J)W�S���7����P���joq���{(��p_! �>���4���e��E=�NN�)J+|=��/Z[N�&<��.<��0e �n��Xֲ�G�>�����x�r�_��x8�h�LQ��b�F���Cju�Z���;���U��m�}ȵ�@.��2����o,�g4y�6��QM��%7k�.�d�^�9K�K�3�0F�����v�p���f��L����$��z7�o�uLi�cQ��CF�^� ��Tk�4UJ�#� �B=})�&�=��b���+ ༖�Rj�+(�>��\��X�ҙm����~+�����~��1{�!tM�<��^;sm��s�L;��B͈��U^��'���=���J��܊��rO�qJ���`���8�1�*��BK`u�~��e| ����dlN��NI!�t���P:�x,k'����o�!�ɇM�I�>#���'�g���.���ܸ�Ec����X7��������:�$�tb�A�*T�����/�ЦϺ?�T�L-�ՒkG�`�x1�9̊�����MU���ftr�E4�d�$��+��\�-о Nt8�Y�A��k��l!��r�0��7�z!u� �D_h����=5�7��NG��X��l����05J���H�v�d �H�I�L����.����l�W)�`�1~@7&�E%>�F�j�%�Xv��_�ͷ��zR�$#L��:}�����T�+��!EǙ�����m�����h"tB�+��Ҧf�S�["��k���'��:��)�6"�����t���VH6f�6�'?��:L�\�\� ��Yŀ2�*k���A�1�֙^�!m�đ]�R�At��cX��~��P�ƅ��m|�b�j���f�K :��L�r�X}��qmDe���/��5<�=���h�_���g. � ��mA)*��T�d��)~�V����� ��+˶>�[t��p�:�+T5o�����-9��Cd��$��RgtH$���b����ew��,��O'�qL�s��_�"rG~u#�?�}:�C'pd~�u�,A3�66$Q�M�3��~��J\�͵��˹�s�����WfoJ�=Mi.e�s������n�]�9�L.p���@�����5"e¦�����%_"Ҧ?���2���aĩ<�Ga�B��Ϊ���J�,��b4�b� �QN��96��dJ��EVᴍ<1Ctwz�P�H��i1�*��4wͼ��f�k��,'����3+������������Y-�"VYL/.�HBn;�\Q5 a�F����6� #�bϏl��1.�q���.T�xHq�c�}���)^�Xm����ʟ&oi�z��.�i��z�Q>|7ץ{����Աm���WyR�]����2�3��x�{ִ�ζ��5���,���z;=�������4�����nx����@����`��@R���H[�pܓ��\n�Ԝ���@�f��F�6�! =���>��� E)��~#3�U�ö9�77�\�&6D;��3N���!u�����^P��J,)f�R<�J� ����>�"7(,!WnRn�+ŵ:�!]����>�fa�qYט@�r�ޱ��o���&ʏ�0�U�K4��Ƞ���?�?�Ê@+xu,j`�������<�G��r?�����j��k��%�:�;��>� �͋e���`�~ �S7�(17#��7i��z���B��I����t�b���/|�nN�(�������v6L�;�7��R��?�N�@y@���KS�<�D��7/������ul����|<K��iK�,��d�����)X��ޓg7��{� D�F~�]��ڜe�O�t�Cx V{x���]q��~;����O���9��7f/�g��W{�Ue��U� �b ���:���^�];��j�-*� ������I�� o��i���Z��e#�g_��V��m�fZ��z$ =��l~��G�e$vE��eF���_|�b�˞d?��f݈Ra�/��ra(Q��}h��u��#��s�5ir�])���j�:gB�9�y��`��X��_-�fle�Ϭ))x�<�{$Ґ�����,�6�߂'Ulׄ\��^�ގB����Ù9�x��~P�B�ѐ�5*���cj o��\/��H�o���g�N&���s�ѿ5�^ g��Ʀ:���8L��]oj�H.��L3P~ ʳ��l������B�����&ʦ��Eb�/-�l��ag=߿p1vE�%�,����8Q��~6�"Q�B<"���p��x����,�Սs��{F�8�(��D�<u�ލ��YoFc�r�6�yr��쟦��w 8��e1�-y�&�*�s:� 6�w=#��ü��l���S`j�Id��3Q���S���^���u��t�!S�Y9���ה/�"�vug� Uz��&y��Z F��,wr���0B]d"�ߏ(��%z�k@5Jj��J<[$�mP/)R2������Q����*��'o���q�;:;�m\�Z��q��-��ay' �Hs%�τ����G�����Ϫ���5(O!�ȍ�Km��K����}�SF��"#�����)����mL�y��=MY�UZ�Q�E�T2n���g��0~y�R�@�3ȬdI�,o>&�����MYXJn�� ���������[���Z⋹�ľ�a���۶3��1�~]��3�C�_���Ua$Jz�S!&�Ţe�ʬ�~_�#�����Y���;;|��H�U@bX z=��(��vl^{���AG<��8��8p+4tO3��X��;wA�#'d%ж�������M/�W�˔������^�8P�;ݓiR;�;\r��+n��O>��ȡ5�a�>(d?�I�dK!��`�F]��Fk�:���{�a������'�˹���+{�W{�H*d���XF�E\k�L �H��T�1o���*w���YH�F��S��z�$0���������!�g��t�0t���pF`P?����M�u����A-[E���v8��}I��l�̟>"���S�-������`\0�� vp�G�"PZ_���$�oHZ�?��<�W3ި��Gִ��a��Vr`wW+��Z{��Y�
Behavioral task
behavioral1
Sample
nOcfXxAVeYSB.exe
Resource
win10v2004-20240802-en
General
-
Target
nOcfXxAVeYSB.exe
-
Size
18.5MB
-
MD5
43389521584ab44849150265da019134
-
SHA1
ac943266e07ec621742ce6d8e42bef37f02827df
-
SHA256
eb9be957275d1cd79d392f1b0e0b325b0056ba9d7339b5c0e2f51ab135b8bdbd
-
SHA512
708eb703f82b18cd472ec0e9d4283a3d82f1f580546dbc80e813cc281303cd788af03a459fe11fe500269fb3d95b3800e90259cde14a1b2b500bd3e31464f928
-
SSDEEP
393216:gi/4tsJmeig211dfaUYNoPSjbddsHPdNt2RbsAE4JiR:gi/4tkmV11dfjeoPoqLt2Rwd4
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nOcfXxAVeYSB.exe
Files
-
nOcfXxAVeYSB.exe.exe windows:6 windows x64 arch:x64
2278a975cb46dc4fce45a94431483414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
ws2_32
listen
wldap32
ord200
crypt32
CertOpenStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 18.5MB - Virtual size: 18.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ