�6���|Ɇ��$%�N���(7n�s�'�r��`�5P��G�|l�t� �c^�*�P�4N�\�Ň�E#���6b)F��l��Q�Q�"ש80��wԮ�0�Y[�p4�?��� �$s��Gp���*q��O������9�\��y׆��J�-��tt��(!�Q��\�}��^�3�a���_pp{��HE��#��I��挓������\e���#��B�& �p�X�li�7l��q:���`��x�Z��}�\Ⱥ[n���4o�Ml�Ք/#\����(t���= ]4z �f�$���Sw�a�+�����B�&��5ת_⥜C"8��Ư�`a�����դ�;P&�l���7��҅hR�Y[�� �R.v��A�=!ѻk����/>��GR|l&��`��\�So�.|`h���G��)��P_���� z�E5)�����Slhđ\��QC�M�g���*�j��GvCgVĐӖ飆fC*XHr\36{�h���>՟�o\�D7fL��;b���4l�R��G=�������,$m�{����Bd��`�k1R���@�h������6��� L�>%��!&����gG���Z�;wU/ :����� �.}�Iv'���g�Ĉ+}'�@ �IB10�����uh�GP3�4=(4E�/�K\u��;m��1�5���c��VP� ���w�7������x9�oL �������/�QH�:,�r<�]ƭe*;� "��M�vW_!��%�3ܺO��-�+�.��<���i��G��6���->Q!DO���rl;h���8�%�X�T�e���e>?I���qı��Zˮ �����q�변dq�%�z���|���P� �*p�%�s+8� �,U`;��V���Xx�@�*�R뀥(͍O����^<\;�����g�]�f�I(�/����i�����G�����g���{��� �O9H�,�ֽ>���4��@�����+�Q��/;TeP xA2e*�� }m��?S�nD�W�)��*�Q�A��h5��:fAA]#�� O�-;u� ��Lj�![���������\ג��:7p�F�ݨC,�������#Z�[P��KD�*��Ly y����*2�継`�-�,��<�'�����ӷY.H'n�n&�F�`��2��Et�$ qmC����&�TF����oFV*9�`u�&�}ʖƕ}��P� �ܹ.oTvu���S�rWFE4�vR91��S�\���\3.��/��}Ņs�) ��� ��y@D4 n�[��d&��f���+��Y�.��<� K�Gero_�@�5_�k6�c�<d�j��=��*�r!��#��5�&rk���Q��` ���/P���E|�oޑkht�;�Q��q�#.5�}����O`9Q��͑~L�y7|�p@� ��S*�5�ss�3�:�'�G-��Ź��P��C ��ɠG���W��������@Y���!�}p�8���އ���3/�P�ĥ)��zv��-�.�䫨g��^��u��8�?��!�O���(tR�C��jK�Iz��M�x@�3�{UR���O��|d�V0K�V����z�� qfw�xq<&V���G���#�j�.����ř����U��>`��@�V��&û2��)���s��-M�_�qמ����0.� 2ͱ 7��Y�Y8�;�FEh���"��_�~�*�@Ԑ.sb�ʴA���LY��F��b��(������ڙn���Q�S�0P�<�&E=B��]������|{ʣ�>�������#�`���p�a���B���\�A��VV��;QS0#[CE����Y� �GߗKA��aJ7oʏ���+��q]wYw�z��*rT�0hlI�Ƙv��#���X���;a �9&���a�6����ʎ<L~������ݩ����*9J�E�Wx5�W8�M���F�Uk��P@<���T9ϟ��|�U��Mh���С���m*Z��"Ɛ�|�9*w���j����?�w�h!��@�m"̄j-v���]2�#Y��l�A��f��1����1�0hC�d�о�&p��;~���r���w2���b_�o� 5� ��,3RͮB�ٿ�x\�G��r7�"NF�$1+�&\��6ϙ��j.v;P��g�e7:�5O�ڇ��b��qѶ�ӛ��X�O��}��hs".p*��_�-�Mͦ'ܤۣj�*�3���#m-g���g��@a�d��ޞ?4!���R3pEBv3��"@�;�s�������]̼��?����������*|���p� ��kIƵ�;-ka��i�/N�o���uQ��� E��_��u*m���\W�+Ƞ'�W[b�����̎��Ox������C��%VÖ�C窥+I�n����|K���N����h���n:�n^�z�./���;�m��o��ڊc�/}��|��.s_�5��[8���%n7�*,��IEaLՁ� Sv���t8:�p��`� 2L>���?�FH_��D�.�y���'y!�B��m�Y�L�,���������7� l�y��+y�@t�/�����P�4���"�c�H�8ꬼ 6�G�g���{ ����#3��X�6�^�K�C5�/�I�ZQ���Ǫ1��7,�2PGp���z�NB�Pu�86�A]yr��8�,S�}A�~l�� �����9K*��9��{�� >^KN��^d���ڠ�~�+���#�G��K��줎6w���� �M��/'�\~}��5���dɲ|e<�b�p��S0U�f����3�� [}G��TIڽ?�7���~���)sx���Һ�<��&�㐽[l�O�e�:��6gb&�Õ��v���/@g�q�{���m�pX1d�8'�����`�B��$�z߅��d��p�������un'�M���hQx�B'�)�㝠\���.�5��+ʉ9JB~� +�VH����'�3�X���5��#���}N����BYg�����k~N�$[��&C����N�i�>rt}>�r0ı_�}���7�d�������d���ߵ�$G��<o �J����������F�I+�&q�
Static task
static1
Behavioral task
behavioral1
Sample
VlBBUwxYy.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
VlBBUwxYy.exe
Resource
win10v2004-20240802-en
General
-
Target
VlBBUwxYy.exe
-
Size
5.6MB
-
MD5
8124ea8a72fc599dfe2a672dbaa458a3
-
SHA1
3e96b54608e40d37e77c252135fe11566228fdc4
-
SHA256
e10738a140545f3c5604d932e44ec6a3e310379ae99595add8b29c6fa5442bef
-
SHA512
2db2a58856fbc3b9594ef6628dc85a360ed068a55b395a1aa2b494c68d267d07c9450fbe3f67c408d9a57e75528d421961ec18ce704a13efbf6ad6db5aa0ed39
-
SSDEEP
98304:eW2nKiXBk1IIhLcIatIRksW/lby/PEJb+b1xU76wMxxyfKmt:p2KQOIE5aORlf3b1xU+jyfKm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VlBBUwxYy.exe
Files
-
VlBBUwxYy.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 457KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ