0v���$��s-M�N�y�����`��j�M�|q�Ǥ~Tb*X��3iG�%�0;u�o+| cTxv �8�s B���F7���� ��1�o�ʶ�.e����]��ij ��R�:]f��4�Ƥ���r��=�����x���'���^^ �/y+�!徎�` (q;%��҈o>+_�Rcg�:��@�瑪��m�iD5U�������@��;�h��S�.b��.RXH!���L�Đ���'�)O���V�'�/&������L(,�9�hDׇ�{`��B�}֮R��� ���w��#��`���oP].��%sG�V>��=�� �ü�jbXJp\�_纝���W�|,)v^����ݾ��v]D�d�o���Qe��+��4-l<4��8UF���>0����CF���W��?F�U(h�ɤuzN$3k�kA�=���Q,&=�x�W���r�w�s�����ߓU�W�?9�(#�̡��̋ ����!���է��a�O�;��D?IM^�堊x�!7yC;+��h�Q�����Ŋ`���)]���0D�@�����^[ʊ�I���f�Y� ��@t�#����z*,��������]�Hg ���x-8��ʩ��U/���v`ow(4�g��:]6�7�N�(�T//+��+��:�V���P,MV����X�|�9�fwl_jV�U�#�}m7��I�4/Sf��R��\r�~�!kyxkJ�2�k�m�oe�#ǵ∓)� ס�K�:�}��.L�%�â���� ��e͟������ i�s�%�nV�6,.��&�xx�6��4V|a�<��9 u�#��S��qf ��ʁ{H¡��3��mX��(G�@�~�J��L�$Y�7�2�{�3����$Z`��� �?�n2���l0�b���㤇�T����]Q,��d�.�8��W�����GG��*�IW�Y�l���l��[2�Z�J�O�f���]>a)��!;<4�O�?�|y��I���6 ub�l�o=���.l��@�肊7�ǻ%��ׂ\l��{k���v�������˗��j�b2�#\�jn��+~�o�GH5e�{�L��b6}�Qj;��%��l�n�����=��*�����!��:OwFѦj�J��Y�`��/�n�:�4��F�gj����U�{k<�����@��j^� wؘ��֟�D�jUF͠�ӵ���ڑ��ea�r�����9�%[�$�H��9�-�T��A���%���,�;���h��w���%�zCK�u [v,�&�����e�7�@�v����vR�[ue�1�f`H�`~���^�w��S6��͌��?���Bl=��ӯcd`�Ƀ��67��?ʘՀ��B��c�Ä���D�-�z|}NJ!*�W@���&�[Xm1�\������?�j��Hv߄��^*��B�'� e��Ѓ� ��|�h��ަ,ZݟD���@2R������)�wC#_�5���V_����ؾ�<��Lc�s9MȻ��9��+���f>�@C>?��h��C��:��?r�i�j~�G��B&!��1YW��P���J�|���C�xZƅM���4~~���atA���lb��5��Q���|_�xs��H��DRQ�C�д����6������:P�2������ ƽ5-���`J�`�Rʳ��I�P�xy����*�cR�f�IV��=�P�'�:u���t�A�F����S�R-�ޒB�d8v�%%q��z7Li�.A��ye�$1vr�ߘb�.�X���[��q��-M�Ζ���J/J�jo*�O@�M~��M����&\"�#�2Qh�ӫ��mL�O t�5�J���<���������W�K�?���r�p��f�뷥+3m��Q��vҾ� _�A��V��=�6�#�Ɣ��`�ro��u�h�#*W���oD�vXf���*�6����NrI�c/b��|r2����3Al�#��h��-��[ ��o�����t's�>`�����_JWJ㺏���ʬ��� ,�'�䄽�|Ӛ#�.iu|}�YZߺ����8��+-Ԩ�#eڝ*K�7�Ɛ�md9��X�k���z��vkW�� ۠�{8=@eo;����F�j�(Q{���C/���x��7cp5��2K24q���\ ��u$Z4QJ�6r(C��Ějy:=�_��j�]�`�^7ǗM>n�q/��rͦi���NZ��qV�XI^1ڴ4���{���c[���J=�k�*��g8����[ۜ{���ĺsԳPL!Q����@*2��1��B�S�������U;��oK��:�C�XCo�{Wt��Q&��GY��V��\�*N����mW/`M��n܄#�n��F�?�3|��?������M�PdnG� �l7�a���іG�Q���/^6��b�"���uz�X�]E���"9��`WxdAc��i�u�ZF���I�Nv�b�5`fb5z�)\`�5��A�%���F�g����Q�f�����c�&�ܞK�������4 j���o��^���)��-4s�k%c_ �B`�j͋0!���j���e�bN����跙^�����-�}�C^)�lD]�8J�R�7I%B�v� �+(TMts[m�o��YYP�j���_S����":�P���p 4��*Ƣt�C�1�JX*�9�,+[9%��Ȋx̆::��!�ȉN�+�Fb@>8�.����`������! n�O���m��rq�����Q>w�U8_��p�"�ӮpF�V >��ԛ�V$���r"�#�R'|�Wjqܛ��Z�a�����DZ���w�b��`����)��i>�?-j��!0������Sc�SI���T;]r9A�ɻF�2ye�B�Lی�Mai6���6��%���C���5�b4�5oUI�fY������oS]�=~U�V�լ}a�h����T�~M^�q6��!�}�g:iՐZ]��d[!%P�f��|cr�O�m���~�-���e�{�1qF\�ZGZʜ�̶� G �P�,�}jF�&N��\j>�}�8l�u���~M��Nj0��f���]@�j��d\�VA���3:�\Q$&To_V됤���{�q�����
Behavioral task
behavioral1
Sample
rQuPlMBadLDa.exe
Resource
win10v2004-20240802-en
General
-
Target
rQuPlMBadLDa.exe
-
Size
17.0MB
-
MD5
4f65fbcb1bd6e3a5ee4fba9d17ac993e
-
SHA1
7c9eb87236238592dc75672ee8e9cddc7fcaf299
-
SHA256
e8bc99409ca504f4292f62395df0a28cffb4fe1768b5f2cfe50f8ed1e996f0d4
-
SHA512
7c455ea1deb3a6c3404527a8fd93566c14e6c2c521ba944a654d385886c2ae6e15460b066187e10da9ea42013f216b1deae9e34d526c60cfce1ca53c3de91461
-
SSDEEP
393216:v4Tr/lg+4jMC83Oxi8QYp29pazxeUaCkTN2FQcEO2nRL:v4TxaICZxiK290zxxeMFNE
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rQuPlMBadLDa.exe
Files
-
rQuPlMBadLDa.exe.exe windows:6 windows x64 arch:x64
2278a975cb46dc4fce45a94431483414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
ws2_32
listen
wldap32
ord200
crypt32
CertOpenStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 17.0MB - Virtual size: 17.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ