���ʙ; ���e� E{90H��������_[ �%�[���6��G�I�J�P��]h(��<l/: ����-~w�+*�4�%���+AY|�V�����.�5<�!X���t�(��p}�2����쎙��>:�}���"�U^|�zq���|�����>bKrEF�Mր�'�m@� �j�i�Y��#<� ��p o�2��KM��8�ɗW�U��o�i�p9���S�<�ػg��|�dJ�����/B�C}uµv�]J�^?��%�H&s����w�:�ˊ2-�������u�$�k)�jߐ5D���btlτCO�jz�u�㍪=�y��䮛7�iT�Y=}�`=֊�lE� ����9�2=\9Bu������ث|W�q���ᑚ|�-e�8��������&��x~��{�^7�4h��V�o7G�<��ϸ�:e�`ϫ�3���FB�@��T:\����P1�yw������%#����}L�}��T���V�`4e<ٴ{�!DJtldʧ萎����@I�����au��\�f�)M@P�,�T��cY�\A�nΣ]o���TC���z�:��<ݨ���إYnd\����=XM��c�!v~���z�DS��1�����zMA�]�?n1��N^�|z.c��b�%�=��.�L�}��`U�2$�}b3I��!��6�)�r �7Y���B���'i�:T�MI!�:�����)��0�4-cF�����~���C�D�>��v]K �&��e��K���ʙKR>���ŷ�\���y�p#�4��C���x|�;W�MN^�tm��6�Y���g�����:�z|���\�J��)��^Tj�R�:R�1����>u�Zil�_���?5����)�TÒ_�7���� +��]���E�I��&�L�We�o�*��G݅���P�q���n���e����Q���\= ���g��B������"�a?���7� [^����O��//x+_�)|�t5:�u�Z4.��ə�Z�w��7�S۳L��]Kh�1mO�j>�KAq� ����\�4'�<�Թ_+]@��9Mә!�p�'���s"���A�r�n�������_��*� �������q��HD:�9����/���s�֡Ѓ�rɴ�[j ���n�P0S���oq&45�J�̪Xz��*U,iU�7�x#{NJ��&b�wE��a���� ��\Fᯢ1��\�K���07�O�/��Ł���J�Y���V/۱`-���T���(�^"���n� ���U(t�p��`�%�Jބ����Q�n�+�ܲ����"��<~��q�竕���1�ŅbWq(��%����/�V��v�p�cL`���������b(������c}2%oa�'���1�,�0�S�E�9�p��ۘL����??�؎����,3�9������!@��Lֱ��3 �^�ˡ��T�ν�6�\�ߑ=r��£���� ��\��(�����A���[^WZ��xK?�-����p�^�'��l~����]�jz0�I�"�����J=/p]_Lzݽ�mU郳fyqJ ��DB� V����8��&���Vΐv+��/�#��nz�|w+���������B}�`ƄH�y�%P�����m�8���ЪECZ�[KM�Z�����?I�P]�nU6F\Y�Gޟ� /�L�E�����J_�w@�e���P��N�������3���?��VT^���ʍ�,<�E� ��xJ���U���;���w2�v�hl��^6M����h�G�4�e�ŗZ��N�����!��#%4"#�?"w��`ϔM���%[4��a��u�p�`���X��� o *8<��c�b�&D�u#,l�0kKB��`�= �����~�pS�W�M9O��\�:�*u�� �~�&ɝ(_?�Z�Ϛ����p�� ��ؾ������Tph�7��[�5,Hzu��j��#_K�,����R|���g��xA���yM�'q��Xq�� �0�:Mݺ��j�55�Qe�g� �kB��Wy���osՎ� �����{,G���8��eq�_fIR���N�c��:*�V7b��� "����y}XoWr�F� j��z®;��û�A��#�9�R��/8"e�zD�(K=3�� h������&�A1�O�5M륬�qa�� `P�����z�=�L�S��B��*s�ݻ��1��A$������eG2��u��xb�D�(K���?�t�=��E��݊J�j�+�'�Ʌ�g8e� �w��h~I.$� � J\�I�7���� ��/�b�rl�5��J��S����݉�L��mv��N�H��G�dQ�fB$� �v���6D�� �xXӌ�������c{�����OR8-�s mSn�X������Q� Ϯɚ��/���}I�����@\��ېnQl�C�y6�h�F-jK��>Fg��#��=�ͮ�%#�>vaq�5��9��,�(�9K�,��H�,L`���a�C%�6{�3��snW��c���2�s{�[DD��:jQ�գ=�8րi�l�����B�x�L�Ǽ�,ə�&�%hiX���2������c0'��c��/6�:�s�W9oh�{��+9%�w��?6���ل �/�V�Ȯ��4"p���� G�3�i����&���c�cYqϽ��-�B�6���h(���8��[u��������&=&��āL��)7��Y�d�����X���q0�S�6�����^-�n' �|р��"ǰNAŪC}����E�`A4Ėf���Q5W��1����t�����&�v�?��A�J�.�����%��t�TFZ7��j��T�_���zϿe�������N��t�b�b��pB� Ej���UL�*��u�)��y� z���� �#c�70�TM��+�O���^���R��m!8�j2()ߑ�뮚��ߏ��W�#�e���ό9�H ꕰ�n�����6aa�q&Y�Z�$��t��4��R)C�ش���BgV�i���,%%�C��X�N�F�S*�"4�/�������"�����c��鹯�G����7����c�92/�_�
Behavioral task
behavioral1
Sample
WEYQbzdtrOXj.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
WEYQbzdtrOXj.exe
Resource
win10v2004-20240802-en
General
-
Target
WEYQbzdtrOXj.exe
-
Size
19.9MB
-
MD5
51c2a6dd0c49c0d9b61806f5255ac7aa
-
SHA1
6a11eb5b5f59c68ea30e4ebf8e5c3e84454195a6
-
SHA256
be59816bb7d2c9d20094ee0f30765af8ac7a6ae565496beac67dd29bdb16e62c
-
SHA512
a00bda66d429490e934e5f1a32aba320671fa79c62a287da26d5142519cec195686242ec89bd35bb9450ee593fddf2c43d7479b25c5e2685b139d0c2fcb999ba
-
SSDEEP
393216:NHxIXCAgnPmx5ZRI2hpGReJz8e35EAcRvBNc7F8m4r6rby+QOsk:NxIb2W5ZRI2hsReJ4e3LcRLc7VS6VQFk
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WEYQbzdtrOXj.exe
Files
-
WEYQbzdtrOXj.exe.exe windows:6 windows x64 arch:x64
2278a975cb46dc4fce45a94431483414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
ws2_32
listen
wldap32
ord200
crypt32
CertOpenStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 19.9MB - Virtual size: 19.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ