��!]����M5�MB��C�u���S7Z�w�h����g�F�q�w����7��}3�%o�/s�;N�`�m�P 5z��%��-I� �s��S8��yow3���SK�A�m]�H̖K�z@�#3w�#��!��V:��W韹��s�N֨�������J�[a�c3��8v� ���; f�E�*0�&'���M�С+k%�@�%<��'�?P~�׃yC`Λ�~���"#���=�Ga!?��^�F�Xc���|�aP�b<B�ڍa��+�ƒ���d ��|��T�A�4�0��F����XK�J��dO��Z��[�V���'����&���%�.�%�e�¨p�q�h��v�H�y���"���_��.�%$��5:2:�~_p��[��B웉�Re5�!]"��ʄſ21�l �vf���ל��˿P���X+ BLP��P����V0P���0J0]�1ӕ6�ޞՍ�2Ϥo����3<}�\�ܮ|'�'VZ�ԙ�i_.[0�~�����ɝ�#�y�s����"A;��[!��_�3�d4|K�oiyU^��5*��m��RNt�N`�gd��̜����O'�R3��3I��E���]�T�3�%��9H���H$ȉW�ށ�����eGI�- ?$��z �}���$�3}�«Y0����ߢ#�T�Lc��v��~K�LH�H�2� �K���,����Bݎ���ɍ��8�<�����ZdцۂP4���9��>�{��?��1��E�ӷ�U����-x�7y�*3�����x �@��XتY��N R���(ףQs47�;�Eunu�}�a[[�t�cl�8�~��Lj�-Z���ӕ�� <��9�v�┷�<��=����Q�vI�j7KB���j���b�M� ��fF��Cʛ��6cC��I4�V�琑�3�i$ϻ ��v���l�8_��)7Xs�� G�!�ڲ9�F0O�i=�)>�҃��Z�W0>� �e9Y�bb�,UҺ>��cj����g��n���|w���ҧ�"��v��`���p^"p.l���uz9hP�o�QI~�8���O{M9�>2e�*֕�$���M0���6�����d<�YjŪ�����?~~����@p�p�/�Ws��5'��l�͞:��^M�����YH�@A_�D�* }{��fj�l�q�FF�D�Mv['2y`Oּr8�Ѝ'G�n��<�G^�⣚_�x�AG?���_�|��q�1� ��m64��:��L�gn + W9�D�q�Q��sL����Ϲ y���$V}yRkFB끕�85�%�������9� �J��ڂ��,u�^�-ʸ�..���!�ʟy�EU����{i' e�#�S:@ܑѾS"��6�f�_V�~���cΎ�0i.?�V���a�P3�i�����UI}ܖ��CFA���=hY�\�/���Td�,=H�b���w'�Q=Ԃ6ʒ6�xH;OKk�?���tw ��C�Jm-�M� �d� xzJ��72�T$�}�-����mM��4�L�Ϩ���mQ����*��¶�74 ����c�(u���]1Yؐ���H֕��t������O�o��CO�������� �t��b�Sn�Q���,������K�3XG��*Dv��b�D�����r@���Kh}����J��*��,��zey�5��hɪ�o�������>f9��V\j4*����]�eK���r鮨�cه*��G$�y��qӒ�����.!9_"�����)�o��\�Ql �6����b���,Rl�������%o�`���� K�"5���2��N��2�0"�;X�a�J<e�t�5AFJ%+3~�����e.\4�Td�֊ջ �����T����\u]�xIR`�@,�����=ۖ_l�P�>c��I&��2�Gt�(U�h�Oޚ%�� EMqT�dse!5t�6/,4?�8�ב�p։�t��1����b �;���k3n?ZU�$��D����_ ��j� �T�X֙`�=O+7��ӳ��zu{��A$��;��>�;~�Z�=GKnpy~bI׳y�5��?���7_\.!�~���C�\̏)��eR�_hq_�p�R����^p�=�J���(i� �U7?U��s\vkI��S[ �v/e��#~o�K5)Jq[K���^{oV6 �ܥ���Q�_H�i �f.�BU���~]�*tv_�w1YC����Cn�F����8Zel-I��Ъ�H)ȉb]�=���Pu�#MBI��>�/8��VJ�alL;O��u�o]ȓ[�$L����v����nXp�L��5�g�$�Y=f�g����Kr� e�,��h�o���_��AF��X��R�Ƴ扪.����e���[^e��)��gM��i��w�F��K�(*� ��|v�e���|`�*RS>`��0=SI-�ִI����� }��Ʈ=ƕ���ې��hs�k�W����#��>r��re�&*���T�����;A�lB|b��K��C&c:��-���88�y�j*Z���˚��5�a�LIɐ��r�-��͛T 8hq��RE��Z� �e���zw ѻ��Y?��LOpK{��wsj����֗�^����<j����+�Ti�8k"���Q����v�mG��~�3 �)�5R9&���c��Xx�n|�٥�8W�B�wǔ e��Yi����P�^���SP������)�U�0ȭ����j�E_�/����nza�IC��H���;-���l Ӭj��ً`w(HU'K�ET�rYڝ����dgاg�M�ЬT�@��:DS���Y�n��������w^�n��I��(���+펣P�A��{e�֕)���f7@��V��ۉ���%By�"Y�&�G\\|�;�Qf��rq:sEv�� y�V��L�ea?�V������_iG�QB�R��m{ �n������[O���l����B"e[I��ر�ؽ�-����F�I&Oz�5��TZ�� 7���d��"��@B�]Es�p;�l����;�%z_F1U���mt��4jH��hL�2�j�DU��������m��e������"�$�yO�!&S�D�:�J�Ҵ�n`����}
Static task
static1
Behavioral task
behavioral1
Sample
vzlomjopi2.exe
Resource
win10v2004-20240508-en
General
-
Target
vzlomjopi2.exe
-
Size
4.9MB
-
MD5
811a06fac35a81cee6debb42b49f7782
-
SHA1
d2353943dc9b631281e8f2aee1956e4f135d6b7c
-
SHA256
913bd8c0a7909b5ae916a9f34e6a22e878de2df810f18e4cc26e1fb92a9a526e
-
SHA512
e5fc95b9fc6aed85eda830063f61d6c882fcecf3f59bdf75d691a210335d2a341a8a9011a7119c220a3a03eae9006ab10f807b50667134c189dc2162ebd06007
-
SSDEEP
98304:2CF7loPpCNNwzAkwPjeEo1K+Rr1ZR2U87PVoqqsySCnyShxv:2CJ+xaa0rer1K+Rr1ZR2UgVoqqbbht
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vzlomjopi2.exe
Files
-
vzlomjopi2.exe.exe windows:6 windows x86 arch:x86
4b15391cf23aecb234634dd3cc19c6b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ