��8g҃>m1W��(cr�b�"���E�k�$躠��٤�h���]��������u����y ܝe��~sDK��,�g`&XA����v-^��)�Q6����;v`�V�S[����@��w��\��V�l�9 �J�ӿ��Ǭ�r�a3g.����"q�g�|�O�;9�_�$NJ���q���U.�՟*/Z���uf3˰A�qɿҙ�8>���Q�X"�<ʽ�AxI,��f�������#�9�{��N�D��B��D5g�O��}�{~�{wnERb��%~�`W ��z��@TL�#K|wo��h����s�x�<v�&M�?U_�f�H���3g�$����.�O����i'>�l�x�zg�45\)�����@</yb��k��))��G��=i��S���~6���J������0�PWfk������js��N�L�\�iX>��ٝ���(��=`aN� ���;�� � ����Kj}�l~Y��?��>��;�����"�aP� �q���]�웝���܄1�M늆��8��mEΧ��7�e��-쥖��5�w��Y+_��%'G���)D�h�B�}Fґ]�ω��=�?<���;�8"�.��P;$5��\�Ν?hڳۺ ��[;�[�g.A�>r*��ݳ�RV�i�8]�կ�)��a@��>�(x�uzp=���Q�Ԡ�o0ޣ�L�u���R�������`���ߗ�h~{$q|�z�F�O0���W��0������������r� ;F�_)�A~�����ȼ���U��L��Z�4~�`�A2������,KOz*��h %�%cvz�r���S����py����X/�ai�M�D�BB;�i�`~+�H?�\��@�eڕ6���3��v�]<��&D���q�l�3�+��.��l+�|48q�&�ap\����C��AՖ�����6q���0>��z��f�L::�G_w�UbJX1�˟N&hiS��is��������y� qj7�4&b0a_@#�$���Fr|<."�%4��{�}���PZP;�N�l��w�ӱ��Ƨ$�x����V_4<�N�''��(i��,5���@��|�.�|NX{���9����c�k]��ӻ�cG�Cl���59���]��u�3�V�U�2<�IbQ����b���5�0�u �V��),i��2 C�� }M������s�K)ݛ?����2� ��%)��U�x?��0-Z��ƻ�1���������D��j��|�y���s� ���b�eSg�_����֩����9Dg�@m�֎��>p�%�83���o��ug����bO4����Yƾ:��ȍ��6-ၜ���Hx�Z�H�SP������ÔV��+R5�����k��r�D���.�w�NR��D�N*���8��,�D%ՏR�o �s[Zχ�!$�s�X�<�4ކ�9�o�I�����6��D��4���ɛ �����S�&1�V��v�"�8�vs�ܗ��(�N+���/e�um�v?o,�pF�h���(�<X_D.���LԣE.�v��%���"��+C������5�I����m�����!�`��q��?�������1{�䍖���{�),�Pf�C�v>� ���b c Aɥ� i�t��Dn�b���l���m�Ji������\&�ʴr"���PE���(�Q��y���L�<F�����W�<�S�t�m�xj�7?ȅ�@䬏�K���J|H1ʠΤ��!0�;wa�?r�����ؐ<S5X��pU�����A� �����rc�L���Oz�tSi����@ �g9xUK�93�%Ee�x��[��F"sBtc�*!<�o��G}s�6��h��E���r텢iL$hs�Zth4�dG��(`���Ȓ)� ��� QҨ~lA�͇kO��+�:$O�TcO���=e���qEhstr�'}$م ��d2�W�Y� 4���[�v������gS^;6=x�~M"pm�ʑr3�AD��Ŏb��G ����7Rå� f�¸"PN���Q-4�@c&�%im��(��+��"w@�������Gө�\��]C��0v����P|L�w��E�!7y�����x��q�&miAМ����=�m D$ߝ?&,`m��3�c�z9ٲ1�&�����!��+�9v2���~G(��<.U��(q�C����sϊC��l g8�~���������clw����n@��`(����W*�v�LA�@�S�X�ڞ��[6�@ې�옆k����� OQF��MQ�A|ǀ ��}C�wmQ���N�Q�Ve�i~ia�%71�B�em�"�<�0��W্�LN^o�B�$6g�lkYA>3��6S_�vq���8�4J��vJƯF��x8n��N�]dD+tq��B���tSvC$0C�lgI]���;<%�Om��Q��d��L����˫�Qw�H½2����*�P�#�y9+��y"G��<�Ew���>K���J�MOj��5Ԍ�h�܇���1)���+��m�Bcu���ҧ�D(goq E]�47B[0���l��I����³��U�䃭c��3"L�#����u%%cp6sAF9���j�pA�O�ǹR�E�%���CB �n�=����P����h�D�r�< ����V��:� {���nF��G��M` ��_��MiR&�~�V�l�L{vt�q.���� ��QL�in�ܟV��"�`Τ/M���n� \hؘ��>y�ɢ�0��-�GK�E����O��em�M��_���w��l��ڌƌ�3��@| ���^p{��r�~^��.*e0c$�?~���ImI����>jk;��-g ���m���JE���l[�h�f ��](�f��貆��G)�~Z�-��ԒģI�=�` ���W|����1�Pn�V7��ᔺ]�1�����(C�Y����d�r;{]*���z�.��Z��ײ�!�8!D�=����|�o7��^�X`ttL���{[Li�����ۅ���-����|.l��m���%�:+�&��w���&�/M��\�_��ކ�)V�s&�4��8N.�Hf>��A/&���aE�#U���
Static task
static1
General
-
Target
VIP CHAIR.exe
-
Size
5.6MB
-
MD5
2c6e757390ab9cbd246a4397cefac3cc
-
SHA1
ebc76c447d6504678d449a39f57c574b39ed5063
-
SHA256
91bcb9f080b7f24e097a233e25475c1f162f84896131d80eca1d5515265f45ab
-
SHA512
dc7d29e81ea9a72f9ca91f3c8506e9b60a9a2fb1c48d0c7e7656e130fe1d453c6b35be06ed45370e3535fb4d3c5e6e915fbfcedaf953f5b86ad33398aed6104c
-
SSDEEP
98304:fSxBfSfBtOVf9nWsiNHCX9HoA1Qqb0l3p8A3vxlmU:+fSWNW1uHouQ1l3pm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VIP CHAIR.exe
Files
-
VIP CHAIR.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ