���T�`��������L2��LAQ���+�kF� �a�r<#�r9s�R���I�c�9xc�� �5eA�o��I�kGow }�Y� ƚ��t4#��ܳ`���K`��}`�4a>Ƴo� h�b��G�#����c\���h9J��َP���W�T�ܒ���X�v�g zb�0�y��S@����О�/" w�*t�&����li�=N��25A�4��g-��s숝Wn�@�sP��w�,�<L@�Z�3�����BT�@%�Ǘ�0��~���|H�6����ȊBC��?����ٙގ��9��]��T�4�E���P�?�Z�߁w���$˜s��l~��>d�4�� �;;���?%5n�Ɗ��b�x�$�-G�j)�Gl�� Ŭ�̉JSzf�o�Ʈ��C��[D�'�\��}�����S��1�Y�{857�E"*o�xbɛ#������U�Q�����I����%[��N&�Q*�B�x�<<<����k||�G@X���� 7�f0�o�DQ��eq1q���J�j L�K/-�����Fkv�B.�b�"��Tl�u��ۛHD��V��S��D�c�a*����5���c��d�'̹�UDG��qk��`Ze.���͝(i߉�j���j�ό� 7���܌Ys98�������q�"���R�(������s���cH�����1O�re�3��x@ջ�K:� ao�+���O��U9�W5�����#b](�Ƚ��P��&9���:�!���(�K�S���<e(1��pC��A�8�d�8?m��xA�6,�g�����[z� H(�$f���H�dX�|O=߅BE��2�M��!-.��t.�ј#�XK*u�|;|(�_�L��=2���tM9���> ��a'T�ۆ%(�tK�Q$[x�߸��S0�E7>��&c�rs�:����So;��I0E::�mgyJj�La������u;*�+wv�������n�'�q��]AK��/��o����5����x~0�D��n�! ��~ed*2h� L=ꀺ��%��h�����KC��(�m+k-+F�D5����k�>���`�fmV�h �m�q�vv�����2�a �(z9���`������F����t� �����!��� �0H%zj�<��ד�!������K������_�L�|.�����Bq�����1om�]�<A� "@ [�Tq��;��&4��p��y��)T������ܞuY1��4TN��_8Po��ع�1Y�� lxH�cȩ4$�^�������Z�i``� b"]�/<�U�V��5�5��_\+2��� �9ў��]�_H�k5_z�͘�@DH��l��?��W��u�m�����ET�C��f��5Z9����[r'��vJٺ��o8Me����� 4L2I��������Tػ{Vb_)�*N*� -���I6^�� r[<�!">�GX����Ơ��G���D�D�Rn�P�B�&�$���a��� �B$O����df��MˇP$��\S������Etq�[�Rz���ٍ@�N�i9�9s3Ò���С��8�g�;Mk('a?�����s?[ZL(������5A���`Y V���Vq�q����.�@��yJv>��c֏��mlYq�NuD�h@�>ޣf��>u�+,6,ӻiE�p˾�T&���Sk�����&œ�X�'^]���:Ø�}}���0��A���V�W�~H� '��+�2�vl�nw�!,5�~�3��*���f|����$���U1�S�VoM�{l�LԒTg�%�1>K&���S�n���-���"Z�f�/�A��Au�Af�%�/M~Z�0F���דq�P����ۉ�������җ������M0*L�̘!XP.�nW�=;���WP�6�eJ��ƐHVo��g|���Q�^��zk����6-�~�Y��D��^/t:#��oH��H?���"ƽ��i�3{�I/IG+���EE���,I�/]�]D脏�Mz�oS{: v�c&���(G�� �2���Ԑo6�%Y��lo� �����kћs�s'��h�uz��`OH�����G#u|��4�x����E���D,QLjlφR'�9>[�ŸM�5/��a��ۿ��.5<����/_q�H��W��r��hX�3�r��a ���Y1���J[�������:�j�j��kN�l��X`R�1���>Z%��Q�ȬP�,i�<(fT����g,�� �' �qxs���@Vҫ�Y��IQ�1N[Dd��=e�c���*^��?�o��>�� z�s�=q|x-\̛A�Jkv%j������+rb��c(�8�0�?U45������a�_�y�]I=�����?.{��u�1 ?�6 ]� ��Ȏ59b+�`=)�H�v���4U��L�q1-T�b�|�>u��H������U�&�����ɄRD)%U3�%�=[�t>:Qfg{9��#����(s�6���3q%O��-�HPr��m�h+Nq��GS>�(L2܌Е�ThT3��W�nZ�K �h����-��v� �@Ie���yK�B�\k�>Yp���.+�I`��V��<: ��?�����<-��0[0�����^� ���FR=������"Y� �%�ڄ�^'/�1Q4e�n�*��]�˔�|죱Q:���5��ܒ0w���(q��ș�쇅�!�����|����~�4^��.�+?("�� �y�&���UBIc���:y-���:-`���U�\����t��\z�6[l@e�ox��=�?`�)��im�i��>��H��n�8�/kxq������dbţ�mVjh�o��<�І���)BDǯ�I�)jB�?�T�'v.�p4���n�T}���A�W\"���"r\H0� u�r��c���F\���T�(�˗_����(+��^�9hyC���`�i:�����)�m�l�ۣ0th�S��ƥ�ʪ�k�֩&q"��ck{c�J|�j��9�%��S�|zy����F�M�e�o��㑞ա�H9��u�k���|���N�Hv7�;�F�Չ��'E��N����QlʸHc�R�@��4��@�7�Rz������t���X"Mf�i^� �rV�v�s;� fK
General
-
Target
Yonder_Spoofer.exe
-
Size
6.4MB
-
MD5
8f6176cf818be24d9a9a02c96d779ff7
-
SHA1
b2f4fb1975ea1518d17e2489b005a003a3e876e3
-
SHA256
a50313148c4f3c575c7564c4e5bc14f92aec9b5326c1ee4e291c1f576b0df7df
-
SHA512
afef7c86923e5a2dacadc1140abe092b240a454df74846baaea3b256863eaa5eb1646cef97f0fe2d2cc73f8d3985a1cf975c9cd3c8bae82b5ec5b0ccce0c0c32
-
SSDEEP
98304:73O0NlpvbBHyA9N046e/sC902M6CMbJjN5z7YREOgRmJrjDLB3V7mNNi0rjbpA/7:DO0NPbBHyA9OA/ssB9HRm5LBINNi0Cd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Yonder_Spoofer.exe
Files
-
Yonder_Spoofer.exe.exe windows:6 windows x64 arch:x64
0624dac67380eec05d3e8766aabfad8c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
BlockInput
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
psapi
GetModuleInformation
ntdll
RtlAdjustPrivilege
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertFreeCertificateChain
ws2_32
connect
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strpbrk
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ