)j��s����"��&��\ylS���t����,#���|����Q�?$����c�C@���@֜TZ#�F������2��Ԗ����q���\�k��!���!'s�i�&�-s �g�>L/�>c�X<���e�i�E` TDD�يX�r�Ǹ�ʧ�JjRwe�q,�i��������0������:o�B �CU� ����zx ���@���펶پ�- ��l�)gf!_Mr�h0�$Kx�c6L���i�E[��ٟn����� OvCELw��_\��uw� �%';�K�x��wƓ���#s��̥?x%b>�9 b��Z���2���4;Vk����L�k�Jlp��� ����k��D�:����ȣ�|�DXъ�2�x$l+�ح�*�0�l;�e+����#��7@�� \.�˛c �'IF���ʹ4<��s4�>\�%�;}�(}���~�.Y$�w�Y.�Q:����l��c��p�SZ�B{Cފ�:��Q�wDX�F9�<k��15*�:�8x SKl�Q�c�c���E$�j�7:��͊C���]�ͣ/p����q�J�F�>j ��h�6�Cca�f�?idN�c9:��4�fE��Zۣx�kC�������tДM���X�?N�R�}o+��^�����#ф?��Dv������5��́F�h\Տ�IT���-q����t�'b9 Ր� ]��S��*���۪�4z�7�o5�H�'��pʟؙ�0`��I�6_7�U~�Xa��7��).��Km {��o��t?����V؇���l8�u|��|d��T^+̼j?��dS�,�w�&����.�qo��D�^���FMzps��&:e� v"k��~v�Π;���=":y����vr�"��aR۠{������n}(��������DZ��f����F�#d�j����U�7L�.?B���2�n��J �R�z+�h*Cc�}�l��D�!�Fo΅~5q&��C����_{���*��Cr��KW|�S��E����>��X1�[39g p����B���F6���to/��� ʍ��GeMPD�����0�4��bb�������i�\샱-K�0}{�Vt�� ���eϹZ� ]� ��Պ�E����y��R�h=���q�`e6#VIʉX �+뼨Vԛ�Ec7��BVw�K�P�:8SgQh�"�ݕ�����C9�(}��?kB;�DJը��}7��l�_3Z]��8Z���Ҏz��#��٘�d��k̨��`��r��R,pZBDg��!;�IL�U)���ȫ� �JF�A�-��MfCV��o���Y�FU$*�]1O.��R/fSe��i�GD�<��ZM�U4���>bL��Ya�f��Uv�BZ���e"m�~_�� ��l�f���+�����w� a�xn����*�|���&E@a�&/�s��b�d��t�2��`�T�\o* �yNډ��?��AO{����;���������L�a�E����@���:��æ�����K ��4�R�����a+�SA硰�b�}�t����dȋ.�]o��ṽ��F �A��DZ���B@�">!X>*%�)T�B���=�Ż+�Dy&�u�l��>����FCJ�>O�ӭT��7=��0����M���|b��g�����9�M=t���O�՟+�#t� ,ue�.$��y��9y�f��%�d��(��G��L:x�K�I'$m�BZ�SN��ꆁ�T�6�c��_��&HE8 r����pӡ��YR�$�ŚH���G���Q�(� �6X~U�j?ػ�0��2��5���H��74�r�]������lE�,0�}��҂UP���_�?;��~�L�t�i(����4���-\E��F55'�7 M܈ {��L�~�H��ϳ��N^�γXvJdj�њ��'��AZ�R ���WT��|���RN����G�M�5��b�y��n���v�2�v l�o±�Jh�5�z���ן��>B��p�8�)�rdd2GB��(����FO"�� �#j�?[���|j��w���&�L2L;�kG���^��n��Q�?X(e�1O�Z���8�2��#1���Q�W�2k�#v��p.:�oX��%g��{�=�W�M�V�#J}��� vJOM�͕�FXI�zr�bN�c�C "0��| Kѫ0���j��P%س�#���B��4����-fcwO7��5G�ۯQ �0-t�yفj ��E�DJ���Vs������F�Dljg�P���8G��xi������T�����al��N�v����F��-��.f[���~�m�@�]tX��P$f��bih�����.5h'n�Y/�bf��ub�?������ ��+�~��3����サo|<C��(*l+#��T��b��h�D=��)3r�s���n����y&P#I�{�DC�N����ZGz"�|)�$TMA75�Ҹh!Q�|Ee@˰��xGF�z:DƝ��]��aK+5g��`>�d���&]��Z���a�۪����GBu�l����4����xn���X�N��/�.*&�z�i��W�R��� ���=�^L��°��r2����q'�[G0��߬���y��r��J3+n@����m~7�[*ǟQr��Vh��Z&�vtT~H�Dhֻ~�L;�y�������Y�&Ψ��u�x�� v�%=#X�lž֒�M)��X���9�����*�����gM��V��Kg�J�:�Z�3�1��՛B���4kڈ�k�*K@�"�j�n����O�������1[��lVw�O�JJ<�Z�;��r#Up]�t�%�*yc7��}d����B uFP�@w��E������7�f����w�<�w����f�ހ��9���{A�jH��?�e����v�����5@��Z�xN�ϩ�;�U�U�I�e����xƄ��p[��Ee�l��U��id��7���T�n���t\�������+��V��� M�pO�,ފ��ԫ,3������U"?Œ̬Ӎ����'��ci�wB������Цϧt�/���t��K���ӌ&�v��^0�s���g���M��>Z�5��<��sn
General
-
Target
phoenix.exe
-
Size
3.4MB
-
MD5
ee3b4a848f0460221ed88d9591010e6c
-
SHA1
c973d18483dfa596095df4f2bc23cd12cb3b20f2
-
SHA256
0c22aafb185560146e62bc320c1141330295963b6ade1ad6afce2e67fef320d7
-
SHA512
262cde52ff71ef7c0d7af0f625c4d0b6e6d883e7b6d495e1f5d4940ac0bdb181b7a77c23dc6a77d268635b5df20f780628cb8337160ed34b7b9a27442a7c53a8
-
SSDEEP
49152:9Z80tvCyJp3qV1w9+7jLfMeCNlH3IlORAsbkKx8ni5RTrs4vJtnhvE1IzfGE:PvCmFtyL0eeyORAs18nYY49EO/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource phoenix.exe
Files
-
phoenix.exe.exe windows:6 windows x64 arch:x64
a66cb7605b3eba875f00f397b17f9365
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FormatMessageA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
mouse_event
CharUpperBuffW
advapi32
GetTokenInformation
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
ole32
CLSIDFromString
d3dx9_43
D3DXCreateTextureFromFileInMemory
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
normaliz
IdnToAscii
wldap32
ord22
crypt32
CertGetCertificateChain
ws2_32
ntohs
psapi
GetModuleInformation
wininet
InternetCloseHandle
userenv
UnloadUserProfile
imm32
ImmGetContext
xinput1_4
ord4
d3d9
Direct3DCreate9
ntdll
RtlVirtualUnwind
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
oleaut32
SysAllocString
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 887KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ