�6�� �a��S��@P_kvr��ѪL;8�zX�=*nj��sު���ƕA+��k^�dS�آF�]hWW��K�&f��D[�����@�J� u����-c�㢝@,|}a��yE� X`1Y����_��C�ë��#�2W�cFG\Ԏ��<X�ĭGn����M7�Kv�X��Ο�ڶ�5�d\�=���X�����<�59 �l-�%�x����������zXw�N:���+%�&���]��� �|��0�`h��b�Z�\����"Sn��SK!�2+�m�p�͙C���M����;&�,~8�eF��WR�b�B��ׯ� +���*~h������S�!?@|�����ї�M���P !��)�������� J[f�)5|d+yYҶw�=��5�u`�Z���k�vd��FN����]�&�4w[��%v`��*���7`�%@�эW����{2�fƩQ��i����I�?1�ǝ�័ˍ���9���N���DvA��#"���u�/5*yz{�S�mi�����j�N�VX��f&r�{���$L�橤L��i�J��=M��G���g>u�<�&����P�Pv�=����b����=m���7?�q֠n|���/��jW�wܦ-�YX�h�~�g�S���_�=fX�rIT��m�R��Q�c��H���0�V����@E�s��džm7��QE+|�^La2TT��M9㺎�s�p��hU�}{��&����Ǧ&�E�7����ϓN����ԗ�xƇv�����M�&S&#�D��k�����] Y+_��������'~lO?�h]��xxM&��n&�a�1J��4%��E["?���������\�A�t�y��'��T���f�:.�W*������l���fn��@�U|����;���8P�C�Ҭ������KF �خ'l|�<A����|N��r@ �ʀ�H��i�R�p/�]���+s"����3%��������NR����)}�26@u[�se�}�_�M����k�``��vXP�n�>go ��9#�(~��A�� ���X$Oa��O#m}!���ۓr}mu7C!mfasi�M���48��JN���ȗ�PO��J���3�7_�ys���ʣ��H��o�Q�"77�4��X*�%p�EI*�N��*l���ؘB=�%�����{�R^P�U9tj>�� "վ!_���Nsқb�x=�>&#�HR��Rx�>"��,��`������W_H삐>���ŷu��O�Ӷn$�X4�S�L��J%�<|�� ����} ��̘�ڣ��\5lS2s�/��C�O� �� ���$B��L��n�����K���-�勈ƪ����Eb�v5�fݵ���z���o_;�A��X��Ha���$٪TmOB��$�n:��-Q���.Hq���8U����sD�"�v�~�8�vǣ� %��A�>'�@��f/K������/�U�b��r�̀jOW���Wj�>z<��jS����%{W�d̃��� 7��QsO��ר\���FmTм@�]������u�5H3�r�۲<�B�CY%is.�������A_±fLWq�#W,zI���'�p@���T��C�J�+Tf�}�*�8-��9ʂ��>p��nee�2�4{zX�a�}P<��h�<3���rZ�����d�ر��������Y'ȸ����+��=�,�d�����V@�bZ�r��"���p�]��% 6��7r{X 'n��NR��ܰ��k���u����� �Ff��?��,=z.�iL���}F�d�|��i�l �`�ʎ-��_�.�P��B`�6|8�[�!��#h�����-���X1��d�}i����%�[�Bg�W�{�jn�D�����p+�V��ޞ�JJ䚣"����&D��Y��~�ռ��'��%.˸U-�ͱ��:��=�4��w��9���c��[����*����fѺƵ�51%�ٰ��Ҍ��Ohg�\]6�� �'�u�J����o����r]�i�/�.��"hto/s�ƴ�ܺ�ǵ':��M�f�����\Փ:��=6�����8��>\5�'�P���� w� � r�ހ�W���(�]�*��sZ~i� �0͒�S���O�w8n~(������R$��<���������sOu�����G������G��8h��S�������W��V�"}�,�O��fEL�JG�4�c/a9�Q(�"G˨DZ*6��� �ֱ~�?e��v��,M7��8��ւ&���4:��a �z�� -V��%�1[����o��# /ɝr�Q���;�I ��.�B����_Z��O_.��"����^i���-��,��s�y���.�v�-W\Hɖ������}X��P����s���P.�?����u�Dhhg3=�M�"_U_�'y�-}�d�V��}������4F���?̪I /zQ����DA�D}��[_���xMNKy��#$�_#��bh<q�W��ӊ� ��T��0g�/'�m⛌wp6�`j`y�6��"ȟ���wÕ�D,]U�w���_B�-8� w.T@���NI�7��~ ӎ��A,Hdm� �4����Z���o.j���&�hXLq������v/^p&)>5*��V���X�}�8<�q�rkE�q���=��O1��&Z���eDT�.������M�\ǒ�O�"s(���'I�M��d��Pw��\&��j�)$n4���X���+�8�V+���۞'�Xd�a���˜-�gmOo&�(G���A���S�.Z����!�����>=��yO�Z����=K��_�Ӎ~��%�� o.��s| S����4���8������4SnE���K�W�~����r2��'�e���zY�1�����@[��L��<�j)d�C�̧�^œ4�~����'�g��g"Z}hP{�e�����vT��� K�S醒yV:X;�#[�x�^���R�t����:M��oc�������䚌ф'}8�Gi��cs�YekЦ�1�9B�a�A8�1�Ú���y#�U펂�ck�~�֭��c�Tb29T����ڝ�Z�&����WG&_W^���@�t����6gJE�
Static task
static1
Behavioral task
behavioral1
Sample
amidsfg.exe
Resource
win10v2004-20230915-en
General
-
Target
amidsfg.exe
-
Size
22.8MB
-
MD5
3cf3ee2eb8f0e74cafca2a41f80decc6
-
SHA1
f1f26c28f6b03f824470afebc65c2bd725c210ff
-
SHA256
4d01b76695d542981e21d77b2f786051a1388b609e245bd828ad567edb8af4bc
-
SHA512
fae8d0604061df5750aa80b438c6d8032a60ca1a09bfc912b527d0c35807150d790a8b6325fd2ca4b8891a7ae1726bc13f47fdc86d975cdf9c3c16467b6f7950
-
SSDEEP
393216:U7L3sNAAW4U29yInXaP5zuN3Jc8ZTvRbFJ22qmRMglCHuY0Cdab6DVArWcQXA3:k7sNAAdUlIXNss42qeCECdaYVASch
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource amidsfg.exe
Files
-
amidsfg.exe.exe windows:6 windows x64
00ec79d38140327a3c9e9df18f0ee262
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
OpenProcessToken
msvcp140
??1_Lockit@std@@QEAA@XZ
winhttp
WinHttpOpen
ntdll
RtlVirtualUnwind
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertAddCertificateContextToStore
ws2_32
getpeername
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dpE Size: - Virtual size: 16.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.h6N Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.G1+ Size: 22.8MB - Virtual size: 22.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ