�.R�Ï��Վ6�6�J��>���ӄ�kC�����YH�t}�t��ʊFP)j���K�hd�Rj�eF,e;6�c����M=$N�s�O�Pt˿t�nF$�(�u 鰥���@Y�Z_�C>�#�F2j@�^��V�����p,}� ��;f��\Q(�"#������{�K�ѯ�J ��{M5�h���bs%F�T���o��x��7���S0wo1r����jS��(Yt���+=밲+�l 9,�Jf�y[�B�L��n����m '��wD�K�f*���C��g���{�.O��I6o%�9��4Um~��G4�Mh�^S��m�v���my�`�d|��vجV�~�O{�ܐ2ݴ�%U��h�?a�W�\��sE1{�ʯ�k��0������,��4ֆ�g����i�ҧJ� �),�K���!l諈� +�;�>�+��"OH�bM®M�~���^�fz$C�ԟf����kc#��K �|{<�iYP�7ȌX��x����߮2_�Lؒ�.�e���w�r�c,yL����Хʑ�,S���S� xi!��[�[���!⌮QԿF�m^s�E�\S|?�ʼV�^�uA� ��?��J��\>�h%G�R�:����@"" ���|�мN�y1�8Bce�u�8����+�dt�a�������S ��&<x����3��5>�� Rd��/<~4dFo�$&�{� h##��-����D�CμhM���N�OZ��2��6c �@�p�A�l%�ߢ�F)���ܼT�2x�L�C�&��dl`�6-��l>�&�R�c�bWY5�_(wc��ֽK:�Ep{<gV���ڻ�W{���M�`�Qws�_6 w��jb���t����)-�\�Юm��r�� �im�A{P�ᒾ�1:��`y������- 3�_���B�p<x��S��ՃY/ĩ X�w��W&��I&:� ^�܃���@y�K���Ĭﭰ��,gQ�i����_V����l(�:��J��K$%w#rK� ��^�9��J͓w;9g߇�4-���7�Ñ����rG���qiz���7B�ځE �����=���^h^q��%,������p�YG��A$�gt!#���r%�)�p5��'����.��������ֲˈq䫞O�C�2��-R9_v�6����5<��AU����QD�D4<a�*�̞T���v0,�W5������dYO���>8'���m^9I��〄���p�����Y�E�c'�1��U�L���y�I-���w�n}���B*T&�����͚�]����Z�O5��]ҥ_�]�BS\w�axFTs_��Mn�\F��7��Kx�p�qdzT`�|� 2 �J�Q���6S��a�KH��"(������ؼɛ���]��B��z~���a�1�;+��Bg�^��N �n���. j8u����7�(k�V"��L�O!�31!:�����SKC�K2oS���ER|W��CMɣ2���+'�k�,z�����ܒ��m,f�^p��l������zm� ]�_�8��P��).ʂ� @\@�+1����p=�������"�0�5hM$J��5S:<��@���ʷ�u�;�+A�z���n�� �s;g��<�O:�!���gPݚ�����8�:3���ʌ���sϙ��A�آ��`�,O�gXiP>vA�&�3�2?�����,O�^��K\����b��/Ľ�g���V'?`�,�il�蔻s?G�~��% !mi���ȡ��o<�n�#��s#�j)�<��+����Y�,e3�|#�e��_j�!i�S]3N��tNVg���k<9� ��4�<�Cٖ_N���Y�T���8�weoC�"�%�)E0��U��%�[e�LPit��'�R�;�p������H@���EuA��ݧ��i,��=�:���bY��g��u��26��l,W �dI�~��UOԦ�����d'c�w���1s��N���?��� ��Pcs�$IT�)�_�D �2���_|p�"�T`l�w1kQa8������N��n��ڶT�jA�?������LHx�LI �\̷״�����$��2|����V_L�-���T��BY_k���`�������0TU�o�֊ GT-C�o4l�b,[6�W�~���<�6�Z���VTj�� �'7-w��!�𰡀@s3�j#2����ɐ�j���2�ϳ�*B���8 �ik!�K����Ly��3z��G01�$QR�?q�?+c�4�i��9TPV�����g����EЕ9ν�uj���g��Ü���'�O��ҿY�����I��Tq5��a�1���ˉ(��,=t�H�������`�5�T�Q[.I�e\x�cr�����A\�̵�/[�ka73�6z���OL|� ���㢠%�0+���ß�ȁejU5Q�~�dCo�q�8uX*:#�3��7$�=�i����h��z�"�5Υ�E�K8}�v? ��UTo���=S�7\�I0Z������q�������/�����o|�JFu�@�'bZ�����ݑ�a�n��A���r~2H�*����Z3�ؑUT�SAICRX�!��##�v0�6��,�Il�+��M��謮N�˷}́�%�6~`������k^�����_��������6d�qi��J��;_��k�_/�˾nL�I�ǽ����(��B��}��&3Kؿ��� q������J1���r����Cڕf0r�z��U�-�_; \K�_��\����k.��"���_7�.l���|CV�U2�e��)h����Z+"��-�gL�I<M��x�xOn���3���q������C��,����e�T�����V��J�/����;��JK���6b��̸,+i��3�Z�*���`㍡m����� F�� ��-��OP8g��Wx�>smJ�`E�i�lq&�f ڐ�y�V�e�+�98hŪ/��Ua���ߴ�2��k��g/do�qX�&؎��%�22�G]��o�#vU�v�kM�Ԁ���V������"vF*��L3���kN�2�!�VY�Ў����~�]y-Ų�� �y��d�z��
Static task
static1
Behavioral task
behavioral1
Sample
ilikeyourmom1.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
ilikeyourmom1.exe
Resource
win10v2004-20230220-en
General
-
Target
ilikeyourmom1.exe
-
Size
8.7MB
-
MD5
798cd9ebb8738e8b8af49114fcf1dd73
-
SHA1
989f3af4770f79ad12757c33b7ed17e2acb30c39
-
SHA256
b06e8be4c3134dd01ca8866f654a50c23409060393d0b1425c78190cd96d09af
-
SHA512
38de52555aa1510fb1a98f1a27a64345fea49197dea8bdb535f94e361765957657e3336d816c0dd2c2057a0841cff040edb53a73e33678fe79891972059013bb
-
SSDEEP
196608:22+3Wf5P4Ecu5GhaQvvkw0W5xZy+hc6R65mm4eoaMRz9:2h3WfB/9410WFPPhj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ilikeyourmom1.exe
Files
-
ilikeyourmom1.exe.exe windows x64
d960bb69fb8e3a770fe5eef3c5b9cffb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapDestroy
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
oleaut32
VariantClear
imm32
ImmReleaseContext
xinput1_4
ord2
msvcp140
_Query_perf_frequency
d3d9
Direct3DCreate9
psapi
GetModuleInformation
wininet
InternetCloseHandle
ws2_32
closesocket
ntdll
ZwUnmapViewOfSection
normaliz
IdnToAscii
wldap32
ord50
crypt32
CertFreeCertificateChain
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Exports
Exports
Sections
K4F Size: 754KB - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Lvr Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
JXp Size: 75KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
m<P Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
S:> Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
,Vt Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
>oe Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
N@0 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
G`a Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ