�5O.�T��(���K& �~D�BO��lp�P1��OhT7�����)<���q���C��i|�R���?R��?�PM�Z��.�<<,��� �1�� 3��a����b������G�hz��f!4����� !�wB��M:U+��J>3���@2#���~�P� ���n���:|�Eϭ���M��G-.yPE�mB��2'7�Z��v�^�*f>4��8�ǎh�L�����u+��u��D2�̭��a�A��V�& 0Ϋ�vt�#h߈�t���Qi��IcN}H0h��V퓫q?�М�w��Gj5�9$a(�ڋ+�M����G/֛0���P��,����YT>�8]2�������~Tt��I���M��l������n�BD|���|JP��V楄u�\���f���ov:g�$N�0��GVL{���c����9}Q;���eT6�����RtO`��t�?{��.�P� ����V�B�D�'.����<�̮I9��y�L�h2���t���#g��57�]G�9���f���\�r��$'nC������R�,�w6s}����٠�q��+��=���!��ڂ�K��6J;폫G��0���US �|'�ɮȋ���<�YZ71���آ����K�q)#�I�,��8�� 9=6����� �W���^k/V�z�9K4Q��!�4K�B����{��̓�tMyyVm=�YJW�|�QUvg�*���V��[ ��P�vU�yd2�K�dE��%͕����)��Ei%YQO���mq7�q���2��� �65 ��a 6�)�e�G-��5\D����0ԛh��e���p��Y�f��$\�w�Uv����Bs\i�����H�*Y&��A�FK��.��j� �ޙ�zW2�a� ^k�����y����������Az3b���c��sCF˒��I *`�v`�Q�i͈�f����M��4V�Uo��d�(��ȥ�B�/���Ǣ�y��Z�Pt�����,$���tj���8��6�'b�A\0��b�kR� �{\�x�?)\�+<�j��w�&���E%"_���[y�ȇ`>He�a��J�bh�,y�vjB#������r��Zr\۳�f8�j�6AWg�lDƏ����W�ϝ������8�_y.�t���.����V��ܗ�3K9�; �*<����<E���!qh����SGY���� C,��ӻw�H���(��cŞ�v�S���#�ܢS��K>�Z_�)������l�N�˃��Q4�ō�1����g�*�{KE��Q�b/l�wn����`q��:Bo�-�GO_װ�~�$��� ~�xl���ц p���,>�rZg�;�XHIh ���������W� �O��gh�Y{�:l�|SX^w8�}p��?`{@�t"hqNȾ�`�C��0�͏Zӽ��:/�B�$�4��2?�e }X����{)b�DiS@3�~�-��x*����E�Y+�����nM�g��a�� |U������E�Ҟ뭗騩��3�i� iUU���B�0%)ũ2#U<��M�X!�/e�>8�d���x��ޞ(��nO1��*k��aq�����A ��l�+��Q���v���!K�94��Rӌ��1�7��P�q�g���a�"������o��!��|�1G��j����$s���؈~|����|��^��� �����mX^�:� ��+ֆ�B��*�C(����|���:�ݥ�v���q똖��ks�F[U8�h��B&�Lrf� �E��T��0S�?$�� ��?kl�� '7�40��7?ȟ ���I�YM���_LPZ7Dn䕾� ��KV�z��r�h6fLl�-����[ ��Q��{0C%����hi�SIQ-2�8FЎ�ࠫ0�V��ӸY�b��GEu�oC��n�U��^�1�-���,# �<�|���<�9�">V~����{��籕�̵��O��=���=���գP 5�i&9�5:(GN��� �7�!�:Y}#Z��(� �"y� l`��S�@5����� ̰��:�D���b�WWF�><+G-=բ5������o ؤ0���+I_��zS��o�D�"_T��«uP_:��-���X�Gu��9cŎL����1�߽�,��TQ������ ��uͮ7��g;�L+M� ������ �(�Ӫ�]��uZ�Ǒ-FZO��j�}�Exa��xV���r8��6�W�"OQ�1T�]2Q9{u��/�-n�U�!�+*�?����XT�� SM�ʊf�Hp�oa(|��o=��_@���]�����}F��D�d=X�!���FPZ旵̄�.��P/�]}pS j���*k��b���b6��"@��xC��.�S�e=����s�L����"��0�E�T�R/ax/��2���VNF�0I���H n����ݡ&}�Ao���c�'����0�]�/q�z����4�FDӻ����^��?cU��z/M �7�����NL; D1*3A��v'?q���]�[�Q9�.�2�$=Mx4���NQ4O�Ys&AF������h�^)I�cf�pU|<�#s�� ���������`�7&� .���Ҏ��fU"�^�[��<�#<��=\Q�x�́[��E7��^�;��p�V��_.������G��/��:�g:�Oyx7��Nl?�ڝ?�K���r�P-Y����!+W�W2�SB��o�=O0��9�q��<��WԲ��v��7H9"��,���@!��\ɊppY}�Jg= �V]]�P]"�+ۓ>�U({踾/nkK��(Ͽ�A_Q�D�xk���]���/������C�K���g��_lH���"��nx���~�w�nU �f1� �b�J�(\�����ɽ��_�0��针֊���zֶ)n�Z+��������cw�.��A'����Z��{��&���%cb�� B1Z�myi�I�� �׀qո�Q�p��~�g`;�m��#% W+}�k�ŋ����%*s���?������hR岁q�o?_�\g��:�EGq,�{��U4��pA3��J��I<��<��ŏ�Ot�z;� �ȭ@�n_S�|KupH��6��)L�֑�;�r���O�}^�.L�{�c>~imS���rC9Aqđd{.���~ �N��)��wW��-+X�j{���+��p��X���@����OI�1�Y���������y&�7Ch��<)Z��� �^���K�y�b�N��F$0��&cͪ�U*Op��yi:j�<; ����JD96�؇%��O�_�~��o���\�����/y/�cސ m�6pAx����x�D��� ^\�%d���'5���o.l���h�G���i�Ka��XDIO���G,� ?Q�'uNt�R!�#�C���5v0]2�#� ]�>\��0gZ&Dev{1�Q�%h��Z�Ls�9��%��'�/��K���U�0))uUK�;q��C�%EoV?c� �oD�P�s��<h�=p9��Uz%��":O��!��2#��E� iۆ���[����+�3
Static task
static1
Behavioral task
behavioral1
Sample
Avoider.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Avoider.exe
Resource
win10v2004-20230621-en
General
-
Target
Avoider.exe
-
Size
4.1MB
-
MD5
198900b96f3cef3fe2f5e9325c465648
-
SHA1
37074ac7e033bf789bc29f6a2b68b9b60947098d
-
SHA256
2cd897243891f7c1ba53828e3c59b32d8fc92e57d3eaa636fd131d414846b8d2
-
SHA512
9a6a93d3a294c50ff4075d8d42e2b722c4cd44285aa63705dae72d09c6c58ea508956c636abcbbe3b022ddf7d028336fcf3ba6f6aa6fcc97b52509fcd96bd97e
-
SSDEEP
98304:id8IihXTx1aPPIybTS7OU1OJH/ArxrfIItS:id8ID3n4L1Oi1rfHtS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Avoider.exe
Files
-
Avoider.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 215KB - Virtual size: 476KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 37KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 15.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE