?�K��C�!�=�]�����y"� T�|͆z�ϛp;n�L.8!�7�{R�TUc�?�r��<�|�bt߿��U��������gHQ�jц�@�Y����=��i���>�Z�f���E��=�ٶ)��RRUs�B5�i[��;���Л]#O�i�4�?H�Ƶ6�'�z��=��O�lF����+ꆼ������|汔�8���y{K�����u���O&"t5>�ֶ�~n&���;a����v��F�쌐�莮J�P��V���|S�� ��xD+�4LJ��f���>�18� �F��xZ�+�|k ���j1���� ��ֽ�w}�h�^���J�>V���UlN�p�=�9S ���A��(W�"�85Ij���war�����$%vX}�P�L�U�����b��AB`M��e��1[�v�LB��B����y��k��E��Rml�T?H�>��|걫������tlg��-�)����/�k�n��ʡO�Wc!�_Ћ�#��.���~������:��˜^|�``���rx���=uX +QI" ތ��9��۽��- 1s"!���������|{���8 �]�x2.����Ӓ f96s&�"}���i�1Ǫ�@nE��,�U];gR�<@81�ӧ��K ���bX6F������U[S��4��%R��GT���P����+wn��g�'�z:�V%G�48���V��WՈ�U#�j}�be�l5߷_��Q52���t����`OT��@�.�K(Jqd���Zc_u�`D�0��A9�gCf�Ԑ��{�P����^���~sm�7(���zٳ�~������G�馒Ⓙ߯y���� ������.�2b������ t �¦��a���hv��vu����V���s�j�O�R(�^�b� .yK�76i+E�{�4�_��R�܁e��3_H�Z��\/G�b:Q�1�mc���w���� �W� B���҅�pZ��\kL��i��S���!2�d�P-DV��}Vx����{�<�D_I�P�s��u���=�H���p����{���� L 0&��{�l��Fb�=%�T 6f .��Y�mH.7Pp�ܾ�b|�bd����h|� �����_ m����9 ���q�e~-�3��e~��ԩ*zo|j�J�w�/ݳ7׃sKw8� �k=/��5ʒ�x�%�&�����{�5�NJwi�Nؚ��&#g�9U��>6�,]����=�şw&�� �5�YhF�o�1벭�����]�o�[� T"8F��}�-����d�`{��BGui�=�W��;��U�<݅�����:u%7�� ��B�D^4�a�Ӂ(�#��+��Po�������5w�.��s��&��h��B��1����e���E���q���_c:��D���v2u��s��F�����jS[aw��ƃ�����?��f?�Q����疯#��_ J�0`.�Y�Π��D�XWY& :�*�w�z���EϦe<���H�6��&�M��(' ��G��sUy��HQ#QK�f?m,j�B�x��J�|�A�Y��_v��]���-���S ����������$c�ԣ/��x��^�LK��Ƥ��G�ﶡ�.���4q��%����A)gZ7��==��Q�ʘ�������2Xiq��]��?��,1"���9ԏ�PP��rC Iy��KOzm����5��ͿZ����!��9�4Toj9:������ċ�S{�%m���� "�"'�eP5��,�R���딾�nQ��O�9�G�N߾�=M���~,�V�x=�3��c�;�Q���������c@���}�ra�xG�}���Q��2����e�Z���,�Y���7}�J��B�5��{0�c�E��H���]9�,�u��%�;�$ '��@����1}E���sx�.��ٕ�h}T�j-Bm�J�Io��lJQ>����LZ�y����j�S�2� �%���`\��T��Ӟ2ܲ_xn���/�W��M�@.|=$:]S]/�|�텤�k��R�p˾�����ɼe3��%T��X�FJު�NJV�X����S�V�f��?c��s���� ��t�r�ݨ�~?���C��ȋ^�í�#���mhBc{�3P���m4?����σWt���� (���G�m�5��#_��dM {�]�M���ꝐU'��/���`]`N��6�f�p��KT;�:ה����xyAG�Ѐ��U\�aJ���d%H�O��U��zY9�J�cX�ěg�C1e�Ŋ�>���EH�m�)-1��Ւ�7�5������Ή/bN�1��}#����"6J2>m�E$��N1~�6�>��2YC<�x���TM��?c��o�42����j��t�f�`��u|f7���[i�/��z����ॶ�gE&*xp=J�3uE�<>��J��تi"�U�a���?��k�k*��0���ȁ�\x"�(�De�<�>!)e�~�o��@�#��Ky��,;���gU��) =6����(�g�Ä���qe�u�Z�g��$+q��Q^�OS8��ڰ̴C�I��>U�_瓣��MP��7ϊD������ꁩ 9%����s��.��v��{�B�b���7�SA��#Q���kԯ��MK,;��������Q�\���m�j�]2�eDb�}���1�{��X3-�~*�Y���F���������v�Q�wR��3�{!hʓ�q��)�U��4CZ��e ����Qwd���%_�,�r���P�G@?fd#�el��+@��c�w�]��Ld�7�� �z�s dh�>Wd1�`$oB �2P+o�n�o*�v�����`$�)��v����r�H`:'�������+Q�t(�/���`�U��G������$��{��o��5�P���NZ3�E��8z؏x���K�x��R�VϦ��Nyn�JH��|Z��t{\��:�[(�cᏕz�Ќ���Z�kU��F�� 3����>o��=|�dx �G-&ߐ@���fE_6�y��c_���9��~����-���4���z~�b�>n~��]������Ip�C���L.��YG�s
Static task
static1
Behavioral task
behavioral1
Sample
ProChair+Blocker.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ProChair+Blocker.exe
Resource
win10v2004-20240508-en
General
-
Target
ProChair+Blocker.exe
-
Size
5.6MB
-
MD5
30c1f0166ae11e619cbbbe2659c47bda
-
SHA1
a3b38066f58a17d3bc5bb86238daf5927694ecae
-
SHA256
a831acd3ba049f7cae58ae1fbb3cd261af5df062f3273e247b0f22c52b7ff7b4
-
SHA512
554f91a8536ed8967557ff0878c0b3b548c61292afc4bb58d0661c5e018f0257f3c2eefeaad9f52bee0c3a49d533a4f33c79c412051663cbde44337be504597f
-
SSDEEP
98304:NzGHV8jNMiVkQiSsIP5XyfYdMDa6R8tRb7C03EWgBwV2YiY55UiwBqnf1wr8:UwxVHi/fTap7C03CwQYiY55UfBqnOY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ProChair+Blocker.exe
Files
-
ProChair+Blocker.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ