�pϡ�m�̟g�,�9�X��f�^q~>��͊�����oo5�v��K�5&�H}D���jg����s�u0����k�ݚ�Ӊꭜ2'�)I&��Y���Hխ}���4�W����ۭt1+���g�D��c�ԝ�5����7^��O��b*���qL(��^>6o�J� ��&�+I��B�{b�RnG��vY��?&����|����XlZ�ڦ��o&ɦ ���+ESK��ox�u=6�}�!>:����L�T�^��f?����Q�V��-{�[��R�����ْҴ5�9k��$3�N+̴.j8���`=���=�P��d���>c ��R(�W�f�NZ���4�չ�ȏ�SM(nL�<}���q}��C����䬃K_�O��q�`I�����]d� �>��5� ˋ�*i?oE_~b�W"��b�m}=�4�Tai��D�0̶i&ƛ[�gJ<-��V�Es[a���L�s�_n8�7�HuGb`�k:�i���*_%�gר5'���hc���P��]���64_�j���,&����[�yy�SQ+fVj�N�B�D1����}���'��?m�O�c�,Ĉ�!���/*���ڋ����f$F�u�%Ï/�-�F�"�تI#��N�ˬ�hX���D��$���Z������Ⱦ�Ȫf4�t�X� zX0䞋ND:�q=~����p<k�s�R}��9�gy�f'�F��5V8���c�fQ@���Q�S��)����r�7,`���~�!O�q@�����n�͜��-����<k�> Q���L���d9/�i�/�K.wD�4�{����73��LVy-9�;��z�!{��s2n,ː ���גs�/WߴG�I�ǣ��ɫ�kH�օ�v*�l9�O�u�Jh�9Bf��0 {M�YϞ��Z��_L4�W��v '�dR���E`�����#�Q��1j4��M�'���,K��o�ƃo��sL��>3'���UK��� N�Mz���'@X~�����^mz��u�:�����/�}� {�{q��v�|A�!� ���g�]0σr��QC���� h�M�� �����y��Ы���gz6!6��aEi���34�6_~A�!`��_5nBn���Kމ1��y��$����I(�@W3����a@���EĖ����Nd�o��G��x1N�c�GÃ*/����f\k��/����2?��ϟ}�V�����~o(��s�R�AYz�(%�c�a�2 �Y*K�B���0�IFZ�k �37���_V��q��R���gɪ�Ã�=��|di@v�W��u�������Ǒ45 �eU�M�-s��E�z���+� U�g��_���P,!鍉�j��x��(.�]xL S�'����lgI�@���K���\%?T�8�����dV�j�> ԋ�%�t �EXI��x\�2ۑ�r��&�՟I�k&�@�����zlw���p��&�Rf�^?o9�˶>�uu� w;��]J��sܗ�Xv�}�͞|k��{_�����HWCKO0ԗYfO邏*a�a+K��?�l/z����8��!����ꦔ'�,�m|N����Y�IH��ذX��=���"��n��bӂ�Pc6 �?J_��K��_ �H[?��H��,=ل�dlN9˾�+캕���htX'��h����C-h�ܹ�� �ƀ�M֠����G��s��m�x�E;4(&�V=�J��ڇ�/l�jG����u����&d>�#�Ͼ�N+|� �#��x��!] �E1�U��w�+���H*o��\��-����[/�$:T\�)�<h�Ǜ��?����Aڶ��n���������l�e`��a_�]��I�VDq�Np]����������!{ge���n&�~�=>��&5�;!Ҧ�y�{Qa�Pj�� h�(Fy���bU[5����t��z%Qw?�B�I����!Tw�>"`���~�1�8����ѽIӪF*{XG;��K*=�Nu{2�>c�gg��ί��Z�W��b��� c�� Z4�^e� � �Ί� 5q��nll�ju�?�_����H�!����03� �b��Ab��6}���H�S*^r��ι�|�G���!99��9J=s��59&�^2+|5!�����b�12�����qC�=��w�$��m�7�R�r.���%�H,��O�C�q�9hn�>�R��pOw��m�pt��3�Ms�JX����:�@a�E�t��`@�1��6�82����C=��퓃�sF_��4'��5�FHZB�5��Z"( Q��dӨڰ6�o��%�'��؋& �� ّ�UX�?N�E��js}&Z!�Ď��l߄bJ/�[�ц��ѡ�?�2 kUM�a������j�y��k�T�$Hb'p���tJiyڱ�?�`��[n����t/u-�!�4Z��xp��Z,�SvСþ�>���X�B�X.�Y���?��0 T�PEL�to�!��;�ˠ�K@���m,�"^��}z��k:~�ݎ�~!��"w����sd�CF����i�ƭsZ��hqT�v�=~�)�𓌌�" AqE�g��C\Dzm�� 1���g������2������� �y�U���Mѥ�!�)�4�|U��$kp�ȕ�<O�d#r-^QƍH�-���C��ɂ����9 ��Kj�5�E�n�:�d�UN���Y8�0�$�r�.����.�x}=.�����*�sU�X������Z����R��r���7�'��Ɩ��|I�|Jg��{��_5��Ʃf�?�<�@�� ��0���J���<^�+l��t?�r��}��#��a7sY�h�2��Ȏ�Q��g���/�j� �^1�sQA�r�ce*�����c"�q6(*�L3�fΑ���_*�鲩ڝHMCKʹL�d��fֵd)�u��zl?��G4���)��St�_z Ӡ�Y�]QGN]w��b L��F*ìv�2�\����H��Fm��ُh����I�t��w ��Z Ѣ�%=7�#�E���%ť�ROl��{��kbh��ƅ,��/}@�!E%����9˾�ʎOjl���<S:a��=g g#օ\EPv�p:q�b�_\��)J3eQ�Wq�Q���D�bUi� Ϧ����>�3�
Behavioral task
behavioral1
Sample
GlobalFL84.exe
Resource
win10-20240611-en
General
-
Target
GlobalFL84.exe
-
Size
5.6MB
-
MD5
03547903a365f87da7493621db25d42a
-
SHA1
adc719ee7c13e99e698c55042523354de3641a5e
-
SHA256
1941b4be86662f0704ece298ac4df4cd25b737a9da25303311cfcbd0abcd2a2d
-
SHA512
b45aa3e913d7db5b393e68a2efcf2c8262003093caa6d90fbafc572cb393c134684b274540cd87979822aa633e1655ac974852435035a7fabac221f37d7d2ba6
-
SSDEEP
98304:lKykitXucVQFJEmKUDvwOpqiQ9if0X9J6PnIOldd+g:3rXDUJwoOL6gx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource GlobalFL84.exe
Files
-
GlobalFL84.exe.exe windows:6 windows x64 arch:x64
36444a3a7eadcf33603de3530e235bab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegSetValueExW
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlVirtualUnwind
d3d9
Direct3DCreate9Ex
xinput1_3
ord2
d3dx9_43
D3DXCreateTextureFromFileInMemory
urlmon
URLDownloadToFileA
wininet
InternetOpenA
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChainEngine
ws2_32
accept
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ