���h���ZPj)� lQ�35�C� 8P�_Cqq� ��03�7�]�%�i��%$H;<��B��N,��V��i�4�O��>�y��!����q���Qa��a�t/P��h���ƪ=i���p�<J *�<�;��H���-_�5yж��t7κ%�_]�1��+k��"ᐇj���BY��pM�Pvɗ����E)*n���������o���/����zk���:#8�,3�~ �>�v4`��#�}�&okƵ�{Vp�r��b�I��fY�P��`VÒ��6V���D{��i��]\j]���M_��� ʄⴋ'��Sҿ�<@6}n��Cі;R3@dϛ�3,.^kk%�W|7�Y{����\O5ʻ�����8f���i6���e�I���.j>��&ӻ���?���(��=E�Z�H���b�{%Ifo �Gq�����^63g�� ����W�[L\������d�?�Kq#�A�q�5a~��x��pVn�8�6�#74� ��\�ҙ�6����&��D}%2���K��uk�$z�;�Ȥ�-܂� �?�=�\7���/%<�5�>>�2a@�D�s��-�y�_��}�0���r��8ܷ�%��2�A�`p2v���BY��h��ȟem��[pGƪ��WbY��P'�d�����Y!X�~[\JQ�E!�r�r[q�9G�f3��6(���R�bag1_a��*q9C���Ӷ�ն� ��X�W����xiztb�ʍl�n�_�{������������kK�8Xvo�`g��̚u��I�<`������?�������&y���×�7G����a 1ue�0��C�qN��=�K��1��d�(fO�Y<�hنS�&�X| �?�$&'t����8N�#���T®a]�R��Z��m���I��n�?ˡ��Qy�����z:�ɚYV�w<�&W#�.(�H�-���'�Hjgp��TW�6D��ZP�F�$,��G8�Li���6������!��=W��c���5��ܞI�9[�Y�'����ةڮ��;���s'c�a �fc������"�ߵd��q�y�K��ނ��<aY8�Xw�R��j�#H������t7�b6��Xge2jZ��p8�C~�� ;�����l���h��r�n��ɡ�O?>���d��RE��;�)������q��0g�Gw�b��͉����+|h�-97|ɯܣ`�@��k��!S��>�|W���7<w���3��f�P�[���+������S~}M���!����K���i,�ȶ�6�_�Y�89p)��l�1�2�����wS=���bX�T��Z6�]������ٸ��XvP4��z"�xECt7HP�B�R����p?="�2o��%T�i�5[O�jp�A��`9b�@�>-9&���/:��:P�lc�ߟ}��nh �xc��r�K�W$^��˟��w�X�7kt��q.I�C�� �����+;���G��nM���Lx�����C�3I �9�\�!\<�NX�4�,��m٫~��'�ŭ���8+�eC#����&i�U�G�$��#NX�(5�IMA�`�v��\(�����k.��B�S6m���9�uK):zF=?}]PZyoC)�E*j�;B3����Қ�*��;`���p�ڟ�� hfQ٫a�Ҩb����&�����B��,�+��R��y�P%���� ��'����փ�6�^���~Θ�����~�X���ݷ���t��� x�2:��W����%\c`��Y���X&�2p7o��(� �5��M� �C���K"��������e��K�權G��;�����@8.������r��4��?ƙ(��T���F�D�� ա���:`U��w��U]ґ���};xz��8�3{W�!��ο�k �ڧ�O¾�~�|,���^H�X�G���أ�b�o!���X��A;��^��><������O/�������7t�o;g� �P�#�R�i!���z�uw�2��8�D'�F�2�y�Ɨ�Mn8o�"�l��|d��A�a��/Q�Ľ]l fJ��dP�6��S��,���j������о�pN�� P�^�K�ʸ*v���Eigt1>sv�D{Ō��M�Jϳ��%Y��Mn��q|��O��%6R5�!IByJ�0�p�ɾ�*�W۱��T�>8�'�&E�<ׄu�|oNFDho����v������Ry� - P$C�9��c䟏yj@y�d�ڈ&8b�{��Z�|��t� 2$H�E��&H�*BZ�˰�4�)L�`��4Q4�k��zj���<I.MX ��Y[e�Q n(�N:�9X�����ڂ�rL�{�� �G,�<�����y���z�����b��y3H��H�\��Xt�8�2@$�Kj��>�G� �����!�����(W���R��۽�� �衶7�I��@�Y�ݢ����p�������E�~zK��X���U��G��Tߒ�}��j��(�������>���t����!�O<IC������;���S�gB6C?���f��o��K�����Pp��H^,����J6�^��"d熈��_P�;�� Q�������M���`T�B����QV����H(T��ޣ����g�N��q�k��LO�A�U5��z��qa�p��Gh[��B�.���ꎵ�fU��ļ�>2� B�s�q?g��o�O�K����=B�c4��{�!�A�����݂>l_pLQ�-��S2��<W8J�"�0���������kٮK6S�b�g�1��4>��V L=����K�|8!4sc�����9�������i�|�a<7�h�,ia��кHp9F����ǝ~e�[Y�_i�[[}c�D��es�Kϛ��}������<�HT�&VH%���b�2Z�֞G_�7����W:�J��%���(Xq5��Pc,JRhG���kvB��1�6�U�q�$�`�|�"� k���[ݨOUE���7�|ՠ�ʞ� Z��S��ׅ=,+Y���1�?��ߨb��W?��m� ��W�"d�����O�����,��O��=���ɷ������ƱZ�'��
Behavioral task
behavioral1
Sample
cidia3_1 (1).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cidia3_1 (1).exe
Resource
win10v2004-20240802-en
General
-
Target
cidia3_1 (1).exe
-
Size
9.5MB
-
MD5
a93670cfe0da8d2334dbccfbf2a9b4ae
-
SHA1
b3a0b71399d26d617d029eea3347274a3dcd88c2
-
SHA256
69a1bbfc3ef92a91279b60091dec5eba3c5d2eb421a67030a4aed2c57b473341
-
SHA512
03e2a8dcbdaa592d920c7a230c1ada8a7a9da66763f4cdf1f002061a6d2b386110217ba34d2581179b721e4db4a5908527e5150f0f73a3e141825546a2c434ea
-
SSDEEP
196608:9AULM+EOF2Buc/HuvZ3DDgpCK8CQ0KQ5oqe35qMDhHexMl/5GQETANvyEj:9jM+PF7c/OZa633ze+l/5G/Tqy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cidia3_1 (1).exe
Files
-
cidia3_1 (1).exe.exe windows:6 windows x64 arch:x64
06c18b193378770555f04e3db3fa87e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
IsValidSid
shell32
ShellExecuteW
d3dx11_43
D3DX11CreateShaderResourceViewFromFileW
imm32
ImmSetCompositionWindow
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
WSACleanup
userenv
UnloadUserProfile
wininet
InternetOpenA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 636KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 863KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ