�w��_�=�厏5Bf%{��M,�]څ� Sq���N�����j�v|)�T��0h���,"�%�%�N>��� ���De���������M���qkZ�»2�n��*:��<�u�3���TX�Ȍy�i:Q4��x�)f�S��g�ăe�⍛�w2�넺����~�SC�vV��-��\���iY����X��Ȕ�q��Oy�8./�/�I(�J.H�ˤh��@�b�콍���b/n���ٵ�(��N����5^]��3�gr�wX!�/���qj�j��9�:{��-��n��Jw��1�I����}R������Ȕ�����Ё�[�d�{���AS��鋹(��D���rc�w�=u<h�O��4*a����Xc �L���)b�5,�^�J�� �~�s ��5Z.�`_^Hu���y@Mw��r�%iu��B��X��[�R����m��c�� ��P�]l_� }� 9e��Q@!H٧����̢�@n��cbZ�R��(buy������A���d�ק���@��C�g�ԣ�� 3=����h�ս?i�\@\�ļ<@�f�]M<���#� �T�X�EkS�kɽC����}���j���7�'�pݗ������jDX��n����^���q|ub��� K�� �Z���i)@�h7�6��S�v��4͡�ht@���dD�YH�S�w�BIZ��M� ���<��=�@Ū���� ;�h �.��Z�>(��e����5b�����L�4K�����pM��������c��f��Qq�����I&>�N��>����0��P�Cof�O���f2]�_M��*��h����~ܛ-x�/��g���k&�%Yk�B��^��>#�� �|sD �V4�$�ş���E��Sy ��l(���7�L��R�Zݸ���D��������� ه�"�b0���{R��0����yUϦJ:���m�t�����l �+ l��Ģ|}R���7�WX�5/ek�}tg�)U����?��X�:^R�uKJ��5���+� B!�#���j�s婝���.����G�!����νu(�l������?�6��9[�-�+(����S:��wB�S ��Qd��k$:����4��b�.V6���� ��sOp͑$�YH�Nה����R�����G�O� ��Z `���?q���~����o��^�D�����Ng!䰷�W�,�S$q��W�����9y�έ�5 ��Q��Q��,��WO�-V�6`}p����d@��%����wuDc��q���]싗0�e���C;�w`�Ո����̟���60���H9��2Jn�B �MB�i֟j�`n�3�&V5%j�]�<�mi�MY� 6�<�KNY���q%��T�6�)dIL3����rد2e���������/�tJE3�rM�IY��o�^� KI�� �w������N"� �{������{��̭�w�>�ȝC��O�����O� �c2�j�r^r7�����F��I��"�}���������@���� -iO(l6�*�n��Y%O?����k��"(4F�:�!���_�M˒��A��S��M@��~2sY�fS��� ^�����w�h�1���S�YO:]B�evo1�����%�8:����[D�0��� � ��=Ţ?U�dc�u6��"Mð�vIL4B���|�kW��`�h'�MX6��O6��nɳ�ڽ^�ɱj~ �mx�>�Qu��ԓ!��μ�qÊO��2r+���A��N� �M{E-����\��9�� ���C��h�F��oS2�_�%�{"a���T}�_��|�x���Ӎ ��X�pVb�|�'����bS�sP`~0�d<ݚ����>[�(�jJ��n ���GC�����K�6�4J��`|Q�&�����S�Z��-��0�4�k�!�K庳r��Z�Ԡ��{M�"�G�{�L�ݙ`�#>�?�G�x��������W�|��Kmʰ�lG:�A�t:�EK.$(|��:�������>���%�9Uꤪj��m:wW��c�����!�a!6�@,���7x����4�ׂ8�^gZ��a�w�ӥ}Z����e/�5�Vt�гE �t&hѧG��i�"�ș|�7l��%�c3��-����}��ӆ�m���o��n:�3�c}�jL�����K�b�x^�J��&тK> O�������K:,<jƴl�d7Y��u��<⩆���;Z�>�0:�'ݺ��i9P����;Ź� �wi��5)�A����%E� }���?5���*�袿-�Pv.nE8o��f�p����5,�^C�S� ��W���h��w�ϕ � ʓc��E*Q�c(���r��%9�&�ҙ�y����?���t�b�Zd��aN���mf�7rڼ���a4Ň[㪟�w�+���@7{�`�n��̝@�c�ԓ��:8�'�穻�}#y &���R^?+�lϪR!V��~Lo%>%�Ϸ�WY8��U�[܊w��K����&�W�!�'�,��Rk>}� $\�q�_F�<�ː��X3��lU�����u��%�_w7��oqcf;������ �e�*Ύ��̄��W����\`U�>'($�v_E���k�Q��b�o��f�0[��R����9+!pc�U� �]��!e6aߤ�8#Vi��vV��{Ŭ�{378��Ħ�D�#�,[kJ��w��Ȍ������I|�C�?gÞ,��� �[50�4�z���L���b���?��9�"W.���>#_�M�6�SbΟGyGwQ�}Z�Mt��՝�j ��٦�F+?���m��?,]��vv���65Bf}��(%B��~�ޛӄ�pݮ���P0֨ܒ����2�"kR� T�*yct�dyuHD�^���g��zx�nD��1>��-~X������H��Y���EӞ��Z��9B�RZ�>���:؏�rmT�'����OŧqO;F������Ob������>� �t���;���ʟ���� n�>���6e�+�0�q��yPw�F���p~�[�GG3��P�m�N8[����Yǁ�V���C��-�38��q�T�����
Static task
static1
General
-
Target
update.exe
-
Size
8.3MB
-
MD5
e239ff841a87dcc810c566c030088baa
-
SHA1
a21eaf5f30e46d7c30aea8fdfa5efde1d41d263c
-
SHA256
a7c1b932b6067c62f0d4cbab5087b17b4bf2f3ec776355a3efdfffbd2534bf51
-
SHA512
0e2613e908ea8345c2c6dd3ab47bb0be6123e158e0e6410265132ed60b188e8d7390b4abbad0fa269112c656140d331960a70741a8d58708ef0ec5301687c0fb
-
SSDEEP
196608:PMl6ocIsmk8GWHuRRZbBBG3NQJQFvMzisNIdCYDeEQm:Pto5smBDHuRRZBI9sQFvMOsNhaQ
Malware Config
Signatures
Files
-
update.exe.exe windows x64
a5c6b9365405ca20d1b7c320fa00228e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FormatMessageA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CryptAcquireContextA
shell32
ShellExecuteA
msvcp140
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
imm32
ImmReleaseContext
ntdll
RtlAdjustPrivilege
d3d9
Direct3DCreate9
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord27
crypt32
CryptDecodeObjectEx
ws2_32
ntohl
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 970KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.a56 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.?Jm Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m=H Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ