�T������☲�1 �9҈������J�s���.��ʻӬ� ���ou��s9�<'F�<���<�B�-s��8*�����O����6�[�MӉ��8�f�B������Q\���=�T���#�Y��7�be���K s�3v�Z4ݕ�.���*�}�_JpgxQ�v�p���~��?��ER��$;"��֜W<<Ɛ$Z�-_䭻������cZT�@��� �ˑl��n���hƪg-�P.[ ��Ć���o���̱�����T�(�Nn�qf�af��U����ߘ��*���~r��=*9�Gѻ����>P<�d�_��Qq���#��p���f3��R�U�w|�f��L��$r>xn��HB��8�����oI��j�Հi��K�Ht|�0���%H��� ��o�r8:zos���(�2ꞙ$S�/���Vx�)���t�}ׅw^�����γK�~b1��X�Ǣ� �"��Lۑp�S��-/�Mk�| ��r�oEO���:@�I��,W:'�r m�Q��l��w;��ZԱ;�Ǩ)v6����͍HO���y1O��H .�U �f�@U�&�0cN-۶߾5m-B���",$���v�5WNjl��j����5��A�� ���s��Ю���fv#�M�"VO��)(å��(�$� BWo�DK����g�k��Y�Θ\>s��r����hݺF�||E���R��pƂ�(Ih0�a�ĸu�.U�?h���.v��p��~=%�YN�y0�g���A�?�C�m�\P�E�B�U^Y�U׀�@Aw$xbM��r����t���%˃��,+�� �G�+�(�yq�'0vR��DR�D ��drG� �!��"���N� h2�(���m]�֍�����Y��_�a]��+��:\��-_ �#�l���8����S�V��rY:0ó�{1�������B���Y�b�n�J����hR��Z�AE�7�M }v�Ӻ��^:y�2� �F�Ig3>�A��H���Q�i6�E+�z���#u+��k�գ��?-m�����84�4�&q�0Һ����c.�tH���d"��oJ��4ٟ��]�j�[r�mB �=A\4��Ԑ�{@�@]�#���L�mܾA�l���ӷ�����7`�p�m��� �J�/��?���8W v����b+O�f��,����� ������Y���1�ԁlcb#q+Ap���:� o�t�E�$��%���=j;EHdN���E9g�� r[\����ݗ���r�9t!���/�,R ;*����4����� m��+#U}b��W�(��b=f��g��9�xثf�]'�0����EQ�u������o�A�-Ulg��T��Rp CrG�8�N��[�ő��ꥎ �;J�:!}G�m�d7 ҟ�0e�B3+c�����g���H�)��*�;TU� ����AX�>io��y/�=�8f�6B0! �÷T�|�&�!ZE@��#�"��yV�x������B(�n�[UI����+�0�I\^J��#��b�Z�xi�4��X���o-�j��t��7�#vv�^?����n9�b^o�_D}|{�q�e���)l���Fn�V����R���iF��ZT�N����)�bVҗ[��PP)�y���ەf�A�9a��e;��_�s�6��8H�)I��"�o%[��U�X2īT�'��M��N�K)uQn�d�`���=����� )�E�}�k!�k�����@��֩4��2J��=�2��"�3Wo+�e4x�#w��'f|����f��h?�@G6��]%2����!gLծ�� �ڴ���"���DrW�]7,�U��ѓ�>5��i���$��oT�$�ww���C�)&%·x�WQ����c�^�����#���&�Z��FP�&u�mۂ@�8D듃m�H�pe�~�'ڿw�O�M7o�E��{��GbL�� ��e�����PJg-E�3ʤ$켣��x��D9�xc��Ƅa�k���dkF������#fD:v#�K�ə�뜄��|��W"~}2t�x����l��Q�@��`]��Aqu8�&yCq{��X���T�(V����{��� ���cF}a�/�)�ۤ���saD�r�`r��d8O�+:��r��@|}f�]�����Q���<�F����I���tl��V�C��8�yD���7m^)����% ��.�_�- �>���f�nC,�j-ta� =���n��@�v�ߍ�,Lpi)ۓ(�1��ж�Q1_b��7��M-Z����S���s5��mN�zt�!B��]�.4O����is�������c��&(��|x� @>k� �{��0� !f��ER����.�Az��d( �3X�>r��#͝� dx��>D�g�g?�b�Iu8��W�cr_���6���ј9�����_�1ĺS��i�R*2Y�K�1烇o6�B�gH�`���B�]���\� ���nc��73p�&jU����'k���t��o'o%_F" V/[��.x�Ѯ���}��B|1�4o�)<��)Z=�y&��<�_ĿIJ��q���L���(��߃�V���(MN�>C��i�^���Ė2g��Z��9NLE��[w���}��ɻ���v�ā� &-���:#t Z����kmh���ٲ�: �m�L�蹕� ꁴt'�FJ.��p�#NϐT��F�g�q�~<�h8��ZTw�-D*Y�YuE���Ky����.2� ?`�m!����Iix5YU�?����"/v<; �Tᣐ�����=n=tHu��Cu���u��(qǾ�閩?}�����������{�g'@}��c����5zy��, G�]��~c��0�?w�L0�"���wl�5��^vw���)�œ%PM#�ݙ1�u�"V�,��j��ܧ�C��r�q�OYɔ�wr�3��D�5��h���D�p�X$J��~��3Ga*~��Vr5��b���ְ�y�\Snb��p~���N8:Ż��,�t2����f���Y��J� /5b���.Q��%d��J3tۑ�",[��wI�}x[O'���c!��-�����a��qaTW3a����b��� �z ��j�ൃ ͊T9K�v�AV���
General
-
Target
ForlornInject.exe
-
Size
11.1MB
-
MD5
3af69b685cd9508c92c467f53b68a781
-
SHA1
ebc7a88be765970fed5c3bfcd8d44b7e01e40c40
-
SHA256
1295733e9a325c9a484886d661271e074ba04117d4679fe6af4dbc1373b50fa5
-
SHA512
d84c1666f34021660b797b57f1798dbb82d6752c64ed3695d32214d5593fac689276fb06fbb55554c4d8f63a320d7c4eb69e77d9493a8ae4551ec1e558782ca3
-
SSDEEP
98304:N+FlElRVS7/o3xhNCvPUg9Ujnlsdjb/jz1bQ0hEC/zumr1IHTST5zKzti7d1jvn:NOEXVS7/o3xhNecsg2HJEpVUgztE1D
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule sample embeds_openssl -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ForlornInject.exe
Files
-
ForlornInject.exe.exe windows:6 windows x64 arch:x64
22f1907af71b391673dc37c47e7cfa75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LockResource
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptDecrypt
ole32
CoCreateGuid
ws2_32
bind
crypt32
CertFreeCertificateContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 78KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fptable Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ