��M@�&�o�!IL3���:�!��aT���s~D�*��k��]����;Ŗ��,��������0�� �1^K�����Ѩ�7�'�t����4�O�{�����}4��k��%,������x�Dl�ĉ����&��U��z�l�;!�y�ftA':��k��s��V�*��H^r��w'�����8���'�8h����4獡���ɋ��m�JO�S�ۥooW�he�tw~n0�)�In�pꥊ�o� �n�y�Ģ�JB�V�%NJ�������xيT���d���Dk�>YbK��-�SLF��4\�IoYќ��l娡�����n�n�i�a�����cX�Lk`Cmi���ͦ��� ܼ��� T�:��^J�C�Y����+Ȧ��|'z�� $J ��#[(NA ��-z���S�ӟ+�~#T���b-c�aܻ[{;��*pM瓿��&�Һ��tXX��,�V�.{+PJ�H�V,a\�Wy��ET�g]�f� 4�����{L�)H ��(rSD|����M�QN��M����X.9%c�N�k�Ye(�EQ"A��������x���uT�AXS.�.>ym����J���2�3Chz���كb {���!�Dž��n������V��[���{����m��Em���z/�cAF�λż�3S�1B��]����M��+�z��PO���2o?X��8=w�N��sO�5?kd�&��I �r��O�i�X��SV�"���H1H��Bԝ�0��UF��*��b���R2���M���|է*�|������)�t�i�� �Yp��K"��:���?A7�+�vܔ��5�ư�bt�UUP-��fps8C��-��#�YO>��_���IB����w��a��\n >�>!o��a��#z[4�� �S���A�?�+e4� �&��S�w�KR��X��vew��%��_25<7�nx 'Ѩ"l�fK���?�1(Xl�#2T��g7frٱ)�7��#{�܁L&���?����٪�S�5 �Ì{��}a,����C�3�⢫����G���-���wD-��Β��ɄC�g���s]Kb�}<aFX����������''�����EK�ϲl���6�J�ۆ����&�E���um������`��M�n���ϤU��$��� 2�ϤI����-5��,�s��<�]�7]K�ҺyB�~��H�M� �0�D<����.�>6�����c�]�㞑�(��}�KĊ���6�r�:LM[t��XɽC_:�ݽ�ˆ���� p���U6G� �1����IAk�Y� -�o��� v�����)���`���c�&�ŏ�������m�s�a��S/�G�lQ�D�O���)v[JW�P��[w)s�~�V7D}�5�A�����i������k�'�i�1݇� �,��M���;u�y�mKAvC:����Azt�$��������RO�+�~�I?v8S/��33�E��y���n *=*��C͊�� ���Q�� =�s6m����)�LPJ�ʎ�P��-�5WKa�~�4 bmn�]Z���I�� �ib�1q|A�qƋLt��`��w�>�'�ԱeP�;ӵ|�̮%��������Td؎|�X�D�ݧ)Hq�u�L t��ɑ�t��퇨,Y�A(��x���{�d�3����V��B��S[�&���/XַP�S0Lub�A%����^;=P��}FO�Ͷd?��s��b����"K~�Lzi%��~g�h�o�in��sc�c�+MC�`�儂4,2f�q����e�YT�KɃ��_�6o �����c8BE����Q?�.7x�,!H��q�"1ǰY4X���G�����x����&ȳ>����twi�]D�&q+g�Ys��r�U�3'd��b����Y/�N��0�F��"�L�V�^�>R��~�o��)ۯ��|��[b9��!� ����L��5m�����3��0�OD �d����}:��X)č}8�F�UIg�"���k��}�����,� �I� ������OC�LP���&d���U������A|�e`540���{���ut�[+�fn�a� �� �1�zA�V ���+QlJ\I܁ԶiH�+WB��(1���'�[K%O�A-�������7���n}}�B�1��Z�Iy�YL�T�7�{�k�o�$w:A��:�d�6���i��5�[�A�ܙ����t���O�}$���Q��(�Hl �g�^����� �[��ə��n��HȹsD'��UЙc\豼� `�>YB5��@,p.����j�M\�p�~�^=������_~s�%�NV� u��3�H���9��䜝!H�+�X��=��}Z0ϒ���vCCN�ޏ��~��r��R��Z|�P��&o�fi 8��@�J�q��Qm«Fs��·q�d-�A�i��W����<�[�>a}�-E��1�{� kE~d�d���R�(��z`����zW��"jl�6�Vɦ�H��v͏Z/������]�o�'�Ľ� Az۳�<���,��Yp(�_jlQ-XB��5eM��Q�]�9��p'!ө0��'��(X��8��6|� ��=��;4�|}�.|�<^�"��㓪|U����镝�Z�~���o �m8>܅��Y�p����vWx�� (�u@5/u����,Sm���e:P����O˟8n�&��^�+�E��r��cU���*�L1FS'�` �����4�R�`�լ*����hN�CXY�̫�����b��W��h���9���70�x}AU��e��~2&ɞl�F��܁�x%Ƴ> ��X�&�:h��]N������`��4���]�"K��C� �����cO�{`�m����ŤB�3�4��3��,@�O9Q(!��gMf�Y/F�V?uڨMm��% s�w�ߪ��ow�Ђ��Rq耉�����H� 3����hq@�x�pЌ,gq���=��p�N����6{ZܑoR��+��kY8W�q���_05A���� L5e�����w$���Τq�����7�*�,M?Pc�3�YL��*1h�����|�ݖ����N�kĐ�g��lͨod����ܖ�<Z�
Static task
static1
Behavioral task
behavioral1
Sample
ruyzaq (1).exe
Resource
win10v2004-20230220-en
General
-
Target
ruyzaq (1).exe
-
Size
8.2MB
-
MD5
270b28eb338d8881a9243bec9862cbfe
-
SHA1
550632262b0f5f3a1d1871c5fb04ca6c2ab2e369
-
SHA256
4dba20f5aa27c794c37e1a747780313176ac305e01398c8b269477fe9ac852eb
-
SHA512
fe7ab5c7c6ca6fe8afcda4e48fe7066068bab3bd1ff882e1d7b13241c5b7e4c77cefc859fbb5c61a1f8192912b224750f0cba3f2303aae0a717d132efdcb29eb
-
SSDEEP
196608:78/SyvLsA2aft6OCAZdCy9zl9+9um+HezMMrpSb/9k0h:7uSuo5/AHCy9Q/r8T95
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ruyzaq (1).exe
Files
-
ruyzaq (1).exe.exe windows x64
64e3518c154a4e0913195ee7aed12ce1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AreFileApisANSI
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
AdjustTokenPrivileges
user32
FindWindowA
CharUpperBuffW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
ws2_32
WSACleanup
vcruntime140
_CxxThrowException
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-string-l1-1-0
strcmp
Exports
Exports
Sections
.text Size: - Virtual size: 333KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: - Virtual size: 140B
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zYK Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.2T8 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.&:d Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 422B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ