��,�^����ޥdQ��b"��A���"E�"��T�Rz�t�W�e��8��1kC0���Ȥ�� )��u�.�_f�,�k+.,O�;��>�oS̓�d�(�DϷ��ta���`a�K�/��2`�� yTU3A"Ҫ^ي��{�����ҏ,�Ŋ)�|:�����2�Ac���I`��ݵ�\����jv�@£5p��`�V�U�����k��a�K�r���(:�7M� �0����S����0i�������=��7B����lv�z���:�u�jTjv:�?ìWi�O�a[��d�Ȫa)Nk-��Am�q�G� �y���n� �� ���r7��/��r������� d�|�֭\���ݧ)6������iLY�ˉ��F�^���_���$���])���G$z%iP��I��F��7�-�~]=[vo���}ZuY�c�,2�0�F-�{Zj�j���1�??�t����%�.�Q�<?�[�nԁd��l.1�� �z���^��zJg���#Y���֣��s�Gƫ>éAU0�CGq1D��o�?#�>Еt�;��Ϥ�s�E䘃5�:�3���HU>h���4d��^I�퇎^�J-Ra����m����#r����f���X���u)�f���GId����Y�V,Lj~�P)#��\X �xK�S���g��[E�% �\W��OX�J(���";��NW`=K=�0����{��ay(�L�8 ����Ӭ�o���+ <�H��� l70G\"Na��3d5�dӦ9(D^��ϵ��"�ul8���9��+����yQ�ͱ�7|��s�;ҭ~R-ł9U�#h&`O��� G��;1��y�eD�#�`<�UY�ag!�ryZ�ZM����<P���M�y� ˀ�8t��Ζ���Լ���j�&9�%p�h&�}^�̏ys�$4� �%q�/ֻ:4�a�uC�X�.5��Bm)��5�����;����_\d�%+�a�?��rf�T���1Ӑ�� ��V���i�{��St��&��,{]�2.\c�F�0a��3����xrv@m۬��1nrj;�J�`9a���u�I���չ�w�Ҁ`��\A[t險H/��m���1$`"�A��ʌ�P.䬭�' $}r��d,�j�ΣH�(�M"|�Z<�g�Q|�`K��] ���8�'I�>.4�� J�-����H�].�Q��Wvݺ���##�z�i�%�;L�= �����>���g�t�]��w�Q��ʶ��sQjS�p�sM��?��[a�3�h�g�P���>�� ̪e�f%����{l.�9�V⳨md�-��4�\~�r��dGP+���#��~˥?���h� 8����%��~.�Ш38l��F4��( O��.J�����x���-j>��\HŘ[����AX)��LS���U J�l�q�J�:���Wz'���G����t>0���*�!���q.��JI�`��fi�s;��|NB̠�g�d�Mޫ��40�^���/?�o����7ol��h��CUq2D�[�(��k��q�+N�L��/��Ab�Zr��;SO�|v�i������/+��,ZY���e̅A vy;�ձ���"N%��in����U#ڵ���y�uQ���[�,T���l��i�4\N4��&�� �Q���K��Y������̸ÕZm���UM���fmyܵC>�}��� < - t��l�&�m�Z'766_EA�Q���c#�"�LFI��Nr��t@��1�����:g6�F�����q����n���@.H̏.gsr�k���PLUi��yJ��T.�q��Bx~�U��?H�V��Ό���s;��:D��/�F����r��p����K�O���0t�jl(o���w�F�K�3�j�*(���<{��2Y��F8:�\�����O��Hg��J&D�".'gLt�lSːT;��;ɞ_\����9C�Y����<��Fp0�x�z1�.�Hz<��f�#�z�⢤%�ي\ȡۋ0}8��7��X��id����:V }y��F(��v� N!��x�D�Ls�k��E�ł���_� <-���k�0��%m����?���:����tj]�emk��VM]J�7�����NO�-���o�Ta��[2�W���h\oNh�w��h�p��m��Q��Զ8��L�s/N����!Z�>?U3���6����nkVY���B��-��]'r�A'�6�}Xc������i�!���7���\U��@��;�ӡ@ׄ�߷*��< ��(q�F������gp@��#=j%�P�7QTk>L�����⩂Uεɝ���*zW��+�����|��O�.¹�,��X����?v̩6��Q��Q#l��+r�U�:�s��TC�k�i,�]��6 ^�q�P`1/����\�? /\@U�+�����cY���5�_�{��7� �� ����Z �tw�v~6y� ����lO�7�������_aˏ����>�7�O��%E��A�r����7��4R��כ��z�/�F+hpռD��;��!���.�eF���`��S0��L�5PǢ���Jў�^X�jk�7�={mjĬ�c8��a�Z�*�6 ��`�� �z��l$M�%?��y'�ī�E�r�ᶷ"��>���Z�o�;�+I��'��L�j�ɯF��*SA;5�է��][���_��hpk����Ћ����}��&1}�u��Q��/Vr5 ��<���(TRJpS��'K���U�-�iP4U�o�����$c�P�.q#�2��'�~�{�WB [,��Cc��L��U�2+���i'J����(��K�.VK��H�l5���\��G���X�z�v$�/"�4������q�8�����5#f^/�n�H�KΤ�1W&5%Ȑ�%9����o[�I����+���b��a@�7(�>_�T����.�y(ʞ[�(3��^�������i��y���q�mܔ�Gh��c D,�@�w���a����O�A7FZ\��1Mc��{{�P���/rю�u�OI�p���\Qm6���q0+�$ҹ�)�{� ���� 8W�om9�*ñ@&�gO4����
Static task
static1
Behavioral task
behavioral1
Sample
autoclick (2).exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
autoclick (2).exe
Resource
win10v2004-20230703-en
General
-
Target
autoclick (2).exe
-
Size
11.8MB
-
MD5
1294281dbfd0bca99e5e696b24427532
-
SHA1
e6bf82ae428bf2c34a9269e59b5db515c10f7bbd
-
SHA256
bc8ff526ced651295f1394f5b994df93cc390f8e13e5d4b2ffbea5c7530114f4
-
SHA512
6c15af4a3c864b067dab85e8ca67016739a8c41eed79f9c30ff056ec3bfd5600c71f72b32532fc7f52eb1118a3591d0570d40ea8b54be55c39653bdb98ec6d5a
-
SSDEEP
196608:gz08t3q6WAqF8GlSUtG1Dj4mK6Cv5IKvQFYMr4z6d9LtPvaXvD/2QRV1DM:gI8tGF8sStjHK6+50Yaoi1NvAvDOQRv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource autoclick (2).exe
Files
-
autoclick (2).exe.exe windows x64
7963d3a67cfe4f19646b23c68d457d1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ