���eY����V�w+Yܞ>���)������P�w���{�gm����s�JL�ގ3�� �o������7�ۙC��-�[��I[n���P�&\-bnSU R9�s�+���b�X^��չ�),��D�v��d{LwøG�'3 ���M�U�q���y��-�x#��� <�]��&������S(��}��J��Qv]��ƒ�"l`ˁ�p�mė\�v���o�i��D'����Ua�N@v~LAڶ��c�5���*���'�t�,���R՛���UJ=���> ai��@�����py�r�����*�}�f��N_0�u��#����i���9C%��X���]:6^���1�c����~���Og�*�ή��~�lZ%�I G�V��8��>��ص����#�����#�,^pη�B�|�2O����ջ�K��率������Z�(O��/�b��K���ɧ��]t� �������D�����:��Ct��$~�3�d0�s��i����Z�b����d��[�m�h���f�3����e��n�c���L��ʰ�c2M��q�h@�i��7� <�g6G���C �CR���`F�����!���U(F�b�m�����P�)�%Ҥ/�~�om���XYRM�%����HT��[uri�4���v>�zq�v���b��ܱ�g�.l�=��Aù�t1�7�� ƩG6|bx�_�!L��f�ԉ�0>�n���Dg�����{u���а������?,��%Æ3���aJXT��w��%����˘�?F�u��Ml�7�8�هH!�%1�,W%�� �('�+'�W�8Sa�u���-?��j�v�cd�o$`���� P�%���Q�U�ͤ ʈ�����~L�n��t������֮��E�Q h�o� ��u���b��vԺu�dvu���ĺs�X�Õ1�Ը)��ϳ<�gp�����5nSRxͧ��]��˃#\ܣ �Y�-�Mh\[{ŕ#Э��N��_^����Tv��$%m5,�������e�C:\>o�R��Gx�ܜ�7ٜ5m! �9�郮�3�Ł�>6����AهC��ä���Z����n6(�u�)yo��� +wG9� �ȁ4%!������ǹ���}������Hï�aSG*9�T$�!T�k�l4��vrR�\ʨi�.��4�M�������Y�[Tp�M�M#؊�`R�uQ�� d��۵Μ98k7�9�Ӵ=����� [Keu80�@����>b ����ĢE�Ξ�;º_p �FV-�9��1w�XI"����"dǁ�>�e;��^�ҕ�sM��f�K*���Z����Ը��B�[���F\1�"���VI_���(r�~UQKp��`"s��ٷ�<7-�ʦ[5[��F qxTW` i]���M��zTy�f�F�h��ZGpgY֔���V~Ԛ\�>5�i�?�{����n�+אУ1�YN�`:Z�TX2�P�Q��]P֙L4l��d������+J�w֏�<�J�i���v� ����J�yN� �[Ґ J@ϙ�$v�V�T`T˅؈�6��~�2TwT�z�W�A���*w����T!����Ļ)o���B�~����I�c�Bo"V�`a��[�m����thA(-t"���y���8����F<7m^��9�qi�m�s��˪������b8���?��� 7A����(��h�����R�T\.#bl�r�(��`�<�k���{M�k4�dᣇ"gN��������<i�_���R�n>,/E�)}=�:_�(���׳�����f@�41C4�7����#?�\���]�R��>�]������z��֮!:�l,�{A�ؐ�e�ᮃ �0$TdF���[�������И�j[w����%�ݛzd��u��}��� ��8�&������]�顑�����^NIC��a�7��d�`B�aԺ9������=ů�^��4$���<���C�pȲ9��+ U��6Z�H�K����.s-��N�qSr��zS�Y9�o_���"o�|���F�+���'<um�@��J�P'7�cp.�Ღ�jܰZ���&��e[&�[9��8�rZӴK) 4�����*��� �2<�}�n�E���KJU�����I���tz!��sa��}���ȸ�N���z�s��G���Pn���|�|ܰ�N��QW7I#��8������I�$0�̸4U�S$��Q+T�c`����[M#nx���9�%��8��d褐Br2\� �O&!�h2����d��J��;�&����Z-�$F��4�v�=x"^ZWk�qt+���ޅ ��Jz�K���VA�̨~v:_z@���?���Vs{,՟���Q�7�T�ՠ���f3�}'��xa��I���cu+�n���1{<m��'`�J���9��4��7��z���G��d�$g ���Mo<x�y5v�yͬ��Ol����"��L[U'Z2X%������l�w�(�}�+Nm�MsF��f��.MTЩ ]��0�(a�t�!)��m1/ן̶~DH�yD;v�n)���׃z�ɵB�KI� G�^6�߅m9�ǹvvN W��z1y�»�� ��P0�������� ��r�,���ó%!C�,����/^W���Zymi@�@�&�ˮt�"_/2s=�c��Wbiݭ�A��]�i��tA��;4FuV5��||��v�U:]��NJu�C61Ɇ{!T�n� �:YBKcӟO���i�%DQK�AU���-{E'�U���w��e�Я@4�e�����6�F��@Hb'f上�������?e*�(-xVB^�����-�C�h-fU.���3��K\�vW���?9\��n��zC �Sx)R�< �s`�B/$��ҕ5k�������p�]�Z���:�4�V��~.H�����Ju@�Bdc�?��WKU��,�|��|�+Ǣr�Q��4�N��^@��VkP8Թ��Djowb�K|n��=<�Oco���s�x�{8`H' ��JZ�3��9 �cCϣ-�����I��^<R��i߾��N(q9�:�z������Q)ܚy�Kk��4�"1(�A�an��Q�[Ο��S�x���~�u_�o�6P/_,
Static task
static1
Behavioral task
behavioral1
Sample
tyozvjctjtohlud.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
tyozvjctjtohlud.exe
Resource
win10v2004-20230831-en
General
-
Target
tyozvjctjtohlud.exe
-
Size
10.3MB
-
MD5
203246690ffc26749b1fd4ef2ac6f122
-
SHA1
e9848f8022decca9a149d8b2080ab06b4742089c
-
SHA256
4656e2e1546a5735c7672738f289806644291bb7aefd8ff5940597e3aad46c17
-
SHA512
7ee4964e932d6ab05e048585a8b9d3f424606ca4dc1b99ec28df3e91106072029f5dc18618abd842f0b5ea448e9d0c23f081ce36de5c33ca82208b9a22fc8352
-
SSDEEP
196608:evhv5NqPLLAaGjq5Wz3Ro2rDZgxq9073G1/TWQC26uh3pwtAcaQCGsN/:evIYT3RPKa0ja/HC2dUAcaosN/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tyozvjctjtohlud.exe
Files
-
tyozvjctjtohlud.exe.exe windows x64
bc0de7892c7c5f154a5e404e7f38d66f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetEnvironmentVariableA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteExA
msvcp140
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertOpenStore
ws2_32
htons
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
sinf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
vcx0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
vcx1 Size: 10.3MB - Virtual size: 10.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ