)/7y�M���u�:ڽ�8�R����4ʚa�֖�� �K�O*T�\�%YlnOvq��p ���w�t�\?w��Ԃ�S ��̍}�����0��!�\�G�O3����7@-�(k�N��-����x�B�zC�'��j� :թ��#�R� ��ס)5wLEڻ��Lp I1gq�QeDO5������ R��w��g� ��Pp�۰! �>�mIZ�K�0h�A� ??�n�q�������O�� �jg�Цo���<����Q���8Z.�K �P?+��T�;��ф��W h�ǥ��h+�lPWX���B.O|���G^ ݔ�NƤ���A�km3 ���<Yޘ*�\����O��Z���)�%�Aaw.���E<�)<ɳNo�����7l)����$C��uk������W۠u�uZ�}$���(����� ����b�Sn�ix"/�N����zA⃙� � � !\o*�s2�O��n����>���=I��5w,Į @>��\~,�.������JV�Er��b02xڈ��> ,7��k$ �:ε�)���|u�p�_�YO�@Cr�9���5�j��J�K᭣n��^����<=��!���>X�G��(#'j��G����1�'�E_����BӮSYj �xy���5���]5k��2X��T�7��9Fz�l���� 7;~�)4"4BZ�*��b�H�ȿŤal�^���������� �F���0֔3�ͻKT�B�%��(�G�������*�_\$� )����� ��(����}_ aZ�6�*��v�e�&R�$ʜ �ơ%��+��3/|�]�<CD�3���ةD���N4uX��6�P�i�/�,�)&>�k���'J��?8A��������>�"~�:ս~6/�Z)pr��K.���h�D7��)��E�l]���c�d��&y.=^FU���w'��y��4߉�7�3�+kS4o���>ֹ;��Tq��G�]Y�"��b�8�*�*�}\ u9k�x���c ��U�� E��S����]�cR��$��Y5`����,��>H�8p��K8d����J�.�QT�B���a��������\�V�l�O��f;�!���"U���[�-�?�$`S�l����-�A�kF\�7�#��^62 ����%��n��D/��e���nb>�����Z��)���6��l��8}�I1�� ]�ur�>��tו)����6Q{��_�R����ì�1r>i&Cy��s�a�s�\boC o��z��\ڴaK���kG��� {�<���ψ�5��Q��ktt�_�^V����:u>�ʮ����K�C[�\^YG������3��"yj���꠶�'Cw�����Y BY�#����n���)�zn�� 9d���p��e��ɾ��xg2���� ȅ��qF{YtU�$L�����a��,�= D�y�Ҥ�x1��mW�ظ�hJ���f�w(W�{���W ˭�� א3r�GK;<?��̯{�rI �>.b,|�I���e"!��0���ېN��br��Jdoq,�@�J5>���"}a����%Ps��KE�����{ �o$������O�K��,"T���g~u�>i��M����;��A�X�M���k1��m��s0�Q1�{3�w��74�5O�A�DCA%�<�ȯb��Ɛ�$\�� q<��Tw���@c�f���1c�i&V��CiAK��K+��|�J�VFb�����߫Zfa�\.�Ѯ�&!���N���A]?��Dl�h��ij��x,)��_O����V�=��������r_����� ��u��.SkN�)GדI���%�sy�n5�`�la���Fvo2D",C4�̯To�����L�'���������DR#���T��+��I�1�Ɓ�������P� 2��2�B{��:���;7����j��ũ8�<S���~t�C�<A��������?}���3���_�h� �����,[������Jc^J6e���ˬOFiƐ" |�h*N���$R���w��3.韥,� J��Ȃ"�FK�{���&S����-���.֕��U��0̉��4㬔�z�C*��P}��3�T� ���3h%�5�d��B�"�� ��͐�T����]P���|���W��3�gF�i�����E�b�|�@?oyc��/q/u��!��o���<.�,������l.���Ғ2���Y[�3}��+|�D!M�ij�����N>���Z�0��{�<�"&I� 50;�}_h���?s�}��=�n�l)���-s8Q���@˘((u�A���6|�4���R���:w�⊆2*Vn(�!�!�{�k���1���;�����$�F�Z~�J�q���uSK�|����CS�.��V�zk_&P┙�̙����� 0���ά�����a��i5M%�!J���/7df��1�(�hCU�N��w�� ��d>T$Eb�j�)���\_|�N�1a�n��,�i�2�v��j$ȫ���VE>��Se.%�'Al��A/яghυV��<p�����,u���X��⚯�qzݻ����<"a��7H�8��`/zԥ��l�H���� �Ypy��/�j-���4�=c��yh/�_���`sD%���l\Jd���Ҩ�]Nw"��+�(ۈF7��`s]�Sm�4�-�-���ѓ{��a�R��%�a=��ARF)�x �A.�c�'�+�$*�f�ŚU��V~#bL�>`��!�Tu��H�9ǖ���._���]V>t��g���0�� Ϭ/8�n&7�!�� �f�d�H���a(�2�����H�� �й����~)043��UsS��.�]��Ӥqͩ��p���5���Q�\�/��*���q��7)��哽��e�����I�O~�q�>��D ��G�u���� 4�Sj�������C*�Wi�:��� D��j>M�ZH�`JI,��yr�0���+���q�*Ɠ,�I�G*��9�hǦ� ��$��&��t�^����g��Cz�\����/�\��ӠwS��O� T����������-��^ӑ��(ҙ
Static task
static1
General
-
Target
SMELLYUA.exe
-
Size
6.6MB
-
MD5
915dee3fafd0e052b1e8dc5b66e2d822
-
SHA1
3d10ab9dc0703f27421366002cb4f7c82d4b46d9
-
SHA256
cbd1ad510a7a40201b1813605898f30d125bd816ecb377e0627ce433002b3070
-
SHA512
fe31dc8b05a51063258ca464935a01fbd07e85666fb50d657d7b8645f8379a29b942175945b32be1e8a296848deabe0ab86e4671bc32e46f1a97ef9f6fc3fe2d
-
SSDEEP
196608:SIg4VXqRrLO3VgaDpDf4rlh+asEJsaHW9wa:zALJaDl4r3+asIsa6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SMELLYUA.exe
Files
-
SMELLYUA.exe.exe windows x64
83aa2ab9d30c6e5ee76d286fdedb997c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
GetStdHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScreenToClient
CharUpperBuffW
advapi32
CryptImportKey
shell32
ShellExecuteW
imm32
ImmGetContext
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
wininet
InternetReadFile
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
ntdll
RtlVirtualUnwind
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
ws2_32
WSAGetLastError
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChainEngine
Exports
Exports
Sections
.text Size: - Virtual size: 611KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wQe Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.l\N Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.O\U Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ