i5�Ô���TF�z~<>k���"�I��e���)M�хk{���nh�l$��C�(��꒲I[�k?�]c����.�~�F��8�b����Ȼ� ��>�Dx���V��M���_��`�v�����igu7��'��la^��s�V��0��q0���.��ݢ^���v�GKc�?� u{�\C7����T�?9��V�T��1��uA��eDP���p�����8S�2P���GW�*9;x�kW�4�/O����H�ܲ��������@�P�9� ��ѕ|<C&���^�q���%��)�_;�/�����@��vnʚO�$�&��6:�J�I3B0[��#ٞ0Q�[�@C����g�(ﻓ������J���kW��l��r�d_U��c�GV���Y��|�}ۺ�^{��f*Lc���h�h�:#�h��}k76��0*%�X��*�>�;*��{tX#ݱ���N��re�@7��>~��ۚ~{��ɾ^�ӯY����J�F��D�M{�Cghv�������{��t'=���y�t��������m���� !K_vF4H[��+�r�$%��k��z�9<ƨ������Z�����)�"Lj������/�U�\�� 1�<���}R@�D6�o@�n݊�tT�B���S ��ro����'�9=��V�D�w� ��c�I�UT�Àj����:�r]����#��7c��S��{0Ajc�XOD)�)�+��i�J�<� �m�T/cn�z7 �b?0@��ʊ�x���ݹ# �����bf��u��V5iI��I�Aa�(I��n��~�֓X&�a��7��Gd̽�j��GtH�أ��ռ��Es>J���,V�β6�#�ܕ/���^�Z�k9�~1ZS_�8�����Q�0�� �����_��u��ރu7X��*�&{�ȃ����"3Շ��O]dMf6 ?�!��o�P�|�6H�K�v���Ivyڠ�P��ȭ�ICJ�a���������<���E��[�oؓi]Y��?4{A�2��y������kkܬ�.��v-g�U��$N9#��6j���r��������\�@QM����$�E:�g{E.�FҬ�.OH�u �k�(������q�,7侮%��P�� ��p�փ0��v�o�\_�<Fղw�K���P����V�l����i��ҀBE��4���=qp��R����5ȯ�G����fi(Ƌv���ޒׁ|/M-p���s��j7 ��"��b=�PiT�����d�p�)�-b�6Ǔ�#h�C5Zddal��|�a�$<�̓�iZ��,��Y�ץ�}����[S��j�~_#�]���Na%�k�SD����4?D`�Q�˄̎d���;�[ Mj �̆u\�L�\,f��������ǖ!�%�ƀ8��"�+r���#��)\ZG|E&�*�l�ҷ�_��j1��)�r)1⾞���9ִ3�H���lVAh��p��T�he�"�H]?QdG��q8M���^RT���4�����E����m��<㨷�UЕ}����6PQMJu�X��.I��_�`�s{�,lǗ��jL���f�U����vy�ܽ$���T�F���S�5]r���M=Ȟ`�9����B��c�Ɇ��2�b0C��.��?*Xpen���}N��2w�a��i���ɤ#T����o�� d`,�6�c���Ȯ,Nޫ_ P�(�Dv���ʳ1�����(��Xh��A��b���4A�d�k�;R��?:5��wɒ��w�¶����-)qH�<��r����S_1)� )��]�|��t��P�\�f����u���KD~�kUծ��.�#R��#`�����:�v�9ͼ�M����y��+�4��@�}�[��\��*��מglS@B%��,� ,�Z�� 2�DB��s2�ث��4��?�t���쬽Z���oe\pb*�G0N����^��^ՈI̾Cl�M+yZ|��N��3�}����k��i]ilXS�#���՞�����}5���Q}d�A.K�PE֖�nA֯Z���Aɍ�AXOGZ�L�k{j���I僪욙�rP����m��Fw>�&��`�0>6������ ���՛�{([�M����""B�^��s��;$J�R`����cO�9�~��^�X�x����vQ5 �¯��i� 9mn�]loT����~��巍ro�5����v\����'�}��M\S��M��P�T'(��� Ŕ�'*g].���/���0��5�@a��O���d~��e.���kb,ν���`�k�T��0�T�0"��E@56.�����5��(^`�w�Sg�@壘�e���хO`�L�LK���u]�pn;�֎��qp�Z�M��U(�� NG�Q�n�(�@H�GB'v�c�H��é�7��X�Ö/��۳M\29�;>-PN�j��'{����cw��$�:�gkm�D��nӜ��L�����M� �m0vP)���:�� =*,��Z���F�YP��aWqyɡ \h���<��� �l��AwY�wh�:��2��C������&� �������<�x��=�����X������,�~�d�KK���k%{��3���e0R�Ӻ4+���K7�/���� I/ م(�,��ۢ�T�aぁM9��ͼ4�J��~�TH�=O������%�s��#e�ֽ`�S/��F�z���Ph�����K��-Jݎ�!o��G�&0�`���Y�ѕ@$2���.�\>�/߾65Ř��h�<I��f:-�}�k��y���?R��bp���J K�.aC}q!`.��~)B��I��A����L:UJgr�@aʊ��d�����i������$=���N����?�#́�H(4k�T�.~���Z#�}C~�@��m�j���K^=1㱟�B��ѪS���'h� kE���*6'=#�9s��=�<�P�4�D�����0E��VQ��/�=��BQ������I�Er�n� �w��%dJ�lN���Y� �(�{�Y�Ԕ�JoQ�-��i� ���|sd�o=R�-� $�8L>����j�(�}�/�s��?�2��SYb�fʆhhO�j���ݥ\
Static task
static1
Behavioral task
behavioral1
Sample
dexx_otimizacao.exe
Resource
win10v2004-20230703-en
General
-
Target
dexx_otimizacao.exe
-
Size
11.9MB
-
MD5
e09b4c65367fd2249b770c416969ebed
-
SHA1
212827498cbd6b8f9125fd900f8592eca89d2948
-
SHA256
854985767f6128359b6f262f42dbb2ce2b231b0010ff6de963870e7852b22e34
-
SHA512
6cb4251ffa8fb6225127f8f7475df3a4c56c6d44d77925445e04ea5c1d0b56f44042ac85bd054ca17d17d341e97c3ac4c0e13e0ae87145bdf4f240bbb3d52bff
-
SSDEEP
196608:jKpzOpNEody0fkci0To8ns9etYfQrsH9okmik2kFeNK5z01DUIllJD:GVOzK0ftk8nUetS9okTk55Qtl7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dexx_otimizacao.exe
Files
-
dexx_otimizacao.exe.exe windows x64
ef23d99d8a371c2e52eb6a5dd8d17ab9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ