T��G��0�ȍbJ�H�z���&a8]q>J�Ȅc6���y����bJ���v�������rb������[a �r˄d ��7�0�R��O��Ŋu�&}�q�Pr�5%<�l`�% �u��7�N��w�j��~Ă��'��SPX��W���zsT7���w2;�Ÿ�n�Fʳ�_m�3*�K���w|����ِs[��[��6���jr��g����^�n��9���eM�xR̵)��+�<kE �1w�rT: �٪����ӯx����Bt�b D��C��U����ɍ�muXP��V�Jʴ�{���?.�j�;ک0�>9U���?|h��C�wsgã�䗦_�w�rD����^��~yY��45Pv�>�t@b��24���q���>�g1-�(���5��o�#���.�C@�{�ޱ<"����� �|�b�i3�e� &^c�I]z= c4�w��������Z}�.�����F���y �" ���v�3����k�/��6��ژ�>�����k��X�=�Up�$l�viA�KD�D�!�,;�U�`ZE;B��b� <^�g�lb�:��=��u�� �@^�� ����)' �Z~��?̂*T��"�Z(tg�:`�~z�=z��jf\��8�3�����p�K�{!�ݼ1�&E�`"�W���d��-��+?�8�����c�;���Z��Cy9����P��#��O���k�^eC�xV4;��}.�e행4��jC�on�3���~N|�~]��DI�����f^rJ���0D?��Cml���'��V��y+bf�ǙjtR�L��r�Q�,�w�8ٝ3Q���m�#��N׆Sl8w|u[�K#c_��&=Ħ4I@d��D�(&y�n,�S�y �i��x;;qd>��;��&�&�L��BU�/���z��?;�"�*��v]�JDV;M�/X� �u%0����(0/��P�>�Zfy�@�LT\�B�z��c&s30q��5�s����Zw�_�mX�$.A%됕����M�^3,X�,� +*�nR�>J�t�@��7<u.:2S�8�{��w�|=�ȗ�;�4٠W|��v���}JT�O��=J���$��*�C_�� �8�Q<ѳh-k[��g[�'���}��)�c�ז4)���`��;����t��#>����!���O�J��R�q~")�N�B΄�F͆8�J�{����q�H۷ƺK�fpf'���F�M��Ƨ۵~)�-�&�+U�=���[��u�����f�y��f��l�Νs��⠻I��s��l>�V���vP�7��8�#T�A�5`v;X�vm��~�㺮sI 䨢D���掫��sD �����&e�ΰ5��1�Bi���p27�Gȣ�%^��d�j�B��R��8��/(�:��ʣ@�B��2pO�S�I*~ͪ�=F �\�l��'��3�a�vHp�H�+��nW>�������y�ř� 4�p�4!t��B�(���w\@�40�4���[����� �L.�p�@-g�"y����D�����Z�L���1��dژZÅ��U&]|�.k��N;�Y�d�E="l��V���W��W������eXW��gƹ�*��b����|ˈt��r���O��h�o#�� A�k���ȝv�Z��$Y;�T%Һ�] ��/X���J]o-*��w�(_�/Ʃ߿=��@����%g2:�lN�X��X�������Z��_���f����7�*p쑨��o|:��`�y1������9EKݟW6ױ�N���縸��*Hr�3e�����ߵ�΄c�F�����;$3�M�*w*!2��x�䢨�F̢x�e�� dB������f���,5�����U��ɴz%%5��W�
Behavioral task
behavioral1
Sample
Enigma.exe
Resource
win7-20231129-en
General
-
Target
Enigma.exe.vir
-
Size
328KB
-
MD5
ec659a83d15ed51625b43278e8c30df1
-
SHA1
a9a820b04324dd0dc7baf6c549af34ca7fd9da7c
-
SHA256
16039c16cb2958cd2071ea5639ea181313e8b74a3a1cecd6596af1966ee07d15
-
SHA512
cac077c7268ff6464ac92184ec3301c4335378bb705f7d68ec824d185204e2efcd5d0db45c0e9b93f096efe70728f3e440229d344ca334fbf0b99b6f4635bbb4
-
SSDEEP
6144:62QMvu61ReJVR8sJKjP8iPaRE1kyNPnuIxc54Irf6Ng3YPArRUTRzuQDv7mb0c:6qmegjMrJ1kNIC54JNg3Y7TtvDDmb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Enigma.exe.vir
Files
-
Enigma.exe.vir.exe windows:6 windows x86 arch:x86
ed356e2921d18ae43983d1a363be31be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleMode
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WaitForInputIdle
Exports
Exports
Sections
.text Size: - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 325KB - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ