6�`��T������IS�$�K��#�����j��a��_��hL�8^�<���x�f��^l��~��E$HJ)�eqH���;Ô ��x�x�� �y<2������[�F��l��K*k;��W�U�tiM�ld���йV�a�Dt�����#��4�@��p>�"���|Yb -��!��v��^P��Q(�N�(��˗��%�B�3Y���MZZDZ��+4k{Z���.��T���3.�m���\w.Q��+������;6C�i��&�_�э��q�x��-q%�ৈ̊��qD���~^= �۫���M\@Q���*�}�L���4�x�H���?�y�^T2չ7u+0�8p㣧��Qq�E���bW����IV��b��1��&Gu�T�������g�̄�r�J�X�E�o�.���r��r2��E�ۥ�d�"��&.�]wUQ�xt�z���Cn����k;P�0�=�T�K��4�x]TS^̞�Gd�=�c^!���B��k]���`F�@u?Z�(��а+՝cLf.@ LC� ���ijg���KY���YF�=Ng�9x����[-M�I��S�V]�,'нA�[Z���Vd�V��!ͼb������)�8�/C�'}��&�#H����0��`��R�,����~B0����T�{@7��\�����'[:���} ���mb�ɩ��2�� ���.��h��ĝ��}�]�I���-Ot��� �`�;(����c�z���9�#�Y��T�{�c�����Vv�Oeن�Bk���L�� ���݁�E���`A�{O$��\�վfI���%c]�A��BNi���s���cT{\�(ŀ�����}��.���l���ghX�бG�~�p� �� ʻ6F!T���I��K \K�.=�UIf��`��/z�������Y�&c}���)�J'���}[�4I�)vB�X�6��P�I�o�)�XMk�� ����s�Җ�c�V4+W�)��-k��:�a����)�dG�;�Ŭ++�I(ԁWW�����t�����0 �,����9j�q7�Ⱦ =`��b����� x�.�a����RԂ��gc;���ؾ�����V���rl��6l,"A��|��-�L5��2_��]�rA�ݪ�Av�v.�h�WBIB��Md6P_�0��>� �@\�Ù������=&"G,�Դ(���e���Wz��0��|���}�.��Jh8<�7���F������ͲaR���~�%�eQ �>�(E�� I��B�涸��mL����}���gS4&̆�� EUw ёt�����s,���r�����Q�pa�}߬�v��%����qQ�����Dz�I~u���r���p\HCw�ҁ`��8uvd�"pd����% VDq ��E��Q�3i�h:5ry��;�<���aۧY��,�}6�Jt��aD/(�^nW���ϰb��0ן�9�U�t�D��v�&��C+��������'�.^7r7�; �&EK�z(���|���Ͱ��3!���t�D�{��K�{�N0A���{d>����|B���� FϕVv��S�x�����0��[�0\+�M'����&�����!��jM*p���Cu�# :H�����v=[NՌxc2�2�zz��Տ�r`��t�_���S�5��l�=�Q�Z��R@ִ;�K�mG�� �-�KsM�_ >$Y�ᕔ��K�������z��6tv��6� ����7_���C`2��R[�V�ܺyy@�a�\��抱�a{��r��)_3��v�L�X�j�V�;%��`����HĞ�M�=Y.���;�d��X�^�m�V��El��8Y�϶�0�[Y�n@b��/�����ӈ߬s�l��2����o,����f�&&:�W��r���o+.��%�m�E��|�sJ�,<5���f�J/\%���e����o7�:� r*Sڋ@42:��7��7��������v�ec�% H��%��8�\A!?çy6!�'Sn��dw��xH�ъ�ϔ������i�{������CvF2Ս0�xK�E:Mm�)v _ut;����sZ�%p��L��C���$��C2 49d�45�)����@u�'J��QC��З�v�������jA��x�Aڜ�D=1��_]c.�y���B]6 �+�]W�F��Z퉋���$��a�p/L�i�kʑ�g��{W4ek�נs�b�?b*�(����]Z�\&H��tu��� %��nkds̜�d���k���ush�\����-���R��)���X�7��)v'��\Jb��� I�C��cGQ���]�ڕp�f�#�Mcw��Q/����`����gg"����O��"��U �t*/����n���͏�([��쌱 v�n?O��3s�5>9�rѫ��͑T{�����=��� �@�e�� �r]�����̓����o/n�E#s:�`JOC���)uO���s��]����Q(�y�� od۪��^�u8�$|���^�4uX��?O���u�9�869U����Ȁ�@��F?�df'�=��$ۼ��tݧ�{`�5=�8T��9T;|2W��a�Ȱ����� `j哞�ރ.o���^��F��j��_��+��#ú����]f��7���&zÆ��?�Zj���N_���G�5��T?�.�#�rl�����C����q���p�2��������i�y���S�Eyծ� �ݮGt���Vvm���}t�����=��^�w|�8�c�[�������b�l��L�J/�r���ې� �����1v�1?�}A�݊�(���R����:Ƶ��l�n�ys<_�]�M��ވ�<��ŽM� �Cǵ�\��uӣ��$pD'�k[|7�>�Ƈ�b�8r�s�/�j�����8YЋ�&����J�p�S�鸡vƟUr�E+��v��(+T��0AݍH�}pb�Y�u�o������Z�.�cM+��j�����c����&u t��ӣ��]|B7z��M����@��nc�~(�C���[8��&���.��#
Static task
static1
Behavioral task
behavioral1
Sample
launcher.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
launcher.exe
Resource
win10v2004-20230831-en
General
-
Target
launcher.exe
-
Size
11.8MB
-
MD5
1616e35dab3b7a5b48767096a7442abd
-
SHA1
41e1c2b78a2b548364553332b15463b3780f09c3
-
SHA256
2bb8c7ac10a1000a2e40312ff78ec22097a0f2a8182ee17464e2751f3dcff554
-
SHA512
bed0a7feeff4a6aa4650cf3941a345ff1e5017281b5808dda76bfbd5145b5032ca6d5d5bc45ba8e6d79ec9f1e377a8cd67f39fc044db4e0926f86acb7bad31df
-
SSDEEP
196608:WFF34uLxeF7CmBPU/JrhGPrwvz08te40+DgBjsMT4jvet1qhoKLfDR3wXnDKF0Be:i3aFPIJZI8te4ayMTMAyLVkDwH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource launcher.exe
Files
-
launcher.exe.exe windows x64
7963d3a67cfe4f19646b23c68d457d1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ