q��Z�"��sG���R���a_S ���W cm����yX T��J��s���3�-C��p�_<���Sߍ}|A��o�"�i�NҤ��jk)�\����g���s�BSz�h�YS�Њ*��o�`� �G]~,+.�Y�y�cB<���0�Ņޢ뿞f���&g����T�}�����t��VO�}� ���v0�^��9U\ �?�Z��L�U ��Ny����$2>;�K_O4��g<�UW5�̭X�v(ߗ��sVǪ�y���aL���8��)ȳ&�X��1uP<Z�\��q�%ΰ�������5�a�O�j�C?�ſ��H)]�>h�р�neB*Q �m��i1�J1�gE �z��6���O" �T��`�!BpT,5���j����=6���!*{g}!OX2���gkV�O�P�c��D4M+0�q�,��@w�ڳ��[VW��n��v����^�y�i�h.k}w����upʃ���< ����%��QQ{Jvd���G��o�r�9k������&ԭ͗_�u�U#�ْ��_9���ᆺ|�w�SG��X�z�2��hcd^�&g�3�s,QN�7��� ���{�����Ҁ����ߩ��H�q�'h��b��|lx�=�'Xg���\E�ѿ�4͢+�n���@� �\�@*'^���� z/&9�k!u9O!}��9ͫ��qt�gOQb;|_�����M����L�,����Ҳr�W��ڔ�iܢ�ȃK���,]���z�(�h�f�����C��Ӛ�=��W�hz�T/K�� &�"5��j��1��SSm��|*��ux�?O������uIK��K$��%M�Z-&ϼ�eO.���]��7@ղ�)H&� |�ۧ���o�SYT�癪���#k-�'�i��H�pѡc���|V�c5�2��>�c�E�i�}T��ӎ�WB��0#�pS�!jS��ɡx���V��ۚ�r"6`��$�M�fB�t;;����/���5v���9���������NT Ro5K�l_�o�����Wқ�QŅ)ڟ�\�\����RN���a�B6��c}o�}�����O���(|p���+���t)Y+��"0u t(��om�Q�+\qYx�� �`��2aaq�}�iִb��e���i��q�����[N�=�b���1:��(���d��X~�0�5��~,�>���> ���������F�H\P�b�$|<q���)ka���tm��'���R��3l��x� Eqp����i즕��:=����+�� X�k�JYv�1Ȳ������;�6����д��F��?ۡ?�S)�M���9bO�n�/�u�囧���i&��*�{&���_Ջe7m��1���2��f��g���P�Je�jR<$��|6u*���Ja*@�?�~�LZ����f ۄK��n���B.�8d!����/r:�Ȁ˽0�z} ���;S��ن��'�R�:�,�VT����4��w�k����]� �@h�1�LV<����$r4˪����SE��y� X���Q��.�R�JZu�3TD�� �jn[q9�#ʇK���p �R��� pp��k�~�>� �wPL`�0�� x��ԓ�BhQ /<z�� �^*��`�u�S3��?-�O�A���3��H8J.yJ��8P���k�B��Wݾ^?[��_�yC��y<h*^��J���B��,v0�EC�ï{�zV�Z�O<J?6������D.�73�v~C�E� �Yhk����]y��o����2���T�!��́��N��h?���8\R|���jM�pN�W���0�`���h%�:���O�����9A��=�h��I��ˠ����z�2�����(^�ISw��dž���=ْڱ!���������Zz7��� Tz L�߸�h���w~���e�(�� `��T�L���»�y�T|ۺm����'�O�9��AIT���ҕ�����la�䴕��ŏ�����K�Jp��ś�x�@�5�ɣ���ϼ���,�� �\k�� ���zK��.���������ǂ�ܜ .iGU%,�a��!�@w[��Q.��η�7���� ����А]~|��M�/g8���DCR��3� �r�]�D|��I���s�9���>�\�d�u/��sǍyde�N*��A��G�9�* &�|]�b�rzf �3�lg�����;[����C�\]m��*N��GO|���GW�a�(iY�q�3��?�Zm�c*�\R5�����P͚��h�I�;�Lg�������J��c�����'�x=Q��¼���t���&��Oka�=k��kS ���ݽ�ƌ_��n�uAzl`�(�K6��שOQ����� >�h���Q]]�o������6-%�����*�*�pJH��pgL�H�'Y��W��O�oUH�ar��7�1��s3N6:�0<A͜\�@�Ѹh��LGp�ah���Xxk̍���h�qc���S_���,��q�T�{rM@��8���F��`�����8"�5�o!�{g��Z�鄗q}�\�&I��tl�k����n-1h&3�W@���E��t�g����,�f5E��@b���y6jW�O5$���'㚌�Ӂ4�����<F�b�֞�KG���������#Oyh؟�Dp`���2�Dla�z�(��JCb7�?���hɜ�m4�Z�T�C&�S،�4��I�S%�ɰ�_b�R��?J��;�b�ߖ�� ���^m��b��d��t��9�n��Cr?<����� ���� W���J+���iW��,�� D%V~&é�$w������(��1��W������6�5���y'�AO*��W���Iz�~�oC��T_�����+mqv����݈WDZ��5��,��0�e�ᛒ�>M�o����l~;�� ��}l�0A�d��^X,W">I���2�.}���%'���X�xȥ������m�G��9vrt\��5\�$��<Q��QcE�Fwa�.�6��Z4T2� ���ߞ����)d�혴��ʇ�#>��f~�:+)Ca� ��L�?�`P���O}]�R��)xTꢆ�{v�X2�Ť�2 �YMJ�7uO�� ��S
Behavioral task
behavioral1
Sample
Strimage.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Strimage.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Strimage_SRC/frmStarField.vbs
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Strimage_SRC/frmStarField.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Strimage_SRC/mm2.vbs
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Strimage_SRC/mm2.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
delmm2.exe
Resource
win7-20240903-en
General
-
Target
Strimage.zip
-
Size
580KB
-
MD5
4766969f15e6d035712a7656224aff5d
-
SHA1
0720e45264103c8d1de13b36d78213b6f94adddd
-
SHA256
6dcb9308ee6db9e6cbacc0a8fa8bf2adfc4f9dd2c4e048a7b34b08b3893b5d8d
-
SHA512
0f325c07e3d9f96fe30e71c8513de5b3e2e7ec38407680a011c7b62c85171911ecb1feed78a10d0488fc914e14fb6b62cf9b7e271bb5cad38d3744635aad36b2
-
SSDEEP
12288:ulpqoINmKqPyRnD9HZ72PFlLQOaVL82NkRwWH97I5U6ACplVyEvPkW:uls5HqPyRn5QPFlLQNdNkCIz0vP
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Strimage.exe.safe vmprotect static1/unpack001/delmm2.exe vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Strimage.exe.safe unpack001/delmm2.exe
Files
-
Strimage.zip.zip
-
!!!!!README.txt
-
Strimage.exe.safe.exe windows:4 windows x86 arch:x86
63fadb4d799ed27dc51996a999c18807
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaStrVarMove
__vbaLenBstr
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord517
_adj_fprem1
__vbaStrCat
ord552
ord661
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
ord593
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
ord598
_CIsin
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord527
__vbaStrCmp
ord529
__vbaPutOwner3
__vbaDateR8
DllFunctionCall
_adj_fpatan
__vbaStrR8
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
ord609
__vbaFPException
__vbaStrVarVal
__vbaVarCat
ord645
_CIlog
__vbaFileOpen
__vbaNew2
__vbaVar2Vec
ord648
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaI4Var
__vbaStrToAnsi
__vbaVarCopy
ord617
_CIatan
__vbaStrMove
ord618
_allmul
_CItan
ord546
__vbaFPInt
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 236KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Strimage_SRC/MSSCCPRJ.SCC
-
Strimage_SRC/STARFIELD.RES
-
Strimage_SRC/STARFIELD.vbp
-
Strimage_SRC/STARFIELD.vbw
-
Strimage_SRC/frmStarField.frm.vbs
-
Strimage_SRC/frmStarField.frx
-
Strimage_SRC/mm2.bas.vbs
-
Strimage_SRC/mm2.wav
-
delmm2.exe.exe windows:4 windows x86 arch:x86
1e6252214cfb504a7efd7ade7b6237c8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaStrCmp
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
ord645
_CIlog
__vbaFileOpen
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaStrToAnsi
__vbaVarDup
__vbaVarCopy
ord617
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
�.�8e�%��m�}�7����.Eq�ṏ�%�V^�yk�.���EJM>�J�:�֕ݭ�������_^�x�U�4��k�K|�Y��Z:5~+o��*P��%�~������`�|-e{��~,��J=H�,IRw�THx�a2�S|� D���MZ���R�K��U�,�uu�\|�����Tsd����JD</4���p/��^���+�8��C�+[��` �&1yw�@Z���2�_�9O:�^����g:?m�7��?(����.�?g��t�g�_@1�C�\<l����{��_��O ۲v�q������"j��1��\PK�*�l�Zs���͓���캋�҅0�j�iv�����KK5o{ӹ���mOUs�w�*%q7�*����<+I>Vb?��E��v��k7([��&ݭE��L3wO�b�BT�Zk��C^D�G�ֆ|vniʘ���ɓM7 6��H����GY[e�fs�/iLb�S�nC`��>�Q�=��1`�)�w�^��W-p0IKy�"���lD�*yk]���z�E]�|�Z�JYW��7��xK ��Ny�E'>��#l��9������F��v/v���5��מ��5C�cdc�f�n8���b����<�Ad��Lۗ u��S�14~� ��ornQjӼ���=u �]�⤪�D6MY�5� K������W���h}���g�����h��ݝ����ÞE�B�3"����L���"&�;�N�n'�Q�Z T'+�rZ�+��8� ,�w�,�(���_I����O�q!�������U,�}#�7B��3�*_in�SwP�}��?����������%������%RB�"�|��������WUG��f�ȧ�[C�ƞ{�ɻN��!��Dو������aF�8����v�I�v4��vC�_�@���_CM�Ná����aҺ�-1�N�g� ���@��P�b������3˛�B��5��z�Gk�����#�������) m� ]��S��l%�]�U��WJ J�dohn�������|: B���4�����,�����r��K�sm� � ��7)2-A���5/��%�:4�)��C��C�����a�7`s�q��?.�5o�m��n�:��q���2���ͅ����Ik����%�0ұ1>�Ԫ�=$�݅yv���6}�}x�W����#5��mm�aF-�_jms�p0ޤ;�ܻM��%Z�-�E�<��zz��֜�s�5��HԌ�o�N�V*$�-z�ţZ{�ag�"�����c ���X��N�J�J�$Ăď��c 3k"������^�R��6�}���'������+kN��^h�Fx�U0���&����0~��,���WLӄ�#F����u8����hw���C~{���#���������m�g�y�8'h ���;Od!L9~�N觻���v�O������Q���#�mo�V-GZ\�}H��;L������M'�җ$Q����U�wG�k���;CXM�����}�ʞ�ܲ7Ni�A!N��&%Ԏ� �?Ul`Lꆿ�<ǻV�{�FD]�-���y���0��� 3�C<��yG���� 6�K1���7�G;5!$]I�o�n�t�^Uz@Qj�fZ���g�?��1�x,����6~��"V�!6(��*�������i��s��HY�g��I��J�� ���K��_4��1����r�� ��g�62��F�q��d�S ���1UY���qJMVS��M+h�Kd*��P�%��*��k�C�"u^C��o�(Z�h�8�1��:�bX�C�h�lO��LD��آ���WP�% ��@�㉹�G=M�{�g2#k��bZO��{�����<�sjy9����=����3���ynͿ���)�%�y3~2��Jޠ��C�*K�θ�W�oY@p�<��#�5��~E���'����*l���O��~�Ew��ؗi ��5�=���DT��,����e���z�#5�W. ��N��ug�����7;2H|0K�̢_����Vݭ�#����^|�_�e}.i� ��N'*�S�߇��,F ,�q�2 "oܜ��<�>�D�z)��m��1'��/F���Z餵�^�-f���(�8��ژ(�:�?�����I�ǝ��x�*3��t�F��L��-'���>��n�H������#�1���zoVX *9���+����Y~�"�W�|%Qt!�KH+��]!��IE>u��om�k"���~S@Tn����""��V҄�����y�������8R����zZB��S�����\(I�X0�d�bJF\�0��`_ᜭ�^�Ͷ�F}<*�+\�5}�V8%<����sd}�CS��v�w��V�`�6Ygq5.>�@�6���~�M���y!���1�9��O��n�W��9���+g^1K�E\����?-K� H�MtXT�B} ����|f]>�h� _�g�%�9��Yg�` ��jq�G���g9(��+��ftP��,8��nN���l���wv�DM���z���䚏5�&E|�'c��� �2�!0q����ϧwGb�Ym�]��AE�m��1N� g"���t9��3�1�q�@��mMeM�7Z,h�:E��>��c����sUl88��VP!d��ݰ��Ṫ�N_�Ȍw>������4˗N[^O�;�۽ƑH���I�f��;�&=3\F_`�t�6�&©�8�c� -J�~���f�[xV��τ��CC�7:�{Bǀi���("�u�g���=���v���}�rkx�o2�0%-�q��Ρm7RäN%U��%j���@���y�w,zk1��T /���pʨ�Aɚ�~������ ��+c�� ) ���)L# ���� �:�A�]����?�bԵp��K$�=:#��~�U.����j�m5��U�3� [?�%���.�̴K�$�E6���E2>f_|�_��u���O+އ��7D UCԔ=��6�u=�����!í�8K��QB��c�Hk��< ��~���^�E�C۷���y��UA[#�.�W���jw:��?/�Y4�;�]�B ��6�u�$��5�ܹ�AALi!��Me�
Sections
.text Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ