���XA]އ�?�(����c��ɪ���%g�)mY�?�㦫(sU�O��u��_u��.�xo'�/a����%��*�ޗDdߧ� �u!g �8u��b�j�/2��ߧ=�Pw[��D��m�OŪ�l=x���p�߃M֩1tٝ6I����3h�b.����#+���5����en3pE ��DA��v���ʜ`w�����]]�;��S�Uh��\���̖ܻ����p�0 [7�r�5 ������PO�1v7�%��:oH0@�@�\�uS#Z\L���(Sʒ�S��X�6�)�>��qd%�5�{���X�:t��^z���Xo�P�g��U��[��w8�:h����#e�7/�],��D�{�?�67O�Z�/Y#�wz��G1���+_��r#��:��R͕QV�������<��G�Z�ᬁ:�&T*�u&1���e�I��c>E�X��j��O��<�d��h�h�̸�Qx!�0�"y��-*Mc������b����L��7ŊG�#��X�Y8��g�����,&�*]j:�|���_\��_����M�� kO����7����(�Q0U)�������ᥑG���C��,�7�q`��\��=���C���6A����zD��?�*ڡ����E}�˭9}�a����PPow1=�U6����g��L�U�` �7x �� 0�D�^͵?��=#N���o����xw�g#b��;+�z��ɟ��"+)�Z���E��>��Yx���Qm��mKm8e�X9d!�?�3K�=U�r���;�'$�&����Rd��1��T��2�^�H�μϨ.h����@VQ��狀73w�!�#D�� �w �(�^��6�!�oQ��|��"6/���W�B9]zIe�0��w��V7��D�&�T ��.�m��������hKu��c��G���֗��[n\BV���v����;;*٭:+INƃf,�kT/R:�w���~&�;DP��;6��;�� ��6��V����� ۧ�O�`����|M�+ꎨ���R&�WR��@�j�;��բa%O��V��������H�S�� T(⮩_L��d.f��+*)F���7>� Ϣ��$5��f��`v4 �ix!Pі���I;t _ABw�X@���2�?w��� �����@�{�7�7�{�öY�� ,*qu4����8䦔[�V�Q���U5|��M_h�� ��-���@�~�Gv��,GU���8�����<@~gIp�0�� ��#-8��6�l3+�d�Cۺe�wK����sС<�#��$�3* ��}������q��S�X^|l�-Fc�q�r~����n����*5��aL��l����i��v��`�Æc.bӐ������%Fxt�4����98�QR�--M9���\��&�o�K��� ����(]�zT�|�� A�z^ �4� r�8��C�釬w��a+����PW�sV���u�g���|���1�6���'����79�yп0x�b�U�g�EՎ�b L��>,@���}�cu��l��4���66�k6.���+��okꎭ��Z�m�u��&���o��hH�� ����;�3��-�5�W � i�������l�r�܅�o�B&c�L��z���l��XE���WB�iZ�\Û�^W�ɩmw�E,��� ~� $̋p�*>C�&�4l���g��ˉ���X�QG�X���ĉ(�\�8�F����Ҽ+L�_m�vQ�m�f2��Gƙ�%�s�f�� c�������Y̑�q�U����>(� 'U���k�7��U��x�}��.�y�3�Eկ��!U�lS[�A\�e t,Q�0SؿA��zS�� 1 R��hЧ��TƄ�(Q�L���}R%�7��գl���`��1OT��?}��?�I=g�ٯQ�lr���1����fת����cn���0�����$JO�Q�in�B�P�u����_U���|<S^!���7�F S-�V����>Y��$ �QAO/���H�5\�XT�]#������iB�62�& �<�2�7|Z2��g^kh'�kyR������gy�%�j��U�u�Lz�O���GD�ڗP]�<���>|\��z�az�4��a V��E��.������� ���Qo+A��/�h��a<*s��K����R��O6�>��P��}�f�ç7��=_ٕ$6���Y��$VR�q2U�,�h�0�%��o�b�H���s�o��o��ʣ��m��亡uf��wx/�X�U�cMF���DəKB�G�" n��b���,��%O� ��~���#C��ֵ�ޑ����:���j,x�5ϻ{���� �(�^�?G�l���L���ng���p������{�S�=��H�s����ec�،"LF��Qu��u�U-:�M������8͐���r�u{- #���(R��4��7��������V8�DB��F�R>�|��*�D6�>`��K��@=]�6��]_x�/U�����3�.���y��SB��H(2pL�'�@�qo!_`�F����b*c�\A�p�m}� ��Ndž�1�$��r|���U�r���X��S����>�"�@AI�c��~��oS{���F;9g��>��":ώ47F�eN��,��7K�5B&���d4;,O"M�V��%��$�3{�s�_zfq�y5�{��#�Jˌ�TYJ�,��8���y�\�t ytMW`Ob����z#�fy���cX�O���p�E=S�c)x�l����B������A��S��:\���+�O����- ^��kwK�����/�^��:L�}���g��D�~��$8��V$w���A�E�z�]�k�*�g��^l�^1u�2�A����u6beW����h��J���C�l8�����^�R3K�{����rT�yA�F���)K�*Z�чG��7�zg�����Znz|�����]9�Y�86 �o�0sL[.gb��L����YtX����J�LĞ����k����%��$$~"/��u����&։�� E=~�\���.�¶�U��s\{�Ӌ�W�*ܑq�^h��ej�^�ږ�(�����>
Static task
static1
Behavioral task
behavioral1
Sample
aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
Resource
win10v2004-20230220-en
General
-
Target
71e83ee2d42e1d3a0714c7791675fd83.bin
-
Size
8.0MB
-
MD5
ad4048132a2e735a6b33b6806488b270
-
SHA1
5e85f2ed4710f16b8a0629bda9c8adb4e9d01056
-
SHA256
2cdfe2abd98cb1042c905611466553a444a955ba5d3797d11bea7469b3ce334f
-
SHA512
f2eddd14cb46d79df1b9827c5f806beecc284d0c1e924cdd03bf06c3024ba9f81baeca57cdcf21b896e976c2380b1f8f258e6636f08654d136a2e66daa5bbf23
-
SSDEEP
196608:1OCN/w6v4E6wQSnUuccHzDGQQ6Qiv1SSz3Qg7zgNbaD8Pd:NNz56wQSnerLtiv1SSkIm5Pd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
Files
-
71e83ee2d42e1d3a0714c7791675fd83.bin.zip
Password: infected
-
aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe.exe windows x64
Password: infected
7963d3a67cfe4f19646b23c68d457d1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ