���ʞ~.�,@s{��6�YּN�S-:��%<Z��^騿�F�Vo&�&=���5�#����(�,yh��z��j���OjR���\@�xM��}�+����=!�ߨ�FF)������ލ;�x�F#x3x�ecI�1!E(S�������gqG�F]5((���~�?�9i��9�q�%r����l��}���h��?� W;�M��.����6Z�]��aO�ǀ�}���/�qփ�i5V����tz��Pݼ�*t�g�IdS����|�B/�1Ә�.P ;G�M��ɋG�Tq�3" ��_�����g�x�?�唾0�B�GP�#}�ᄂ�di"�F1�Z�/P��~����h���`7�a�iR�t�J�H�<5x�Oe��.U��[Т!2ڎUH��K�D�n�ir^�1�1��m�u������ 6+���F^�3]4�~[D���(Ks�<�#�7�j�f�k�X�x��6�o�+��/NzM.�$�\D)?����v���@����1�a���p�9T�-��N�S�caV��L���BJs�J�x��-V��1_w�Yh yn�1bhV��d��K��f"�A���BWa VA�?��<�#��j vG�.sB���c�h+_�j�.�����y�����`G�x�M�{-M4Y���i�"���M7���Lh{������ w'0�I�L�]���Rw%,][EѾ;����Ƙ e����0����zO� sgD�:OTC���[=����_ݞ��>��P0. ��mT\�x��O��%R�\v������d*�v8&Xn�z6�U�������/���Ȝ���� #]�t�Yv�����6-��������G�dJ䈅��O��ñ�N�����;�(���5_/#}]�J�pJ.�~L������}<���l����љ��7�hy���ngs�k���_�&{E�!Ji<��" ��^��]�^��E8�_?�9�z��3w*F7q�+�J*�}����k���IO-�U{5�r����'֢RQ���K�B�$����v ����k2I�s_���g�l}��3��9% Q�� >[��D-��}�z�A��57�`w�K��Tj,e��j=���n͈�e�Z�N"�0�����FB;�&�e�jn �٢69���k� -4H;��p� e/;)�5Ms X�C��m�<�|����.D��B��ݥD6*���c%�\A�v�����d`����@ر_p�뼏���%WA&\d(��Uq��$_s�_u����I�``���o�I�] ��,��Ge�<Ձ����)}��A��$^2���L�l.8,�Lq��w�(ޅ��%��ݕ�b�v�E2ݭ �.z��w��?��k���Y��W����P��[#:Ǚ�l�^�ȄtJ�-A�x��56�(��w���1,���N��ԯN�+���%�������+�?�ڐ�b?`��@)�T��:���]�q�5�7�,c���W.��\��6F<��i;�:��2�Md[MY�d�f���iX.���@8۶�^ZZL|� x��ĴQ�Ba��D^3�h��5��b�57����������D���i>Ţ@h�^%����q��`$j��v�EG� yZC��0������d�Hq�h�KY(��"dEg�a(" "������DQs桋�ru�r�F�1B�w��:_c��l���;�EHf��e]�/�}���5z�۬�J��`���aa^�@L�������T�j�0/%��K��Y�����װr,Ͽɋ3ntݎT�h�"Ž���J�B���7�����za��T>��:��*�ݥw�&Yp���sk��YG�� �ye�!�Og�<&�j�����D��/���.�D��܋]�Ϊ��[␗�eB���0��.H��-(��onW 9z.���:��<6����B��*���$��utlK�Ά��g���y�'�zߴU�L�t�9w�N`jڞ���0��g� sT��`�� ��3�7X��߅?�Pn�E*���9���M8��H!���.��8WAUm�j��&�閒 p}ň�����y���NHq��T��3��� �61���[;�O�2�>Sk�̤�)�N�O�_�j4B��mf@{k~� ��z^�E6%"fY-4M������t�.r#Xd}�����8��݁*�o�V �A4Yj ��/��_��ŕ��kqc�$�B�������_�D��P�",'$��%��y��o�鬨�����)J�b�� ��MX�t��q�"�ԑhQ�c'�Sb<L*��nJ�r���P����W��e4�X�;�����+�Ԑ�[���X��Y���~�Z=N�оY<����eZ�}2i��Eȧ0y���\��`����Ll9����`���VkQ�b�`�hRy5����Ůl-F�����+�9Z��S_]���J`�?�C/���@�s�@����or;�1��9t��`ܢ��٭��$��/ <ʪ^��m�@���~cia{8�.B�Ն-&� ~0�n�U��B��\��+��g�ȴ{�C<�ϓ��u�u�5n���)B�c��;��0�0`��H��v�DX@SD�^;iG��`a���sX6��;�]�u����U�Jj3} ���S~�s\���G��$H����-D @Άtoi�O֓��*��A���� ����p�pM?���}�L��#�# �3f�p��P��=�����/]�yΦ �)�*ިO��m�r� <&|���օ�O��"0C�<�k����6Wt�?�$0����2���'��VҲ����"8���G��{�7�� �z�紭��C⾅�dѳR:J��G����B��J�Q�\�(x�?k���L���l���>���ڊ��:�n�a7^�&)���u�"�I߯ ϴ�|C�� ���<�[�G��u�SC�@��/j�u�P9��N�y�/E���05����Ki4#,�������eT�$�ڟ'���of��d�ׇ��L�r`C5�;�B��/�j$&hzk�i�{(�E�5��/�}�2�#z6<�/u,z����6٪� flb��/p
Behavioral task
behavioral1
Sample
Toir+.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Toir+.exe
Resource
win10v2004-20221111-en
General
-
Target
Toir+.exe
-
Size
9.4MB
-
MD5
89502e69f61e6f86d47da4537297c44a
-
SHA1
a2d09044b93289c2c751b6076aab5441cbe0a1d2
-
SHA256
cdffdb19b1ae97dc825bc2f6abf7e60cb7e57f9fbf1f79bf20239c6a752e894c
-
SHA512
a10aa14537fac0cb81fd0eec09d911ee737aa1c4e013163f634084a65e94b0a5b6427be1dbcfa4a47c6230edb789686e60cf742183359849b99d2c9aaa0c15a8
-
SSDEEP
196608:FphoxVKpJv9zEAruKY/l6Bjz55goY0haQ46ThEPY9fGEqNNFg8hWoGPO:fhoQvCGuKYUxbm0MQpThEvGO
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
Toir+.exe.exe windows x86
39f67547b28a1f4d556ae71d7b5e501a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140u
ord12089
kernel32
GetVersionExW
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetMenuDefaultItem
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetObjectW
advapi32
GetCurrentHwProfileA
shell32
Shell_NotifyIconW
msvcp140
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
winhttp
WinHttpOpenRequest
ntdll
RtlAdjustPrivilege
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 9.4MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 987B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ