q�G�*��B�|E�i(�-F�O���+�͵��'w���W���v|��@�k��[y������k9�\�ba}���m�let��O7�=�[���+�Ʉ�L]�3c^*�mC�%��6�R�-���=Pl��SȁU�.��Ul����V�k�L�� t��]A<)�e�?M���?��E�z�i��>as���i����d��`�Nџ.r����ҜB,�%�1zr��BO?źY{�ab~�M��'� C��wF=�IrV�]An!��ɘI�L;���i�R�� ܷ��� D,���[�ʧ''41�a���cæ�3O��G����0L�w<�\�|& ��E��Б�6�z�x�K�Z��mc���U~���!="�K�Us:l!���r^��,��u>�͎ 7Bxu�Be�j!kQ�J ��9#�j�D��[���|��Pfɼ~�f�g�Uq�۬,��'��Q����n��@b� *:��n��+֤ܴ�$!���v���Ƹ��*&���m�^�Mں@��^��e*��Y���n�k��o��.( ͺ���Yh+ k#ٔ,�͢)�elU���f�zZ�2�1��|����ŵ($@@┚�3<��w����z�h٤��JG]˸9[��ih�|��=�M��\�q��:��K� k ���1���NxkW���S��4�p�K��T�c.���u �����͎�ZÛaa��S��n*l���7�n�D�<�l���S%���4�v�S�z��y t�Ҏ;��������(#J�샶X~+�*7�$5yqv���(-���Q�]��EW��\ գJɃ!��/��88�9L�+X�wb���������2-�֔�1&><\�c�W�J�2��\�wY/�f���F������o��뀲�M��)��s9,}|�ZEs��G������^(� Hu�| ��{c�o��U�r�(Q���#b�*X ��3�Eyp�T��5Iv4[���ŝ`R��3E��22[t���$^��v+��>� ��[����A�R�������p��.Mێ����X5~��Q���O���щ��s(8�To�?�����:n�ZWNks������O��^W�կ��oE[�d���ѧF������}D����e��o�r�v[�N ;é����K,�/����>��"DHb5t������^剭���ka��C�7�e��?�E�*q�]�KY�fdA�B�}1�4L�ɣ�,4���T��.�F�- �b���j+H�I����&�6�1J�z�d� �����,Z� f�}g����|S�+݅*�lB�9�긅a���ZK�x�f�EH�ē���Ө���LJ)�%��n#ץO��3Ă�q��@iN�W�e����3�1�}XZ�ԓ�x��P4��j\��/���݁b �=~�I��O̜�0z�Q���G�LzV��O7�"�)��g���v��>�v<��>����9�7��Hj�ý` ����K��x���J�ѴB��Fg�Lgn2�q��:�?w�d�\A*����7��B"�t*���e,](�/3�.zs��X�p�So�4��zRSa�Q�Q�P+���p �5s�#���|��M��s��]��z�AW�W�bE��q���z�������3�V���{���:��v��k*v˂��s�qEJK�L�����#��Z�ٺ�_ ��4�dwq���IRvy�̵{@p��ZQ��d���%_����*���ӎõ���b�J��;*���fĨ6��0?`��4�(�\����o�z$]Yg�o9��1���sAʎjUW���z6���h%`�T���l8E�+��f`��φ�Y,H�nkQ�-+�45���*�(��Ӫ�����.�*�}*�#��t����S��D�<!���T9cR�?�W�F ^�m�s���%0o�%��vȃ���D= u;4ۉO��C�2�Xw%~����m��}�L2���_Ձ��'A��n\��Y�Nߚ��ۅO���#[� h��:W���B��D�*Ǡ�_��I;�H�ṥ�0�:�����L��N�1�. ����N�5a�(�|�Gm��&��ƖoD�y��~9����#��l2��u}X���mN���4t��Q}�4��SC���,�������>�r��;&�-�P��Ly�R�,n����M�q�27)̼K���E�?�l�ek�;笭�7�=김��`t�o������^(�Ř����C�R���F������K��M��=e|���R.l�X��y��u�������o�3h�� ��G죚���@L�B �� B��ɿ�W)���^A��<i�4|]�]��]�9#LhBk6%�,���P����n=ҭ�l�����[^�_�A1hm�AL[\���ۢ@��C�j�6�{�_�70;Ώ��|�� �I�si���N�*�vP�q���u��k��s]T8����}B!�?��9 �߾������Ïi[�B��>�{�*� $v�u��- �B��b�ɶ��b(&&y9 tƗ&$��?�<M}mcF�b��/Ή�����n�R��hAd�߹���Y�����+hF�_�ۓ�u�@$���q)Â�&|�n^( ��RRʼ�H�v�^�����c��WŌ�����u�Du�����K�DgE�O6Q+�u�pK�lT-ۡ^m��:u�1���r���hy�f�<U�� L[�E|�C�1yȈ��'����M��Ǽ�8j����B._h�2�K-��tědԛ'���w$,���\j����Xj�5v�Z�M��א�7��^���5��@���'#�W��i�����C_8��SQ�[�+����G����1��ޫ˙x<�w_���V��7�K��2����F����!͈�~�Ģ;1r�l�]d5�B�'�f������͂�0H��g� �% �5x���P�M;Wk���_ӓ�/�B*�Q�#BXfx#,eJ3V�n�aq7T���@�貭�ޞ�Y���r2�M�u����+I9�bD��}�Y_�k`���& ^w��@�.s�(��%������Kk�# H-�G�yk�X
Static task
static1
Behavioral task
behavioral1
Sample
3484ac370ca480919cde48659046d7dd.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3484ac370ca480919cde48659046d7dd.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
af083dae1594bdc4afac0fc68dfbad5f.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
af083dae1594bdc4afac0fc68dfbad5f.exe
Resource
win10v2004-20230703-en
General
-
Target
KinEr.rar
-
Size
5.6MB
-
MD5
f0fe4e3ba7063384864d08b224918abf
-
SHA1
5c6be5ee658bb9544efe05505928e15ac9dd3273
-
SHA256
74bcb2b9f2eba007d53c6c73d3c829509418b07c7ab655130cf17a66e6d294cd
-
SHA512
7561decb0f5fbd0e843d9a7b27360119f11be7dec4a8d98293ad773e64bb464571af59c25c158eeeb5bec4a05f0f4ad3785ab89341d62a4b797431935b43a20e
-
SSDEEP
98304:PIESsjUYN5/fwvQls2vUs+Y2/VxftS0vPMJjO1u0J8yK4ifv1UHf17T9j8RuTkK:PIsN/XiQlsuUpNxfooPMZO1u08yK4uqn
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/3484ac370ca480919cde48659046d7dd.exe.vir unpack001/af083dae1594bdc4afac0fc68dfbad5f.exe.vir
Files
-
KinEr.rar.rar
-
3484ac370ca480919cde48659046d7dd.exe.vir.exe windows x86
8fef9e2e34e4103ada7f42caffd3ceb5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2414
msvcrt
exit
kernel32
SystemTimeToFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InvalidateRect
gdi32
LPtoDP
ws2_32
htons
msvcp60
??1_Winit@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i30 Size: - Virtual size: 639KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i31 Size: 744KB - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
af083dae1594bdc4afac0fc68dfbad5f.exe.vir.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 293KB - Virtual size: 664KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 560KB - Virtual size: 912KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 94KB - Virtual size: 532KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 686KB - Virtual size: 856KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 346KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE