�`�~u��a��Ic1�����r�@<�qC�S�r����W�UWôP� qDx�h���Ck`����Κ�8�[��Q��j��%�8���e�.<�n��\|�2����TUn���L`�p�dUy�*�rҖ���##,.���|O��FfJ�X�]��b�T5 ��+�7�G��*۪�G:tL%Z�J���|��d���k�Y�h�5���Xadg;nRC��aw��\R��H�Aoc+CQyP�_ �۩���*�Wbn���6��4�]b��")cca�%�����*�g�M���D���ɉ�WX��gkf�r6 6eץ�T�CCQ$|�1�݇�P������F����-�xhI�����4Qu0����ś�wӾ�(�y6��ӗ���X�!�ߙ8�Kzs��!|o(5qAi��E�/A>9�좟�U��6lp�%�Q?B�Hvr!;�Ζ�M#��BDj{��"F���^�cԖ����v>��m�-���#.�^�}Y)��|�b곑�d� ޙ�һ��(�T��9s�u.�����}�c�D9%t����^A8����BJC�@`ۏ駛�(K���z�x}��W0�\�;��~�oV�0̟xZ���������|D9u0�3e��� �Zʣ������5�WdE3�)`�sx�4Nj�b�94b�ѩ�|"b�XHD_����>n'���^p�ڲ���@�A(��C�p��=߰A1���&!z�_ֿ���>6>�J-,�)�M��9�m�+��c)A�06w��]�nE���[���~�'0��Թ%!�'m���б�ԝ�?|O���'~H~�[� 4���� rn�Y�$�AB/���f�ī��f��6G����|�&���?��_���7=Jo�m��L��Yv�HG��? ňB�*b��cq��Ng���O3�f!`O�v;�6=C H��БS�Gt�|��g4�meh��d���̲1H6�V���e����������I>�.� ���X�>����<��m���<�*82�s�sKdd=>�U���[��*R9U��9��X�T�g�]��bM`D�M&L�X'6���W�,���I���sPĴ�JF���r�� E.l����%B�;aFK�[���e�+ǝ���"�6�$�y5�JA��.��B�%$z�ʆ���E�n�V�Y;��ɴ}Ҡ刔ދ����@N��W"յ��Xx�C�x61#c_�*��T�[��O��6�̎�<`7�du� ֘�>������i[�R�7l3{����\�?�����˟��Vc8�p��mN����D �7B��iZK4�����&����~Ŵ|���]��_" ��M!���u��&"{B��n���}���3>lA��2?;���ʸ�����N�O�p��|�\.��5bj�7Tu;q�Ƌ�5��{0aw��<�����PfV1-��0�e6��+��D��szD������d���_����u%����d�s-a�.�Gߛ4B�&��a�6��v�� Y�K`uӳ� m���K��x����Y$�#���6�6\6ӗe�}2>�� �� $��PP����IeJ�v��7P�qr��5��L`�R�F=bDz`&Fc[��P�� k Ә��c4ʡqfwY�� n˥_�,kd$|��&k$&��+��nщa<�����&0yS�Se�����F����%W�� "�,%�/u�>� (t���-��=9��)h.�!q����C��5C�r��w�������S������c�����K�����E��̥�q����p7"����}�D>�(�26I�0-�a0������ K�}EB����q���ij��X���I� �i�S��_:���$�I�kD[���a���?`W'���"���^�� &*��.�����%ey���;�679��5�ո����������,�b�iV}uQ��i�Z��}��me���t���aXY{qh��:7�����yҡ���� ��]�H�ӌ��q<����h�g�X�Wo�)h�G �9v�,|���KOan��Z����R�"��_�C� �O�H�k�]e�X����srR(�����)�B�,hlMg�� �/-������x^���j�r�p�=���C�kV��t#���^���m� s��᯽��@�0��G�g7t���|�����h\EɑLzH�+�wܭ����A��1a �,k��K�=���b��*�5�i*�=?��hhO,�v�5�fh�d��w�ām�W������f��V��XZg�u����=߃�����Fk ��Ӎ���5� �`��.�E�� ���⮁�$�G!zk��X���ң���x��*����I��_�"_���*x�g�J��η_��[��Jú�*� o���...���a��*�p��[��kI �����,���V7���������b�k�N�Xr�!ϗS���|��B�% B9�ް��/���zu����00.+77AJEA��*�>�j�cp�����c��9�%�.t:���*!���( *��}=�S�)Z�*v��>�iL���v�_;_����!��{4%�����o� ��U,��I��?��PIWރ6���B @��:K]s,�+2_p�r�=Ш&����� ��wHo���1Dؘ���f��$0Q�e��MA�,7�;������N�)�������a�"�`��I�)},c�vw"������d�:� �p������4���~�ω �n�tشR(ߎ��If>�Qg�apG�ȅ����}]�z��y�Q�e�2K���w�>�W�UTi?����ƃXL��bP�aJ`��2+�1�Z�u�M�H���@�AE粴Rc���!Z� ��0�Y# �<J,�j�,+r1c���X�=ĕ¥"QDd��!$��#K�7�A�o��L��ry��m��2�AؠM������o�d�lWm�@c)�9u�$����ԅ+���x�^�B� 2�����Զ������;��Ym���Z��;��-�"7`�W3< ��k��|��M���&����Vr��\s��c߬"RP�e ̿�qi=��8� ��Q�^,D��spP�!d����HX��\�
Behavioral task
behavioral1
Sample
WfiqRWPwIvUd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WfiqRWPwIvUd.exe
Resource
win10v2004-20240802-en
General
-
Target
WfiqRWPwIvUd.exe
-
Size
20.9MB
-
MD5
dbb09baec730b783c59842156203a9d8
-
SHA1
cc03a7540ead7c037c99589ad3d4be1d185bb7cf
-
SHA256
6dc30d612fc1a0103901ca81ec520b26254e8e87ea3971b6d9b9f8f4c3db9567
-
SHA512
874ea006eb5c1526c55c596042e8e5c0ece190922a8ad97aefa0d1f0dac7f776c357fc1fc938e390e1a597ca29d2b9f80f0aeccc9375c622b4177761361b197a
-
SSDEEP
393216:4E5myezEFzpUisLMluBbN/8kLMvwbtnWANIMraDcX3hnOcw+UAcrjYrA:46sAm9LMmxU3oZxNIanhnOceWA
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WfiqRWPwIvUd.exe
Files
-
WfiqRWPwIvUd.exe.exe windows:6 windows x64 arch:x64
2278a975cb46dc4fce45a94431483414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
ws2_32
listen
wldap32
ord200
crypt32
CertOpenStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 20.9MB - Virtual size: 20.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ