�%�p%#�\�b�^�������)~�27R�����[�e�n;ʃ�5j����+D�u���"�����ri-|�Q�`|ۯ�q����>����s��d��(&X�s�d6�<ֽpB^��ԋ�G(8�&8N��� �} �=�NC(���B%�r��?5T�|m��S%�<焙w&,�D�Zw`��`S�v�$6_myq��{,��&[���_8T���g���3�xc���)�QĹ��e�?ρu�+�k���|bh-��Y�1θz(���ʀ����~ԏ(�� �z�q����1���&�2�,[���_�e����������Vr�ʣ�M|-r��Ty��j6!�_�9{�;�̾��Z�e5�y����qY�epXĩ������H�W����o�����W�����$�.��m�ؔߜ��h����m�O����y(����)��`���i���� N���EZ�MY���;(5h�&���6�yeJ;z\ E����Tr��C�.����ח��+ط%�����}��B�� �j�� ��K�՝�\��9�݁Q@��?ʳ�#ظ�B�vy�6����q����IߴIu�O��/T�I����S !V#�D�����T;�7t����F߈���G���+U۔�%��#��7��c+p{}Z�Oӷ�TP�(0Ka~��SAɷ�-ޏ6B�����.0He�1��'NxQj�l��>V��hQ����=����2��*�����9��"����� 1���RR�QՒU���A˄����54���#���/U� �P[S�;Y(�2Cf� ����|%^\�.���#�+� Ubq�o|n� ��X�vB2����pa��Ѡ�ʣ�A�>/5K?{�ڠݭ^�Ͱ�BD ��f�\�Ց~����1\)i�0Ѓ��]��\߂��M���d��D F"�>J0c�^�<����A��k�M�j�?�%f����L.4u��(Z>�U�}������)��*��&m�w����-�;����o}�6�&���� ݗ�E�ݩ G9ۻ����ӣis9L"����d������\7G{��)�㫹F6~j�uA������R�"���� �����{7�[�����\�Vo��dy�pjJ�� f���U��*����hY�DoEo fY��3'��P�0�,Xn���6�=K��\3^�7�3CE��Px�P����L1E.�^!�{��V��H�f,�����eA���䷅ڦ!�s5���* ����g�+WX�������z�� 07dNt����'`�a��x�AmO���un�X������g0�Bo�Dr���gyi����ZS�%ڟ4E�g����d�����u0���B�?%���X�i��#�H�P)�&�gX��#�M\ձ���z6;����{�{u���gu:���w�� �?�cGI3�2̣����k!#�� ���9�4��MZ/q7��RIe���_U�4(�Y9�"P����ʐ?hm���e7[�L�N��)cP��E)�я�_� �[6���y`��">�'���t?� �dy�q ����*$���d^���]^Q۩�.�����Y�Ҕ���x�Ѱ0���U��b��Gb�QO�/v���Ԙҝ��)���|���ޑ����f������[t)ٟ=m�W��zW��L;��$o�(8������ГE�_J��r��&۞}���HZ�v�kb���^y���;1�/�"d8PTf��ld�ˬ���m���.#}Ѿ�����J��"lH+s��C�9�A{R��6%���<��p����4���Wg�RǙ�D=��.��h�c�����f�C]0���`�柮��51����7I �7��Q�h_�K�(,"�VĜaV��Y�hf�]1����3o�[�����w(sԍ,YL����n��z:���|գNq�$���GT�������ĉҚd�M��\#��I�S��)r\�Tm ���V�%w~�S�Wj/i��qz%�;�\^OI��Z�����`���2��X������Y���1��v;���r9Ƀ�$�4�j2��d�a\��P$���oM*(2�rZ1�fW���v�(v��ӅW��]���"3�?J�s�K�%�� A��2z�2�#ZG�]Vt���Y���V�>�H]a����N\$F����/ڏ��Qn|+7��PZY稷���.�>I���Q��q�ߢv�plm[k�%�=(+�W��`l������~&~U3�:%��ze�9�p��㡮E�PF=?b& �5��_��z���� �"�w�Qj�'�^Q}����+K2�\p�Aj�K���3 �*K��� =���7�v��Ri��������Qo�x� ��h{B��VbA�f�L��V�$��I�hG�����ʵ?�Ck՛kF��? �Ӂ��z$o��(�uO���:1���e"'L���|q���6����)o�{UPͤ#���\�xr9��ǐ,�Ҁ�T2���,�4*���G�)@v���7_@�)l1�8���ٕ]j����U��IL���[/�wmaޡ ��Oa��K���y?*����z:d��5�7��R6��˻Z��Zb�7�`�|�Nf%i(Q���y��b��B�O�F�u�O��Ѝ���������}��[��E���62_;���Ϩ?Xe(Źեc����j-�Q5o4�L.vvǜu��N=���P�:�LJ��;�W���m�8��Ob}���[��E���t� ?X0 a\�]a�tU�rYY��=���y��Iu��9�8G�.�vd6n_/(S��L�rD��yBK��2ò��;Ó�� �K�'`t$�&>����E���� ���'�+bp��,Z ��BbE}�^���h�|TβDόc��8�Q�,�!�d:͆���\��L7��A����(��L��-�+���}g_9����r:rE"��m��-�$XI�&Z�Y��,=E�{�`�Â��j}�c�TK����*���~��uL�Vٟ�t �d�E�x���Gg1כ��u�'QH��P$��%�s-U�N��Q�]r&*E�KM�|�<�Iՙ�^� �bY��g/f�TУS��'�^��oE����&��7�"��
Static task
static1
Behavioral task
behavioral1
Sample
launcher.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
launcher.exe
Resource
win10v2004-20230703-en
General
-
Target
launcher.exe
-
Size
16.2MB
-
MD5
3716b0a1a2d1a0bb192476c41bb0dd4e
-
SHA1
a74bc1293f616c2de4458dbdec8e6aae3966ae1c
-
SHA256
1206c5068c499556270e9b5f38d1294fe2b87c94664d0110c2d7b6859f73feb2
-
SHA512
4db49068519f7f77112304b01e7755f3e84c4758c9304f31234e2ebf235cb5bbe16260dec192c433e101f8c6434e4e755949e158e8c553f9e54c8b0c5c7d4620
-
SSDEEP
393216:FI8tMesBJ24JHtc6tkmDqF4jY6wXlluA74ZtKNtVn3AsXi:i8uJ24JN7vqF4jYR2IisXi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource launcher.exe
Files
-
launcher.exe.exe windows x64
7963d3a67cfe4f19646b23c68d457d1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 16.2MB - Virtual size: 16.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ