�b�����Wj!�\kXY��(M&�C�Šk�'W��XzN����=�D7�*�zߌ��3����8�AI���/h>�%��i\XA���q��R���n���X��QV���6033�<��Kx�h��B}Ԙ d�7���sK?{_��ҧ>-6zH"�QN������\���*�v�����;�$��9�rh���Zi��3�r�=ո epH$O���/�[����xo��nn��w��c\�"�6�T�fY�7g��7�x��.6 �������(�nO�,Bq/j ş$"s�E)a���A�fR�W_T=c 7�/���$vDV�WX;k|)� ��իV�J\{7 I�(�I����Y*�M������b��lj�v��i�E��\[�Km*����F�܀$.��vl.���P�~���Sj'^I� 8���^��Dz�@f,t�t���+�4���p@a�Ϛ��L�_����BݜJ������b����/�9�n�\7���ϵ��vg�2H�5��v>��d�ݟG>����;%`)x����U��3�c&CN��&��X��!�L���9���s���+i���K��fSQ���n*[����5^~��$y0�>��mBy4�� �;�78Ԅg��6���yC[1���gr�ʼ-�FW�&�jl~����U��@D^��gp��=������%W�B��4�S�.�,5γ���dXT蓔Z��h�v�� 7~:ꍌiR�X ���<��2�?ޟ�v��}��1��� �����9!G�]�u[��������熌r��Q,6�K0���d�72��k�H۟6Ѽ �点�i��y�7)rt3 ?�r�h�H�� �2iV�z��W�]E���ǫ��Q-����dC2D;�d�6b���ݘX��~e����:xwz ����忿����q(�;#ŭ1��.�]�]���!'�C�����x>��.4`�@N3Ye9D���s�Ȓ0.)T��~�+<����6��6�Ix�\��N��~ڷ�F�ʲR��n�iG9�C�]�|�8~|����Z4 ��GZ9i�A���Q���+b8�o�H�6B�6�6��V^��|�ӉUg���g+��!�v������9��l@B��k�Peȋ;Zl9>����-��X���/G���|e8�v���uK���(%�)r���L����=x�4S�Q�$���A�P�Ҭ� ��?�&�0�-�2�/a/�y*̣�S� Cv���d���Ό1���R���(�Z�Iݼ{Y�����fqB��)��eP��%�@@���__уv^ãUa�|��+��:���=�����I:�T�bC�(�ȃH?G[���qޚ�����}ޥ�~X 47��Ȧ��&��++@= ���[��?Y"w����#(��OG&�xu�0��I�g�����$���]��]|����E��{��e*��c�whyR��'W�3����p��J[��7G�xi���܍��Y$�xӈ����>,<�M�Pq.;P�5uӇ��J�rx(�5B�ȳ�wy�U�����7����� ���)Ȕ��Gl��5�����Nt�d>�g/3k5h��ߪ'C�zW��Y BBy\�ƻ�컁%�Ft{�,K*�ݬ .��0����� =�Vy�+0�䦃,�N1�i�'�����׃B���� s_�K�C�;.@����ʖkp��͑Ă�w��NaW�Q��S��&��d.�]�1���J_]�S���$��;���PE6�!����Vk��������� ���jR���r`����������b�UR��0����*�=���';\�o��[}��)�4,����A7����>E�V�`�uIX�nq7[��o"�R��5�G/O,�2sKB����*�t"�����:���߬�����[�!q�=��Oe���4�qz�y�K���%Rg|G���j���Ӟmĵm�d�^]����2?g�~��D�^ b��u�Y}H���>|#�y6��]�䭔��{CҺ.C�V����a�I�����F����ɘ�'>�}uHڇ��=ڲ�'ns|�'FxA�tf-z��0�o[���ý�n�X)������K���@��W��� �幡��u�q�y�I�Vu5b��{�fA�l��\Q�jڔ�v��2!�\ڃ�ʞ��gJ�=A�����Xc��X���2��86=0O&o��v�i�V��i��}��y����@>`��o�^������7��WŌK5� �{��������)�Iq��µ���?���������幻 Az�9�5��6�,!�!��j ��&�b�����JEvf ��sAw��AXd��/g�qx��`�iw����]+ׁY�]�� ��˾���"6���H�wπ�2�@�IrM�ijj ��⡽�³}�q1�:5([^&��*�4x�̃��ǙϚ�G��> ��{�*����ҡP!F�����l����z۪rA�����|7݈��Є�`myrd-�v�O�8�ru�~��d�6��.x��d!�O��^��0ު���m?��9c����5�芠b}�/����I��8rk�qh��NdUoh73��} �n3Vh�Ԓg���u�����3�� �9m�e �6���>���s~�вQ��ǗO�Q��lG�T���l�?;�im��t��g�$~���Yc�x�����x��X/Ā��`�q�yL�@,��Kle:��_��@�oq}���t�*�'tMY^d�����E����S�����?�\o�^�М�6M��k�B ��������*O#y�m{}��(�)�=��z�o���bn�ǀH�����Q�&�V㚼hi�ܾ�<�#M�`�Ό��&��2n#�$A_�_�?�XPi3��߀vda>n�A�I���� ��T�%�?�V#�Ie.�������Tzh&���Z���#=_���Ób�/=Nw?Up[�^��yO.�"��~�9���b���� rih{����Z��BZ:@?S~�P�{3����X ��y�M���4�U�,�#�bE��;������c��ә�[?�7d� ��M����ْ\�+���y��@�B6a`�'c
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftNordVpn.ServiceHub.Controller.ni.exe
Resource
win10v2004-20230915-en
General
-
Target
MicrosoftNordVpn.ServiceHub.Controller.ni.exe
-
Size
11.8MB
-
MD5
7bc62898066117193005933a091d37a9
-
SHA1
174f685eddf50d507d07d633e40d4c3ed6cf1b0d
-
SHA256
5016a548ad5c775a68575deae812ba1481a3042df946c6e390d60ba41aa0d20b
-
SHA512
246281da8f789025a08d426e616995598184a554486ce94825c052f9e21eec5aa5976eba861b8692e94debf2ae20dba303000f91fa3488ff62927911fa316208
-
SSDEEP
196608:Hn+JQe0BB5pJ0Pvz08tf5YpBdjltD6XvvmqyymHGmW9HOqMY2i7zl2z8z5DsnIi:H+JYB/J+I8thYF6XvvzynVvJm1ZlI5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MicrosoftNordVpn.ServiceHub.Controller.ni.exe
Files
-
MicrosoftNordVpn.ServiceHub.Controller.ni.exe.exe windows:6 windows x64
7963d3a67cfe4f19646b23c68d457d1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ