��F��j���o�q_�;��qM^��ÉT��V�)S��3����>hf|*����h��������ϓ:�l���x�6/��1��p�������!-��_���'89k�ZdU\`T��#��#K�+/�_�v��'�.���M,/H�F���B;�O�{8�%�Y����!a=��x!��!���C�e�&�OX�Dϼ<G0�F� ǻ�D��\����0�T)� ?��,�l�?g���G��Fּ���osHBԤC���"� v��j�u�����Gۉg��sa�dJ�o�� ��0hܹk��J9�d�����CN�86��-FmTNٸ/�+��Ӧ^�{t�K��Mw�lƃ��ц(?�]N�+�QkB�`�� řK<�.����>I���1G���.{���d��i����*0����L7��9�zHd��П�Ϻ�B��`���zpӣ�Ć�� �%/t�Ac�Ɇ]Z�s�!1�,0`��|}�i1�s�#�_"�����R���c#�^[n���X<ܖO�}����}Yt/?qV�C�S+�u��䙬���z�t���>V�Ӻ����.�+���"�ţ۴t,�4��Ry�d^~� L�k�a~��ԕ������ �ұ2"�u��DP������Ӝ�D)�*�-n����]�N���C�����$q�=�+�b%���=��Hz�G&��ƥ�|���6���fk�tw�Si��w&opq,�{6�����(67�g�3&�FO�X)��VJ��~��#�2[�M�_�;��4*�����B������K�&��.���&n��Uɘ��9����;��Nѽ��0�W�& c��O���>A��Eᗅ9�����Q�g������X�K��zQ��f<��5��#��-Y7γ�n�H���$���_V�6fVx����`:b�E%z������� �fڞ��rڻ���L������<�*g[�F|6�z���3x�;Le��ބd>4�(��5�AJ��F���lc�+�hg{ 5��ǁ����T�0*f�>�� ��{.R��G�����E�2 7��� {r����Qû�U�O@���J���yэ�R�����(�o�*��#j3���$���/�un��5��%2�'"�)��sP��<��H�<�����\�C=��(`��֬��M+�1� N���2���\v�6 M�s��V7�Ro>Er��S�8�h�4�S�$�f���A�˹���-���.���bxӴ)v|����d���?!�0��:��V \���3��H�w�U눖���Y�m��O�ם�E]!��T]6N�J7���'�58O��O�]XEPECe�e�!��\�B�z�*,]���r8����SX��?};lpk��m����K��� ��t��m�;�Adc���T%�Ɠ e@&� � cy�ͬ�٪��*"�=m"����X�B�@��.y���m)�B�%��7֢A�XZ ��|&�3�~0ݾ�&���G(Qg�~pǓv���tt��r����~��J#��p�����r�2�q!��S�'�ڊ�l�)-_נ�ʎn�<u�v�1:��h� ��"���%��.�]�J����;=Xs:> ,R5bC��˒��Mg��N�@o�bܩ`-R��&(5gР����1�ͺ*u=;���s6p����i},���^�q���?�����w�'��L i8���^��n�WR��;\0�5�+ɒWD�O�Q���X�!b*�DQу��&�����D���-�� ���R3���Z�0!��}4�?Yw�oN�V� ��D��σg^��a����V~��m�n����a*,1c��_ ��/�3�M�B@DŽ��T��F�ݜ�>]s�t���Be�����,���o�"A�A }'.*��O�#���v7+ۮdpO9i��wH�4$��c|C�j�i�j=mh��s�m�Ef{���i�d�_*ʠ�(�vx�d�a7�mc��8�����b �;\��#� �43�o�3(��y���5��1n�2�w'V{gxB��ȱZl�dZI�r��x�enVhU�M(�z������D4A��h� �s��p�_"�R��A� ����q�G!+.�+!�_uʨ�V���2���Nw�Yw��¼֝%�ݪB�k�o�Oo����B����1�I�g��9�0�/��Nui����N�Ω���r��Vz��Ns�yt?��3�e�1Sf7�Q���nZ��D���V��,�j��}��g�^6ԛ�ͩi��_��~�0{�qf�c�t=�Dmv��ɿ�� �>�`�h��)��FCI��g�ـ�cqC�������7�Atث��p����.+X;������&P�� "������1�5�P{ԁ6�[���\C[(2^��A�(�N�ַ��$j,�D0/n-�g5 e]_5�ԧ��U����j�a�����#R��b~�x��?�\��Y��(\k������O;���$�k���������I ?Eפ�f�iz��r�}n�Q���^�m3��6Z��sw~��nt���9��@�_��h��r0�8���9�@w��X��Zl~����<��pW@xخ���e`O$0h~�<�x`+i3��tw�m�O�)�Dl�~q�- 9j�!zɅ�j�߳0����*����f�n}f����S���M,���1�@@vMCkN�)�?Η1�K���!��e�g����*�ՑX�( < �K�����\�i��'����֙�I灼{���D�S� ����?�U�13�\�b�5�ʂ�?�V]h���6�����Id�����j�j���$�[U1��f!�$�쇴�Z��AJ�PEJ]�y���-�M,/L�b���1��M�����o��Z��*�����W�<35��o�W��~KEV���ݭ�w�lB� �*��W������5ZHE!e���J�� ����QJsMѪRHУ,��N�C(�kk��꿺��o6 I�Oz��4_EgDnCԓF6��®�<f�Cg�zu�X�rT\D���̂Ď�gXp{Cɜ�#B�G�ܥ�쎉kfw1(TY+o�(+͍`��[�t�|~��Vvm��H�,��_�\�g�!�Ͽ�W��_��/u���4\��
Static task
static1
Behavioral task
behavioral1
Sample
UAL.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
UAL.exe
Resource
win10v2004-20230220-en
General
-
Target
UAL.exe
-
Size
11.7MB
-
MD5
4f1aa98f5352275f6e936dd936dd68f0
-
SHA1
f7c586f7a43953657f78b4ce9965b702781d1ac2
-
SHA256
f313c9783df4fe072536c6c108ed2cc844c792911e501d197fece8e0c32bfb72
-
SHA512
b4713dc614d170078a7cca3878f0798dcaa9d631efae9501399ad7ea367e6352b923bb45853e8e411302ef535548f433c3f093bb189698838396190131a75b3b
-
SSDEEP
196608:Uzs7IP8x/4fXVnM546/zp7MOjs7Gof0FutIJ4sxDixBH4l8jQmqXIaySnV:JIP7FMS4jsyofLI6gimmRinV
Malware Config
Signatures
Files
-
UAL.exe.exe windows x64
461ee7199211d696677968bd7987859b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
accept
wldap32
ord60
crypt32
CertGetCertificateContextProperty
advapi32
RegOpenKeyExW
kernel32
EncodePointer
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowW
CharUpperBuffW
shell32
ShellExecuteA
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
ntdll
NtSuspendThread
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 963KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.0Dev0 Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.0Dev1 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0Dev2 Size: 11.7MB - Virtual size: 11.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ