�2 ���cv�/����{eUׄ�O����1���6��m�6{%��߰�� ����7oE��� �(���� �帰w�/���t�C4*r>�n���Y��v�WHD�ʥ�� Y��VP}�x5SK7B!d��`$����ǐ����-#��`]�_��I��)�U឴f�Z���������ֶ���}��`�B���F�� t�߰�\����7i./c���g֞�:�CS#x�8�&~��oPk��~��,V�R��RT��.���Q"���Vb�|��|=���ZWAK!+yn^@�� Ϲ:A�r�d\�T��1�V�@��� ne����!^��!]��輥�3�� [�Q���XIi���88��:���V���>=�C�� ���<i}���v��/lk�=c ��ݏ߮^ޕ�Pu+�9�]5�@ك�5Aq����1 �.|=0O��O ��� �Y��Q+�m��;�Ak+>�@w��:\phܧ[�l�������_����N~)�eK�Y���ޔj ӎ �D��F ���fF��Z��4�2ԝq^�bм"���E ��&����Z��KX�+���.������[A�=�q����<*$t��C�sc�������+>W�W�����i�8�m���)�y6�G��v�Sو��HN�/t��^��{��5�8X-`�QEr� ���] � �ܭ�4PѦK./�������pxL�^���%�#{H�[�F����^��<������ �+�7�t��<9�S>�l���Ա*kؔKQ�PØUAW�'01�X���� oC��St3���d�q:���֜�c�W��ڊ�I�%�l�1��f���c&,�DCzi���4r�&�%���?Ol-�f�Ʒۮ�(����t�f�!d'i'!U����K����i^@Ä���ZW`�.BQ�U؇���6���, ����[VԆ:!��g����;�=�=���|B[n�lK�j9 ��x��Eq[,")̅L�C�&3O��6��P����r��x� �) m4��7����l��G��i qH�������쏏I����,@���>Ɓ��E[m�[.o������#{� r�*���D?��)�z~#��C�=�9��m�F���^$���Iʠ�Γ����f�7�t��Z,Zsҫc9��ĸ�v�QeX�Ȯlƣ����F3��j�*ۤ\�㸣%��B�}Rދ�p�'�"ڦp�[�e���j����"����V�ݢÝ��dd�f��f��y��[��v�?� �g��P���I ��]�v9������x�p*Й#���è&�eQ�3]ԓ�+�eIe�4��TûPp����QI���ڍ�G��쎕�D��a��D�m�u@�ĺ�-W�"�;�%g� �XH�[�����<�U��İ�p��C��w����D�RJ��"�Gc���YT'G���d���~g�Z��JC�^��vUT�{C�����ƵR'�g����P�ryԘ���U~~6��X�q�^uq�o�P�C�����6OK�o�ԡ��ƪG��ǯ������7�{�`��n��Ae BY�'P`RGo�kb��Ҡ��!�R�}Kͱ�������䝞?�5t�p�G�Hc���SX$����ݾ'�ֹ�s�P��(���ZY�n#�#�rG���H�$�Y&���������N������@�8�z��j�8e�T��(�<oRT! '��#I����i?j�����P\-�7��������6L��)��Њ�m6�f��r�D+.'��4�T��6�E��F�M���c�:��<���!������� u,1�D��"deAE5���yRoU�fC��LJ���q7f�)^�&- �!x�]yWہ��6��T+_&�X�C�+!L��lLz�%�>����fP/p�6�}�0O>��'ѥ����Oc��g�3�`EJ��e��wu�;u��3��Ø�'����A���Į6[ɂ<�C����r*��� ���6]ι��w4�Nnj���<������+1��Kڝ=��MWcz�[�7J�s�Y6l�Q��}�r"l��'���ŕ��9�p�����^� OM�A�C���'jO���;��jK��.��h,��#Ac�\�c>m�7��� y�5���r�wn]U$99�!������JMm@S<���� �wix40�7rc���s�ܘMD?���X\��_�T���r��v���O�4���??i�\�S����>�Mi�&o�[Z�B��b��j@9��� [B�"�ClO�|�t2X���*�ȃ����i��9�B�G;��\䰕s�#=j���q�W�\��ȧ;b"���y}�W�o�:7��H,� �Yцř��ŲG�dѠ�n|Vʊ*���W���Q����O%,���N�4�>*j��l� ���P�QD�t�!(�V�z���)���b7�e�Eh��4���"n� ̕��)TQ�yם<��&��w�E"�B�(pc�D虝�!اD�GP�����w�E;�#%�v���1����6mN� �2���P���G�Q|83RIUr�P�t���}jxY;He������ T����A��C�IοvI�.<Ԅ{�+5�c2����� `�bۂ�l�o�.;�f��0*��_v�_���5.�����I�n00�X�0��N��F���c�l��FN���2E��B�~��cz���Dr����~8ڊ�~̖�.0*�H�-n+��`�d�P���<g��r ���?O���U^*�M�Q;�QD�ł�-�������8C^�Z_b���M}���r��e���������U��}0��Z({p�S�X1J���IO���U}��aW����ڪ��:�=��a�`K�o�ɟX���WF_�!��[X%���T��qa�}�������,�|6nm�}7A�����q(�왌X��_��� �����2�\��q�,L�n�]*��F�Hb�����WG����xU %r eޯ]���K�)���d�����bs\{������H���+\�j�#U[�+tAǩ�z̅ǡSɦ��\���P���*딶���\���xM^�X:"CK�Aj
Behavioral task
behavioral1
Sample
blizzard.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
blizzard.exe
Resource
win10v2004-20241007-en
General
-
Target
blizzard.exe
-
Size
6.0MB
-
MD5
cad743bd390442b5f0441040b8365701
-
SHA1
7e9f7f6b22b7f61db6d27749a70a20da7bcb3c11
-
SHA256
abc7a785ed99a36981149b6627baab42e248e0f4f04ab2338dae004cc5767af9
-
SHA512
13ee634c2c2d252d3899937c6b8ac617d009e4808f4c1b499eb0ab743e1f7b5f069639574a81a82058c41a8c59f8c560e6656ad38c9166c49543e9653b34ce9d
-
SSDEEP
98304:v0zv2yB3mrin98C9Dm6+F7E48TnbNLraDIle8cKDMC9LnW5Vl1/2:czvD9mriSkDZ148TnbN0s39a5Vl1/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource blizzard.exe
Files
-
blizzard.exe.exe windows:6 windows x64 arch:x64
50f3a2dc61ee797cd9021b001a9ae9cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFirmwareType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadIconA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExA
shell32
ShellExecuteExA
msvcp140
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
concrt140
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
crypt32
CertVerifyCertificateChainPolicy
bcrypt
BCryptGetProperty
winhttp
WinHttpCloseHandle
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-string-l1-1-0
isxdigit
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 845KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 446KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ