�k ���od)?���i����s ��n���or���4$��������s��r�nue��㉥��)ݏ$�0��|�/�(AO�C�1�,�UF��%`�V�Tpm��A�w!�rO�Xt>n�n(ѥ��<5NJFg�L� e�DYԩ�|H!����H��Nr4����E�w�����9��i�R��^����jcpޥ�E�&�.�@2E{Y�A S=Q�R�03�zʬ�;B(�3����vz��b'���"1��� � ��I���[�b��;���q��O��&2�*ƝUE����B�����e_A8��q��C&����%��.z$wC'/'B���WX4$(:��I��1��`��y���GD�u�ܵ�So�B�Tl@�m��{�X}!���i'7��` ���$oH�n����#��ϺO������E%I�[�Q3�S����H��}q� h�{ �<D@<v{˖D�tL�{)J��8^��k8�ۥ�V�p�:m�:�qNv&�V���*m��8��ٷ���F��Q���g)ʠ�t�e^��0� �WBv1�؋JI���ݲ��>L�i���D��bS����O{0��|Պ��;��kw��l�K�Iqo=���fu���l�n�D�J�ꬿ���T���a�~&�|��l�vJ ]�z��g?-�(��[�Ծ�������#�^Mj����r�ۣ��K#^�}�>�ڶ�>uv�Y�� ��6}�ŗL.�P동Nj �G��HUc��д�dD�1�d<��DV��B�����x��z�1��]�+�#�y���ܓ�C����V����������UR��f�xf��}0fb Y�����if�3j�"�ܼ�����b=�b���~�c����f#���t9Qj��VF/> ڜ�~-qZZ��צ$�N�ͥ�7ж�fՖF%�U���_u�f����.���>�B�-g۰:9����=D�����#"�����YaTĪ���p�=��e�e�lY�֫��Eg�Հ�q�*������rGT��H���HI��L�K��T� ��۷W�4&���N�6L��0�Q���<܉|�����xV�:�01�<�3]@����0���>&WrQW�r�.S��sl $3<F�����/Y��i@��;��o�t��ny5 .���`��4!٪��n��|���֮U��3�/��O���nj� KWk1[[5R�#��MQ8dC��iI! �B/���t��Q6f���E�����3�H|h����9<��\A!� ���w��O�C�,��(�,uI8���IG��w;.�G�L���p@�]|"���4 ������V�� Ek��(% B�[�玶��d}堣�`�)���آ�9�}�����7��\w7��I����5AWg�ğOPfK�%.�4���m 'p������X~�F0����Tt+�b��/�ˮ{��/��C�:�?Ox�����b�"ē��-�t�U��.�2�!Wuܔ��qo�@�^dwF�<�&��l!J�S+��B�!�S�� �@JH�}�w������}@a" H�� ����8������*v���2Ơ�5�������K��1Wy.[s+���7iVp����.|�rQ�jI�d�"�V'1R�m F���y� UB�msg���C���&Hb��mʩ�I܀"]B2�؈���'��cj��ݭ��V[��[$&�d��=qJ��8#�<,)0�5u�"f}l��4sL[�Y�����Ѫ���э��q��j��m&q� ��r[���_I%lɓ��Z>��p1�x�fmO�~�B?f��]��(�㨴p�æ���>��x?�M �m���h����UG��ŷ�z/����E�_�Sop�� ړ�?u"|��v���z�p5%Pn?e�)�NT $����?�����2��+g���U�Z�^�≪|��00g�p�/�W��A��`m��n7������Ѓ;����Cؼ[�O�ӼGo3��wz#�.!�x����|���S��{�3�ۥ�V4��P���>Y�1,�THR�-߱i�,���$����,6,� :��K]Ӓ*rbvX��I�;=�IϛudE9�"�G����MB�D\�!�(Oz�RQc��*�-P� �%�Bh��Mff}F��{�SM��Q3�pI>�<vL1�1��{|�]r:�q`BVَr¡��qѮ��+��1��ț�d[{�($���<���_,nu��M?���I�b��ѭho�Ï=�i��x���V4�ƺ��%�� u4l���M|��x(�1fچ����8K�VWj���-�4Q=C^%_�hX@���Å����R��|���Ģ��-~D�����[�55r`P� �����@ ��1�a/�;Wd��%)�~� �)���/<�[���@S$(�F�]�%-��Լ�.�����*_^-���+V�tXrVL��I�a��^�:�B��$�/����(�g*��]�����yUm��A������C�⨞���s���Q�ǏXYk���+��翥u`@sy���#K)Vܷg;ނ�kOo �L[�+����������+��wO��'��K�}��~�-Dz�$_JMڄ!!� +f}��y b���N��Շ�}7���X����'��8I��NaaE����n,w&r}���n�Y�;ӷ(M�;h�Ѕ���\���2�tL&�4p�m�/8&��0�����EA^���*�Z8�s��-b������}u�,�O,����!�q\Xs�(��~�3?��'�M 3_�Ϗ�*�s}!#k�o ��� ����^� 3��"��Tl��ۭO3�W��FU��¶t���cD��6�b\60�@mޑ���8��rg�K[��eBt<���r�Rԯ�1�\) )+#%�[w�kLe�q3���I2̆�߅)���$�.K�n:�g�[?�>6c�?�=z�+[͖�$����ǝC/�YY�9���[ګ��` ��:xeʊޥ���_7;�ѕ�2�8P�M�˝�N�(#�e���Ljk��+��Rq�����՞��.A�9��A��Xw ��wB�D\ "��A���fx_�y�UxL kkYy{
Behavioral task
behavioral1
Sample
WIKUETPAFB.exe
Resource
win11-20240419-en
General
-
Target
WIKUETPAFB.exe
-
Size
6.1MB
-
MD5
eee7d37f8521f5eeec89cb5c5aa5bfb3
-
SHA1
ca3fd92393f0bd7b837ca4188a1bb778df5e954b
-
SHA256
1615b7fca8997361a44c5dd1e202a3d1c6efc3d0f60a8abe56129bf1d1a8fcc1
-
SHA512
8354c0cafe27d3c0d3d6cab52596d33c1dc964b0132040b81c83f65de042a88dc5f51429a41afd10ed463304fa3130bfb38a622891fb5ebb751526e67a253384
-
SSDEEP
196608:sxNGuFLyfb/LOEWzHuMsXnJKIF7A+Mn47P:sPGCyjGzHuTYp/47P
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WIKUETPAFB.exe
Files
-
WIKUETPAFB.exe.exe windows:6 windows x64 arch:x64
3346e2dd454410a9e6dfc0adb5f75a16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
closesocket
advapi32
ConvertSidToStringSidA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ntdll
RtlCaptureContext
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 532KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ