ǫON�m�b��Vk"�Ree"��������F�2'�܇�L�HÚbcN���������*��'����GFG��Y4'忡X�d-n��!9(m���ˉ��l#�l-}l#�P���1�g ������hJ��� J��b���Fl��-n��ЎI�b������h���5�vQy��<����M�YB�<���;8��?��=Ι��4�� �\�ڦ���fp�A�-���]�_p��W�'��n9l�̀z�}"P�]�f���F_�m��������x%����K`\�����i'W��B�- ��\�y����0�J��0�n\�B��ٶ� ��q=��4��ɨ��\��X�э{a�=hs�@�j+��V�O�MFu�q#�1�a���M�o� #n����#�����8@��7a�D�6h��ƶ�ڭx˹���H�Z��]�;�o��)�bx�3��vi'�����G~,�#�ã!3�/�>�ٮ���9�l�+�`J2�iN���/�o�IJ��6��L¬�����0g8Q̂���qH ��vc מې:�n�ƪ3i⿰�ɪ�v@�x�^�U��=g�/s�ݏ���<vATh�28Oֲo�=8��I)��F%"r�~�32����p5����%����m��N�����?0��[���RGGPy���К�f��e �(<���~G"aXN$��w�f�`4&{ٱpOI!�R��f�`��b�e��U�/)��m�pʋ��@1�Fn;L� ��l]�J��ٯy1�:�r����ؕLP���(g�����ڹ������)�`�7�#>�0e@y~�%N&ٜ��D?�鎃GX�A�b�7#���'Ԗ7�*��h~H�Skxui��ӕ# �MJ���Q�W<E�}ZS�b=(d�RETE�`[�b��aQ;���O ��r,bg�x"款O��>b�]c�����E^���%����N���S�}�Ը�V �����:��)�WVA.�F�F���m�Rs{j�QT,q�l�D&[L+����R=��v�%��7G��#�[%V��g��~�z�l��=��4X�"���D4Ѕ����Hk�819�;�$lL���{� ~��3����!LꜼ���)k唸�OBDɆa���ǀ�uF�G�'��]��"bxIi7C}Ó�Ai#H+�4�_�E+�4j�s�]N����4��!>�tx�/�,wݶ����o�8T`���H�C5|�GEC� �6�����IʘrD���q w��)c�2ǃ�?��{���"�����E��ݕt �R�v��\��M�뇟�A:5�46z�%&H�^^�����.ݳ�g7��2����5ALa�g��@\ݷ���vz}dC��ܔ�D���O��4�h�hT���w�L�8� ���]�fh�nY����� ���i�+�"|f��f��1!�>G=:�gu��!�h%� �*�p��`���]��5��2��ݫjB�F����e�}u��<WÒ9Z} ó�s�r�u�� ���dk��a� �c��>��=�߸�_- ��f_�J�{��Ƹ��c��;�_��+W�;�ۚ�4x���(����9T�ȋ��ָ'U;�ԓ`����q����,S/�C�3kr�t�g��k�)�Wnx^Ŝ5r«_HC��b���轵��ދ4C�U������������4���Q����@�N�!<5Q�7� ��ᅗ�=�8R,�-� F� )�"��`���jy�����R (ίf���9o<HQ�f}�d��=OGnE����^�����KC�E�㔫JXe�h�sҕ?�Fj��m;�$�g�{p�<,�=_/��ʳ�=3�t�� ��y#�}JW��ː��aRy��P��C������>��V�Ǜ�� �ۦ��{����+�V�/wSE��^�=�p iX�q(\ߺr®GS��I� �� 4Sx[^��/D��HRK�rx[�~�H�mYi�W� �*�(������t0 z~��>\ʅb���ߦ��!az8�o��0����*��jQ�m��ϭb�DI|�V� #��Aʇ)�dU֩]��G��Z������kB`]���J�J�SE@#,���i��iA�D��ƍ�"� LŤ�Q~�P)'��h}`�����:�QU�H*���),�����q�D* ����|����W��H �%1��lfƿ?�u�B�P�G�(��,i[ڐ&��L/P�����bF���ѭ��$�|�w?������|���{�t�O_�с표�2��81��I�������ߎ ���$u7�*#�.ᖋ/>R ����)��,�Ͽ�65�'��R�oY=!"م72�R���x�nd.�s�[�����v����o�3TG�N�;��Cp E���e8��7s��+��T#�|)��@��<�f*�P��u��w�m};�^ d�з�&�.���y8�f�w�������O����7�#k�I������������ b!��}N.ZamV�;��͙= ��?������tA��'��]ƥ�� ��;��̂�L����B&2����P��%K�����+�L��#5�d�Q�^]�Q� �{! ��* ���h����C}˴f�O�y0���M"��A<߬�퇎(��&a������?����*�{������S�ҏYZ�P鰂V���R���?.����Gn���[�qt����K7F��0@A��~א`�r�.N��\O�7j�y�.���������D���������|�>��=É�7�-�F���M��I�X��[���hfoʠ�=��X�L��nUJj>���"ŸW��g>��X�]�ɢ�F�9Zʀ|j��qg6�=~A��[���"��7�����,FS����(���aD��&QQ`�]0���� &����<wk�L��p����U��eä������7��� {�'�r.Y%��ܳ���i��1���g@Dj R8�]���,�wX5.�[��#������H�#�Q5J�0��G!x����C�5��U�2W~������RT��2���Υ���F��I^N���l��X��d:Q���O;x�|�'Ρ�h�E��������e�(fnW ��{�
Static task
static1
Behavioral task
behavioral1
Sample
VIP-CHAIR.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
VIP-CHAIR.exe
Resource
win10v2004-20240226-en
General
-
Target
VIP-CHAIR.exe
-
Size
5.6MB
-
MD5
1456d19f6e07ae3374e5c296f205a7e5
-
SHA1
21391320b8f27e7f8bbf9f25c0e97f58a82f5c28
-
SHA256
358e6a243ff184b5d0770e8c442a2a883257e925e66e2cb8c42e137d19059953
-
SHA512
0ccdbeeae6f05ebc8fae56b241e9ab9a090d5c3c771bcb9a6415c09f1217f02aa2e2465e4deb833c8a5d16139fb69e172d77c7c0dbf7ef25e217bc84a7319ba4
-
SSDEEP
98304:l5Po/g9kQoDuhk2M2uHSwfdnX/aqeAZnOIBggY5smGbirNFUM5p3KS:/o/EkJCduywkVAZnOIY5sJaAW3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VIP-CHAIR.exe
Files
-
VIP-CHAIR.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ