�D�V�}��R�P �17-�*o��6pcfU�- 4Ȟ�m~��s�f'��_ێ�r�h}�)��h��E���5(�*�r��j����j8N��-��{A��Y�pt#���%�R[�d n���m^O�"��w0������?G�7��Ȟ�8��|��KFL��N���G¦��z�>s/$�:z.4��_\�E�%� �����* ƃ K��̝���ͦed)���g¦ڥ�!l{�����g��8� ��h �.�W@n[ϖ�� ���w|(����+nKފ�\����W�����" �C9H�����|;�Ll�����^�����qO0 g�Kq���2�(�@���$ulY��+o�5a<�*3�^T��bݚ�G�Р(�S�NR��z����M���)P�B���N�)��"J��vpu���L싺,�.X\ݥʖ<����p�Y��TH&�E-�snW�يN���xB=k=Z���P�.�9�}0��m�WM��<om p�d�f*�.�i������H����ė�l\)O�{���O�u�ͭ��O�̫W�O�%���3����s��GssD��H..�S0A>��KJ-���ނ��x*4�C=0�Q��U������(��8�<a���â&�C6ի�3��� 4c0�V��gXA�m����+If[������6�R�mk`�^�#I}��G�:�y*��`������.�i//�������y��Ƽ��:o)���o�4i�MK��%��#���B�7ך�ڑ�Z�l�|"��:���)Q��^�V��~B����{(�-��=[�<��Z"�r�^n;�Ց쏤�����n�I8oxg�J_D��Y ���Mٺ����?�<�{�8����������&�l�gh�}fs��#���/���������H���;� ��ն8�Ov��̀ v��J�q�S���@���p�7�'^`5(�O:H� ZQ���'��nZ#SS�B��H���!@"�e�#�j��=��V�j�O�ʝ�uW�4'�y��+s~h�G��e�ͳ�I�����x�������6���JDΰ����mN܌ޚy�^�)��B��]v��dhu\�a >`�vIC���1F>����)���p����a˖v������yԸ͠<�Jhlړ���p��(s"�UbC��E ��,w3�lQ������mk�T�OX�0Jo�%�n���4R*�Lj��Õ��3�0�E��d�v��f�*�1-�ֲ�(� j �n[+Ʀ����:=XT�$�#s��"��H��<2���17��[Or�����=�>H���㷍(��M������a$K �D}�����~+���뺞M�H�x؛.����usɣ��`��j��o�0l�\�j���i`2���hqh��,y��=�bTe������d�f�}�K@)ģ�<����/��M"���y�5=��~ b�j�v�n����xbѿ��ˏ�����*�d��Z'��R���?`��h�>Um��+�a�?�_woN=|Ӈ���~��R����K'������9�e7q�A~5#N?�q1����6H�g�XTb�S�EˋVx7�V��Uɼ!��Dm�-�%�~�����G~B��F��aH�U#:o3 O<��?��Y��Rp@���S;����+��B73���F�(�[�o�9�b�:����-a�RS�V����Ǒ����7-��E�R�q+��d�����-G�SK����4�lVn'��v-ί�F�����`yy�;��f�!��vW��Zy֕� ZֈN��TQomc}�W�&a4�vH �zcs9�b//a����C(E���hW[�.1!��������m����u�OFD�}�,�����t4-#1���K�Z^iW)E҂%�@Q���ӱ� ����L;�/^�K1�������-tH�1�L����I�w�k�%E�ܹ���{j┢�Dy�HIEѱ?�K�hH�W���n\���UF[i��U��$�ws�4/���S_L�y����G�M�!�Y���;�{�n�����]s���;�y#��z���#t���\)�D!Br.����fn���-. )�J4�U�<��/�?�_�r�*%�I!�!`xkX�ߜ��O���qт^ `�CW��8 ��Z7e0�s��1���� �2���<O�**c�YjS�7ڶ�45*�I$bA��B�C�јf�kh�6Y����v�����r�i������?��� e1��:����P`��I��/'#p96C�?�������T���1ٺG���%f7��3$�>Z����Bf!״.�̪�uڳC۰8��E�ST��� �A�Z� zT���2������$����Hm�o�O�bj���� ���b�#u�p�Ezk1~Q��~Τ-���d�>�0�ѫ@Ɵ�o>JTO��Բ��'����EF�vu*s�����I��g�����e�/�;�qj����?�����Dr���y�kDV1���#�l\��[lp6������c}�V�L<2d��4��Y��k+��/4��i�m��B�hk�<a�9wH�ѺNj�r;�;W�ϖ������13hJJ��g�wf9ٲ��D�3�XaۺM��Tn���=�_�˟�����^����;��撈�*���6cNB�A��%�i�cYY]l���K�I!�àV�b���kwj B��w�'�FD�+X��[>0�tT���Kf��dx����mL���������;�L���|Ј_K:�z�Z�{/���o����L��H��շ��^�6<�*8p ƴ���e���&����}SWwΘ�iR_W�G7�m��e{E-�e�[죴�}�z/�N����߾���ecq�i���'���1�1�Yٷl�_= C�c��F硵&:J ��f��%K����!�sF�?�y#��$,�A�NL-���o}~� Z���r�!]��t��3��!�:Ig����x�v4����t �>Nv�4���_S��X�� ��LJb�C�@E91��D�����xz�qs��6��:iv]2�B��Aµ��,�� ���S�錨������_�@��x�JA���X�g&�u�Q�c
Behavioral task
behavioral1
Sample
qBKzZAVPxPzJ.exe
Resource
win10v2004-20240802-en
General
-
Target
qBKzZAVPxPzJ.exe
-
Size
18.2MB
-
MD5
93ee68b6fc2abb5bb69c07f1dba84d2d
-
SHA1
eb4c3528da1a59c86471527bba74b18832d4ac15
-
SHA256
d353207de511cd00ae2550378c6865b3a45a0a0867d5bd18a554a67fd214f01d
-
SHA512
84711f23243d85669c9fbde7fde001229a50c88a050737a27fd764b4860cbccfffadc59db623b48cb496654c58a45c918c2caafb56d4c359cd76ecc8025e7023
-
SSDEEP
393216:WCORMomBpl9/cWoR0ZwbWx0S89q2QKUJXFUcBZ4Ow2X8m:WCOBAD9/cWo+jloQ1fHMm
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qBKzZAVPxPzJ.exe
Files
-
qBKzZAVPxPzJ.exe.exe windows:6 windows x64 arch:x64
2278a975cb46dc4fce45a94431483414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
ws2_32
listen
wldap32
ord200
crypt32
CertOpenStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 18.2MB - Virtual size: 18.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ