*�Zt.��}���$@ÐG*�r5�7�I��"{*�ar��a<|:Z%R �gBXRSGi�W�-Ô�~�^�d��{YN ����il��zPo��<丳���L-���u)T4���2�� ߊ���a�8�����S�e�=�(�� .�c����mߏӰ��"�͠\&���k��T��T� ��#��}\� q��� ��j х6��ݍHX[��_�W.�a|� ��a�H}D_n���R���{gJ�- f�7�1x^�'Y��J:�� �� �F���.�s�n�1��!����k|�~�TPR��9]Z��������$^Fd�X�����Km�Q��u����h ����𠶽nP�hɝrk�ɱYOT�È�����C�AN[���#Uߜc���������0����?Xj�-��g���Q���[�/`�~x1����"k��=�YŴfH-�a�`M���A�0�4³4�����X�1�� Nwj9 U��8v�Հ7��r4p�i�����8T��% ���jdC�H����@�����?U������� ���2�8_�g+p�$@ P����+��݁������ofw{?�X�9�4�Z�fT�)`C��t)BNr�WS�Ppb���q�m�_����I�kCW�$v0B�N�����/���O6�7��Ӗ����䂳=X���ʾ$��PV8d�W��������J�#�W�[��h� ����h��p���6g���ȏ%t�0I��Z@Uq�Tՠ$?KS-7������%EgZ��"�l�����:�kF.[�u�l��'S�.�����bP�?Je�;X�kvY��^Ջ@�<�����&ߡpak�����7��&���Ru��o6t�� ���/����C�3���=3 OhG�-˾3�uɺ/��Pf�Ml�b���f��2֮������[�\�a2��Y�=G�.,"?h9�����^8� �y�{��k���89�+;�h_5�G�*�N[�ww�MG+� Ղ�a�Y3CS��؈x����S���#�%�CQ���&,�p2ߘ���tFfv1�x#�Z��PP�����o���R��!�u�=֕���Sv��s���f}Q��<�Q� �)w��˞������{�4=�hr�ѦI��������� ���F�N2"yQ���|r���H�Ҝ���-Aﮬ�0Tm��l~�"��T����Pk���+m$*u�ج����p�������N�E=��PZ���p!L��\�+������e`�7���W�`�f��e�����]�C�/;���E�S,M+$�>��BJc��*��B�%3s�Z,�|�"��Ȇ��B�r�,��u5Y����b�RI���s����5�������<��ɖ �Md�Pϴ��G��N���S?��7ܳlE2����VVYJ/��G�m����%y ���R��i�$����{MsKF_�$M�;p��]�<� !����M/��ǎ�%}�.�c��|��K�Ք�\w�����qW;Ҿ����`/��Vk�����mk�i�� k�zԊ�Pvj)�|)����Ĭv;]U�ZDD�蜱1�!<�y������T�˶::��"�����1����*�b�d��V�1V6� �%�WLy�̭?�pй� g V��W(�:1�ݽ߲�/�U��j�Z����Px����-Y"�������p�D�'�;�;�,'�� VyaIj���a�����}|S�,O��H�t9b.��2�OCQ��ݭlhC,��dz�tHA��ö��+�ւ)�kޮ�c� ]ߧ���~{��)�2�z�<���t%��/Wb�f�Sid��$E�'�����2h�����\��o�M&sR�����YG���',���aO�l���c�U]�V3^<մ��,�-���X%DZy�����i�M�+�~�D9pM34�j��=_Cm (#��d�C�n@���?����`��ǽV4��������qf:m���I��Gw{�ؖ�8���y�H��? ���e�"����"\a�ph���S���/�/����5{B=eN����Qc0'����� ����W���K��KԠ�����N�<M�8����N���8�wwwPR��E8+IH����/��B�8Kw������ZRG1�~�; )�b�^C㰨��:�vk�`� �ʊ�T�7v�� =�NV �?�b��s�nI�e�b@a1EUݽ��֙��G1��Ƶ�3�/��H�p�ᔗ��To��n|�)ա�N�ޛ$�������̪����~ވ#�f�QN̑��V���7�F��&�������O��[*��c�2�Bv�,2�::�س�KǨ�������������q��Q�=�[ AK�H�2� ��VN��%e��0��V��lW|��.ro�-u"��o+9H��������f�DP+������ �� �s������'td�0��w�G�7k�m ��������$~�c �3��(1�뚌+Y�>������@��ޔ(�E!�G\��%��5���Cf����s�Y/,����(�_�0���9 �m��]d�'�,r;��)��H r���DeI�Pۗ�����º���m�� ��L=H�Zi��Rlt�ݺ��\,->Z=9�K=r+�s4 �m��X�,TVM3�<���Z��f��P�F��M�؇o�^���LZH(o|���� �v+����dž�-28�Mb2�P~u�B�NJc"�-(��sTme�b�;Q�C{%��D�]Y��P xӝ�hжX��?�[�2�;J��OI�m.ro?S�Z�1�H}������*eZ�.��g[��hb�1ν��)=�eS�b�xᔰ���|��=����xe�=��$|E%��$;$.�g �:IP��'����9M� O����4T�aϒ(f#n��Ϗ���CÖ3�@3��f�Ҏ0�F�%�# �BW�����h쥨ն�s+ ��Z_'���y��S������?Kf��ypH���K �S��g���7�m�h3[t9�Q�oW��W0�&�k�|]l���5���O$O,ڛ�R��a.�
General
-
Target
UIUpdatedV2.exe
-
Size
5.9MB
-
MD5
412026a99a9fa3ca8c4a19f54f391b42
-
SHA1
04bfde78a3bb63189690ba749067f922eac796a2
-
SHA256
eabe486b2b490b55cd1b5ad320470783c3c5957efcac4eddfe3bf99412b5f6fc
-
SHA512
e73634498442336390fa7ee6cad318a5abcfbc7888e45e63014c418940e9d0b1e54d29fe4a3a5f94fccc1ad07390d1e2800eac0744186bb0d91d937923288616
-
SSDEEP
98304:lFGkLDVMl/FVcxsWl5a0gl07utiggiPx+X/AJfXgwg49ktz5NiEcg:lckLDVM+5l5aRhtZ5+IJYwgPzfX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource UIUpdatedV2.exe
Files
-
UIUpdatedV2.exe.exe windows:6 windows x64 arch:x64
4a69d07a3f0fd6cc9d36389eb5497d95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForMultipleObjects
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
wininet
InternetReadFile
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertFreeCertificateChain
ws2_32
ntohs
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 432KB - Virtual size: 432KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ