)P� T�1'�o�B֤:g%@���`�pΏɵE�����3���待/��/+��%8�`�� ���Z`�w�&t��S����_�����[��+T��mQD<��@)��R>nݶ���Ŝ0xlh��ёW}�� $�2֣]i���<���DM���o]�JI�,څ�+�����&�����1��bϾ�e.nl����=JX����MwC�QhrB&�mz�GЖ�j���E���p6�hJ҇�B��<FmsB�����;��.,ښܒ8�I\��� ���2��U�ke~<%�5N@,���u��w�'����\�;V�� ,�e�Z @�.�����q���i��oO��p���X��ڃ�߮TWb�HW��ɤ�,�T �(� �+����T�M�S7��!�y�����M��e��(�8�x�#�o�D��ΘK�%�ɶZo���c��9^��i�$�����۟+u�j�o�^qR��������?��ƴ���h��W4 =b�Sϻ~Kd�c�*7 S��h�H?>��SRn��J�v�`V��b� ��4� y83m,�����n�F�*h�E _�K�z��e���YG{�)Y�W@�����*���F�-�a�0�E:��7�\����0MJt�dfE�g7����� �p�&qe�_�I�s�7do��:��'rt>-��������䃅��P��]�!�E��^�����n$j{�i`��P��^��~���3�(�Y�Xd�ܸ����p��bn������1a.a=��ȹ��d���j[�aFO?v��f�p|����ݏ���9,V���1�T��R� �"��rwF��{o�L^%���r`<xST�S��r��#p_в�j�U�BGjĞ���{���&&����$J}mֺ�eD&n�{��Aa9� 0�w��� �� 9���q��v���fm�_^�T����|?_`�����z�%C��N��3�R�m����I�?чBQ��Y�9;!t��(�!)��?�z��=�J�:Z� >Ȋ����-����<���(U�F�t�)��9�o��Ÿq�uVJ���o1o3��n�zG��YO��ۖZϓRR��]����t5�d�;wmF���`L�,ӊ����VVI�d��e����,���p�H >LV�To����v���������KU xB��Q�<Jgiye{���h��g��q�@�=LTz���#��|]�m��`�\/��,����9p���[�e�+`���rFX���8�!}� b���2��\��q��^R R�iΈ��5�T?:/�/� ���})$����MeU����x�-qbK�c��O�iB#e1��6�aHYd�w܆�G����Z����xk2w˧y;h� �ywyz�o���p�w.=�VEn1��x� �X?�$�����@�g;����R)v��$A2�#2�QE���D�CL���d\Ü��ᄬ]�fގ�U�|se��%Σi*M� �� ����R�W��s�)�O������H ���[4{[� \J� �sP���l�Ք�&���d�q��i�r�8j���~<�COe?��[64c"�`҈a;?�9��3,a�@�]�/��1�ArJ��͡ݍ�]�k�p�vNl��|_�R��6!���L ���sŅRo�H�� [�%4�d �i5z�s<��0L%����u��p�' r�Ƭ�e��V��E̎�Y�vj�k�������NJF�����$H��Mo�S���J�Y��\�-�bq��1EI��yu�N�����0W�s�Aˌ�(R0sL�2-���(�k�}Jt��[6�]���'-1���ڐ�(�ӊ�*X05WEP��s���ɏ0�}�����yV�>L� P�o%�����g`�:ʁ:�(N.�Ti�����ː!Ov5�l�m�F�Oa�ǐQK>Ny�o�q��b�0��� t�"���C��m�����`�.���q��n{o�`��yQ�ߊ�D����y��qjc��d~������3���d�i%CO,����� ��L�SGO2�q1 ��/�}�>����z��g�]�S�������i.fu䯏Ր5!|��Ar�js���,���.\Wg1��[T��T]�Ы�!��� ����ljێ��E�<����?Ά�a���,v\xod|���� �YpŇ )kB���'b�u��f1�d�T�~����ɕ̳�7(��7��a��� ;M�oz��~V�B"xoe����"�'up$�gS/?S���B��n���.���P՞�X�iYg&b�!�lf�!�t�b5b�t`b��n1�%q6<���滶�s�˸ڜ�9:cKk�F����X�P����x(Ғ����jՇ���ʂ�/ �1,q���b��`�@����]L��I&���vp����XP��a,^� ��͚�5��j¨��2})���N;z�\��>�0�X�̻�ٌ^q�"�;le ���I͛��f������} �����,�d9V�"ؒΪ�Z�٢m�A:W����g^i�1��\l�����gV�s�_�����%n#�c�Jψ4ٚX�z����}���~]/���;&����������[7w�y��)��C�uI��K�%�M�ږeҙq��K�X 3&�NU�����)|�J=DQ�rOʇЎ�����4�4��� QT���S�{"�Og���v�܄*��l���s8m���9��m���uF�')w����_$���Y��Y>��EYr,q"U�9����7ӿ���V&��R��y��أ}wsx�1�4�O��ՊC�;x�b$p��Ү��*t���\ߦ��,��u&�=Z�ⷊv�D�i�+G!���4h�x����an��;_�K�*ԎJ`�{���抚�{ٍ?��G{ ���7]���&#�P�m��h�#��3��S�Ց_��x!"�/��/&S� ��;ܠ5��˨_� �غ�5YU�71Go%�?�7���ɬ:�%����^5��4����P�4��G4Wq�FC-�f2&��]/��&C�VѬ#/xbi�Km���l^h�f�en�O��wBe���8�u���ƫ�}�qw���.Q�5QorVX$��|�xq�$�m尾�����Rɹ (` ���;��
Static task
static1
Behavioral task
behavioral1
Sample
pozeMenuTroll.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
pozeMenuTroll.exe
Resource
win10v2004-20230915-en
General
-
Target
pozeMenuTroll.exe
-
Size
15.6MB
-
MD5
95a03c6d4007db63ac5ef17ded927c74
-
SHA1
5fd3d8bcf9284e881d339a1500e1ae4be64342d7
-
SHA256
5ff2174131b770d348668ab821ba82f64b4871a52b9c967158fc0c8834941d9a
-
SHA512
84cdbcf4bd14453ce54084ddae2791be747aabe7ae6651321e2073bf028811b8f03da7a2c84bb52f07c7900b897899b2aeea7e37f869fdfb2a15cbfc426995a7
-
SSDEEP
393216:Y3whRZ/eiUW38pwBQGupa1iwrULtwpFx:fRVlp38x/yiwQ2x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource pozeMenuTroll.exe
Files
-
pozeMenuTroll.exe.exe windows:6 windows x64
2918bd4671d15df002b7af50d7d10b20
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerSetConditionMask
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
CharUpperBuffW
advapi32
InitializeAcl
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertGetCertificateChain
ws2_32
WSACleanup
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
Sections
.text Size: - Virtual size: 502KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Nt9 Size: - Virtual size: 12.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.TE{ Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.{W` Size: 15.6MB - Virtual size: 15.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ