�5U�!�DB֫�-_��=���`�_gw�#�� �����סy�?c� 4_�����|�����<\ 8����?A��hF'��'+kVt�D��R)�<lq��L*�H� *�'��RU�OS����L;u�׆!���N��+�ZPw�� Ꙩ)Wء��O�- f�Q&!�m3p#�V���֠���:�Ev��E�H�7��>פ,P�$ ��7�9�܄��m2��c; n��&_Ҋ"�pB� |�)k6���/�_ 7�ߊ��`8��7����.2��|�b���/?11�-ט�3\���R;��f�GJ�� Bg��i�w�i�=��TB�����P��.k�Y��"�y�(�l���i �2�mHs��d C�.�x�ٲ�t�Z�}r|x��*�G7��߄����)'q�>� �)`rʤp��T��y�[x_��'Y�v��R2'��9�Y�ǟ1��3'�Q�qWUl|�C+�[v���ܓ��� f���.�����eU/��G��c�p�a��+6�DL�M7��XU��p~R.��@�8YN6��4�h@WV �a(�Wwq -��{��R�X�) ���T�^`{����/�\b����mS%��Rk�*m|��kO��� ]1��7N�̀�P5�L������!-��&���MR��3���r� � ��Y ���I��;�V��-sh�܅ L����L��#�iK�/�������"\^�_���C���Ni٪Y�Fd!�d&xw�\����Q�U����C����.Q��^�ƻ�g�U�W��*A��Vr׆�f��TjJǡ�/\'�T}�ҍd)�C~����1`�N�a�ɺ �,��e���d����@$��l��=�@�����ѥL��Gӵ���dJr���2��6]nY�#��l�@�1ͬ��~A��ǡ�I��jf� rd �L��K۟Jk[2#m����Zg�k�1��n�o ���r�ϩ�M��O��Y����9&���6��bT���@⋯/�=EA��0R���^���=��<Rկ���җ�臠�Y�����{d�����z����YO5J_�J_��9�[��Wl<X,�gÉ����jv�c��F�MY�nرE����K��Q�Փß���-��pp��y�q����!�BK�H�,�.�B@I=�c�����mb�Q��:L'~�����ִ���\�U����`y٭0W�C���+��z.��u)A|�2�������'����N����ɱY�7��N6��H���Dk�Ղ���`����=�����yK��� �~�m���vMH�#�=aP�.f�����*5>���Z]&Z���/��X�����m�s��J�hb� �I�D*�[X��GT� �斤�7-�Fe�3��홷������"��]�_Q�^i)o���^y<ׁ籥�7��/p3 ���'�&E�*���W���9E�oT���˱dQ4�3���0��|K0�����ʁ���t��F}g���w��f*Z���/�����Q��y�OQ��1�y�e]��l�䠏�=�{�DW�2���b\�0n����V-���?��$�����.�v?b�z�~�����<��Mǻ6��P9�;�<�=ߺ�aZ��D��{Q�������������m~�B�s&!C�8p�ݰ{���v��^M�8f��6i�pJ�]1�rf�[�f���Z9�h���'H.�{se���d�-�Q��g�?�}_+`�� -���Z���{9�}�8�u��Լ���������}M�;b'�K��d��=�HrF�z�4��K�������-s��ԙ��H�V>]���+K�`�?`��"_�!��@�F ƒ���K���Ke+XZr��U5'��]"l2k�A��h��-%���eOhu����B�/�]<w�qH�H���ko�𪙛������_h}����h�/Yx%�8�7�E�����2]��-2�?�&����:�@�8���{�3������mg�?�(ͱ�R�m�5IbJ�@ej�E��� Yi��i�qv���V:�X�����B�+��}r� ���^���5�#D�d֯I�����3��M=�Z<�t(���!����~�$uw�: �0Ҭ�mNE��Θۍ���U���v�vǭ��M��{���j�� �Wo���n�e@6" >�l���v��ȅBc��#&æ�V�b*�(Q���}[2r�g�����.��orJ�\wr�v�"a���T(���=�U�s���)u(���\\'��@~z��ª���`@k;`e� �\�_=��a��C��&��<�����4��7�6������o�����z�6F��20=��8��1����i����p�ڎ��n�)����*,e��n�8��-3�F�E:�7�$%e�N�ӵ�p&͏9��7K���'`�!J�����;��f�C�G7��X�ӛ;eGU��֘O( U�����z�f��d�ml����K��)h� �~�1�9�C`KM7�����y�'��U����� z~��5 �lP�O��#��GTg����֕4 �7��J�:�4)t)$Ta��X��T��o;��dUTd�U���U$�_��� 4W�I�X�L�߷��$���W��}�� KJ6Q�r$��I��.�WQoݡE�z��]"���CE�ཾ>��9n/��誄 ��eCr����o��k6|QHIЫ�����O~'pZ�{��f{��b�S��|q��[��4mF��g@�����Y���/Q2��zy���{���E�x@$~jfv'�<��mg&0�����8+V������v���`8N��D��Ts�p1�:\�Q�>�D�B��w������������C�Ӿßa�<���wd ���LW�y{4�\`�e��w���#Ů��/��c˚'�s�)�����!��,s�$�a�m9���xν{ɡ������((<4��=�9��鷆3k8����g��܌G�,��CB�@a�>g�KbC�3_�6���ğ��l�G�/K��yry�M�iȌ�^:�����������"��d�a���(Uџ�B��q��5!^ݻB���^�R�5�
Behavioral task
behavioral1
Sample
RVVNfAFuoPUg.exe
Resource
win10v2004-20240709-en
General
-
Target
RVVNfAFuoPUg.exe
-
Size
20.5MB
-
MD5
e5bb4ca071b4a7f32467d4260fef5610
-
SHA1
7e950adae620544f07a3b455546e498a6ac2c4d0
-
SHA256
f9cb65c4d208ba89805850d0ea1e2d9853236ac21ad1f93a4f263f377ddd614c
-
SHA512
065cd30ca5bd18bc9d7be0c3700f1f6282b2525f59d741e3a0476d0572b4b0c90f077ecedc0aea4df7eded285948a9ebc54b8192fc2260862b9999c564ab7ca2
-
SSDEEP
393216:HNZI9KZ5ikvL+rWGtlqSfBI5xX4LH4pYZv7ugs7G2pWCL6o+DhUOvNR:U9KZ4kvqrh/hfBI5xXoH4KZviTGDaOvf
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RVVNfAFuoPUg.exe
Files
-
RVVNfAFuoPUg.exe.exe windows:6 windows x64 arch:x64
fdae9573baf53b5f7204550ecd32dba1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetSystemDirectoryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
d3d9
Direct3DCreate9
ntdll
RtlCaptureContext
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
ws2_32
send
wldap32
ord143
crypt32
CertFreeCertificateChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 20.5MB - Virtual size: 20.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ