��I��e����u}8f��!��]\T8\7�);���������K����GQ^�%��$7�f3�'�3�S��_�9�0�26+N��"}�9��KÀ�s�T͆h}.,�����pI�M$oI� ,��w@��ۤ�f����R��.��h��n�%���/wBκ�Ȭ\��E���[�a�]��w/M& �AVUW�<��!P�.,�*�ȗ~,�T��ii>���?�`D\���4���zԜ���!sPN�y��M9s|����D3����1+x ��{(��4��O|�([4@��-��P=�o1fŔ�+����*?�}fɝ��� �\�W�=�"����y 鞽ٶ�z�0��xB�q9�e��m�V��=<��{щMb�X1g���s��2�=��J���G�2�sN A�A>���k��D�X��Ԛ��( o.������8�I~���Vv�E�� <�ԦgPjҥKu��a���c#�����3[p zۛ�i�~d�.�^�s�!tl�-��m�my��_��k��n�����I��PrH���'%�_�:ү�o l �Z��jSfk���4z�'pxY�'���(4��m������D������fH)�C�ՙ�*���┛��(�HUI��� �fA7����2pɳ�/�·���:*�u�1۩� ��D����B��]��qq�I���Ekw��2��szom�Ԭ�#�hV.���p��P3�ƴ�E��<����%Ib瑞�wN���Xjs������"C�(K+7$S� �(N���M��ʻ�9�4��6����˕c+e�~/�m�`�ݾ�?���o�}�KG_�}�m �`̥�w~4:��5mb�*�k:��cE�M|S�1e��<�����?X��C��o�{��_�$]L'�då,U�A�� vYz�Po چ�=X.̀��iT���rW��Re2E���$0�©Ix�c�R ��uV��]�ȴ� ��mM������&=��:��rB���EDȹ��z8v����0d���G�ִa��$Z�M��� �&��/������a��J�CV?�O!uL�[�j��`e>�d�åR.(H��%CڏIg�5&0���H�"����L��q�G���$�p�pJY�C��ή,v۟�62p�\���,���Sܔ�\�D�b#��J��v�#��T��2�,�{�\[rk>��9b:OFY���>�u��D,@"�(GV��%J����ހ^��o��3���f���>�����r�={�pxr�4��y�j��箅l�h5I���<��29%Y� �Ӥ�J��ll*mW2�X �Bӈ����g��[�]��!z�Z3�5�6�0���b����f6g.w[2�&Lv�����!*��6ʒ��<?����"���ى�Z~b"���$� },�>��P�(��5��RvSq��������D�s_Xyo�6�F����"1 �DY���)�ww�[�4� \���JKO��?I�j�%;jPB�#�n7u�rHY����m9�%KZ���56��U���#q�=y�hI��g��#9���UB�BAĹ&�Z�_�����.�����m�)E����\��h_���?G���&GwD����y�|�"W9�P���vG��kQ3����m��y>�����$_��,k���x�M�d�}��+�=P�iX��UE�`�Q�$ �?�k�Љ1 Q2����]�%�kÁ2�ZK߱}�>�Ͻ�Υe�n�U��/���ó�/=vphc�!9&�9& ���Mys���������fz��X}ݽ��o�F:�[��u�U-�Vŵ�@�-���;o"�Z/H �?A7��2��H��(���L�����%#��W�9��Wq��J�¸�Sl��H�>�5U��]Y�]N��Y8��gm]D]9�&����V�i�f��T$('������Mj�Ͱ� 撓�F������tU*��K�:�Y�H�\[��N��'4��-ӿ3���������B�����`~�s���9�/�G�Ͻ@�iv<&�����d����ѓ��@/*�.g���g�����bܑ���϶ �BAfC��3��[INV�}T������-��:r �c*B@�p��5#�"\�M?��ݿծ���T�?��9�|�dK�ŏ��*)��92v�Ͻ����K97G�j�^��Q�RM*�U���݅��͋5,�#�<��_W�x��`����$X�\�<�Lj\!G ����J�J9�?�;Ԍܺ�Y�����:��"�|��e�(�qFJFĘ��w� ��IS�Į���6Q!�%92����q|���0�l�Ƙ�&�@�fӮ���Zǹ����Ho)F�q9$���Y`��Bzw�ߨ�/�+`�m��X� -8܄�;�|����rrCÅ���D0Զ��ԫ'��"��V�Ϟ���d�?��'�3x��h|-&���cS����Q�a+�!q|�����<+�KռFOq�tR]{�cyy�v�I<*�u*,���n�q��l+A���1*;�8Mr���HR��R{�\ ���PG�/G}������q�)@RR#="�*Ū}м�����������4?�� �M܀Ȅ��M���j�����b�YT^`aN��7�O��%sz˺͏2W>�Y0���Qn*���@�l���ՠu�ɗ�`h��L���,����L��_(T���j���T�X b��k\@;��&0�ژ4;R�����-6�2& ��h].sm,�Gq���2��+�J��S%�gA��>J��>��f_g.#����v���!�g�/Ԯw4��;���u��"��M0��n��o�'���Q�g� o7�rYBig~��%i�Z"�]+iQ�1��u���4U����[:�m~N�M�⩳��`#�o�+������ŏ�|�����*��'�M���-� ����� u$ �G�r�݉�!9��H+�AP�On�f��;8����k������?��t��z��XV#�~�����1ҹ���Rj�M�ϱ0�����EmZ�yk&T����JI��&��W����V\��g%\��qs� �@��<�u�ů
Static task
static1
Behavioral task
behavioral1
Sample
Warehub_Nova_New_Interface_9(1).exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Warehub_Nova_New_Interface_9(1).exe
Resource
win10v2004-20230915-en
General
-
Target
Warehub_Nova_New_Interface_9(1).exe
-
Size
12.8MB
-
MD5
bda719bb15bfb020769ca3286ed546d5
-
SHA1
a50fff9224aeedaa81bdc075d0414c26e5fcacde
-
SHA256
e47cb33f11d4c2c8c7bc853e0a13ae38d1f762ea196ac31dd699a5d1dabcd8e2
-
SHA512
c210d6f40ebcb12980bf2e096165c82d51f861be5e94cb001a1e66ada4e483d61662a8d1a0c31d2f55260f5bd99b8852822aad7cfa730e7218336ee22becabd2
-
SSDEEP
196608:eCLzhlNSOMoR94Hk8IlUBFSmYPWZpQzznz+Yd4I2r0TEToTq9/WTkwPWUxsTBpYF:l/Nd8IlUBu2pi4I2rq3q9IgoM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Warehub_Nova_New_Interface_9(1).exe
Files
-
Warehub_Nova_New_Interface_9(1).exe.exe windows:6 windows x64
74f832233987445cc69ec4e61b6f355b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeSListHead
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
SetSecurityInfo
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
ntdll
VerSetConditionMask
ws2_32
socket
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertFreeCertificateChain
rpcrt4
UuidCreate
httpapi
HttpCreateRequestQueue
psapi
GetModuleInformation
wininet
InternetOpenA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.warehub Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.warehub Size: 12.8MB - Virtual size: 12.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ