�+$!�1��b2�FZ.������A�?'��7:�ʫ muzA �M��z�����LFȄqt맯ѪҞ�< �k�b���N��[m�F���N9�ϩbJ�_�X�%�^��V�J�/����X������y\x7algI.Z� �8%zL�T0�s�0L��:o��pu7�����S�K��9r]�.�w�&�mt���+7I|SĀ '�]��ZG��2h�B����GGD@���,�T1�X�-CB�d�m6~�O���D�*C`�+,�>N��F����K$8N�ezS�6���lj�W)$��5�ն2gN%:��~i<�[�؈�ܑ�GI-�ȿ����4-�س&�]�xv��]�0o���Ы�6M{_�v(B9�Ά�-@� ���Y�z�I�m�ŧ��4Ui��X�S �W�JWMN��g�������:k"��ve�k2v���`�k�e0����7K�|�l7|�F#6���6�S������oK ��r)馲L������-�'�|F�.�#��kWm˄�*>����Z`{>�H}C4H���H�Oc��Hט��nC���=��ӧ�Jd���A�{XMM����� �q�Hλ��Dy����6�EsԵ�?�*g��G�&Y�a��,�u�����q��jmDHoA��nG}p���N �wr5x�����.��ic�`�e�@[-Y��F ���v�*�9���-(iP��W%{_v�����ʙ Bl�ټ�`g0H>�����ƻ ��C�*�{��J0#��$%o��[�@��ŗ�i�,zb�]�IY��M�L;Bn�^D�p}�,��C�^�,)�ʬ�jl�\7����b�U>���|���Viub��Q���l�c�GQ�q���!rT{�����k�v��^7tز͚��1.�j��`r�5�Y�<�8�x�#+�Xo��������2�-4Cq+l{@�:��fdVU����>:=:7|�kD��5i�f<�yD_��BU�g��0��A���*]����� �Y�DX��K�wD�-@�8���]6��+��!g� �3�i�sX������\1���}�Ӈ�m`�N�������Sfrj*���%竤o�[ ��s���g�?U�� �^{.Ai`���{n *N��C��J��J�H$��Sa��b�Z������_6�d7[S�����ej�C�xK�8�7f%��~��k5ө7��@�L�S�^�1��Az�����`�]�nn獒g.��%���5���+�\ɐ�������9���S_����f�BE� fo����x�e�V<z�9����X�zW;��;q����4�&������+��G�4b�.Y!��-jv�Ÿ��e��#�❟�j��]�Ɲ6P��D����6up[]�ů0H��|�5] k;GvӖ�`B�QRoO؎�I~T)b��Z���l#�����:V�csFd)��n^�˱L�C��� ��L�su�?��U��f��=���a9��ߪ��F������9�����) � ����O���w�/G�G!�s~�!�ʈ�tF8�?�z6�����4x�F��ŠMO��Re�`zT}�'P��S� ��ܠ��|�eNG�����!�nt,��³.۲�c�TS��}�]��9%���C���T���c�)&NwI��Ա�X�p�!)�Ԍ�p�uq���V�����Ò4��� @�Y�4�H�}��[���|��%�f`��H�z�� �� ���� �����%�k4��]�hoDUZ/�1��G�T1����P:� �滊+ ���{�J�Zg_�C��U��s���>�#���T��=��r����$j_�6�x<�C�k�1�)@��g�N6��Vf��ҵ���O�r�&{ђ�S: ��P����oZ*v[�rR?5D�� 7UIب9�v��y6�QC�3MV�^�B^F�,et�0<J��O�̤�@��pU?��/9�X��PoBA�j��S���3ev����KY-ee��Z[$� ���I���״��� �`�DC��x9�^Ԍ�bCo�^��N�`"4�D9�A�������]:��Ph0IG�������&��-l�ܵ�Ο⫯��[i���lTr%��2{r8*r�L�-ty���N����V��L��-�����a./1)d-pm�$���LЍ.c�t�n�ݣ� �IG>}i�9M�I��AG��Cr���J�ʕ��*��Է�y��)\&�� ��S�K$��s]��5\���R����6Ԑ�"U��x��zb��Sѩ`S�0kM2Ro�}���$ވ�:q<L�$��7����((���h��ʆ��+�Rz�L���$u�v$2���{׆^؛B�������腁��qz�&X�D��џ[b�e��Yer�<�,Fɮ�%���J�z�M�pI.3o�����m���3s�M`n�1�5=[�D��s�w�^� a-~$�!SP ��2ޗb?\d��N�-3A�=j ?�u�*� �0�f���y���߹�"���p�����@$1��|;��X�'m�Y[5/���4�̈́�t��~��mI�4s)h�_s� ��Ȃ*�A�OGR�"Te���ױ �h���]�ڢ��<�9%r��,Se������Xi�������˱��z� �w}�ՙ3R@A퇊3�ͥ����s����p���M��GA�ܻVG?����x��Zƹ��J�#�Z�������Z��.���E\ ���m6岊U�)c"x��lj���������d�O�~5 @�� �U'Z5��/3Av��m�n]����O W%�f�$͘�����c[$���üF�)O`>�E�A��f����žS#��;18�тh< LѸ�)@^)T1]%C��tngq�͞��u��T����K]��q����q\s���$��'7u���~��y���O,����My��P."z�Pv�Bޑ��V�$*8^����h���)r$����B�a��{:���(aw8�S���ʏ`R�#�^6�\����nj��g�%�3=I�����Px?S,���f�;��"`��>a*��Jg�u��Ӹ(L���i.�f��N�S}�?0����
Behavioral task
behavioral1
Sample
AuraV3Fix.exe
Resource
win10-20240404-en
General
-
Target
AuraV3Fix.exe
-
Size
5.2MB
-
MD5
90f50c0f0a3413f37a6db4de4d1eb5da
-
SHA1
6a79b77babce9e17c9a9ddf15fa56be78e3a613f
-
SHA256
7cbfac568d7a3964c8e34df8c486a405f989f90b43114015de671ef1805103b2
-
SHA512
3c0f9ee17916845bd63ee19e451f7626e90e7feb1024019b8a2c46d6ca07e1cd1b787ae0f90e609061d4cb1f10a5bc7db86fe7cdf5c06e91f97ec59618ef60f8
-
SSDEEP
98304:PJYEgqY8LW/Q/eBVHmS75ybB70yJ4h78xrCH6vm8qIMnimIeRSfR/ewl7M38euno:PJYEgMLWI2tWBJe7/H6O8qIIR6pewSme
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AuraV3Fix.exe
Files
-
AuraV3Fix.exe.exe windows:6 windows x64 arch:x64
27481271b0fb91abf3ef91ae5309af0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
vcruntime140
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 585KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ