�9+D%�Y连�M��� |�*��)O��c��~�������x�`��G�3���� <�����z_�X�`����A���S,� ܜ��4��d�[��GAQ��$n8=˒Nm�>�o!�JU�Ѽiǚg�Bf= �|���'T.�����io���q�iD� eIޮ� J��������X��U� �̇�^ݝ�4ٯ���C��1��,bc��cPs�}��h��i��a������Ŷ�����t��� 0�H�9�x�M#Q�;�x_$~� ��W,~�1� �ε�*�I�I�� Z/�����&����%��o�Z4wtO��+�c"�Ǎ4�BCй���g��(�:ȓG̱2z��I�w��{!Y�5zY�K�@���X��0�p"�uQ� ݞ��R��� �����%p�K������S����N�Č��`'<>t���>n2����h:s��6G[�x��I��p��t:>����<>�p�U�4���z�� Ÿה�,go�яS�3��Ęl���P�>�gD�a$Ofy�XC�-)�2�[�:j��$sA��������+@�e����<:����>ݧ,=��ן�dW���i�h����V��=ฟȻx��xW�x��+S0Ң+Q��ί�Ee�a$k9:�����&Y@1,�.v~5c��ͫ��Lc�<�P��j@r�\��^'�tAu��F"iA'2��� ���7�����P${�Î����hyT�h@h�%Z��w0\5Dr�&/A� k~��>���-�d���7�w��mQ����D��J�!�~�,l(�f�Di�F��pј�(�<�|�/�]�T����k��>(��"lʛ������Iy�o��I�*�����Va�Z�<g��Y�� �NF��� I�)�-�'��-:�[�Q���uö��Io�sen�Tf��q�6�~��|�@�}�ӻ�9n_>O��^ENt~?\�gY6�6��2E:=�qjݒ�"����֛�}Ա�&�����L�d�U�vb_-���Kn�*��"i=�%�l.����f<i�<���Y��0��qg��QR�BU����Fb�ɕ&�(��ӕ\������T�%TD�lZ>w��{��V��M��y�Q�h~��e���.��(rb5]M����\�� ���5Y��/��.DB��ڣ�$�}kҮ}�ny�'̡M�d)��UƱ�`�pRN�Т�*���(ݬ�?&S���bJk�v�"c˨S����@�v�Qq��+����> �ۊy��>V]R�M�0�M��Jɬ�Q�����4�E$�X�<F<��m����"$��3M����*���G�e:E�gUKȂ��K�O�t�{z�*A�7i:�pӭ�PW�w�l)tNX_�k�����G3���>@��T���q 3{��a�E�Bഐ�RC�k3$�i� _�=�h�f���ö�s�5F�LH�~�tf��]4���j��J�皡]�м�ݐ5�������U9��Y/x��9o�K)�HKm�ѻm��D_o����y��"~T�j�S�W��2��U�Tc��t���P;dj_�𰊾w���^�D]����Ԁ��z��l�L3P�7�aj0X��Z���7*�-�a�[��"e��6?P#w���*gb�8��+�� �Us�E�- +G�GUh�F?wǰ��6�W沣�i����5W,�(%����Nu�#QE�?Kwr��U�6i��Gv� �`@ܢ5+�"ξ����Cr;����Sb�j���k�f�� ��^lD@������ө�pR�\]+Fg`��Y�@̫� �,A? �nd@��g7��``s[�$%�L�$£n�Q>h�͏��5t��E�<�.��m�,��������M��bA~�|�c81D�f8��!�=����0��2��QP�9�-�%�6�' �u��]+�V���}�A�Q��&��j�o�:6���%�zl��w��dW��QT�j0�>,?�Y(�ef獈�rc�<�����'p�:'�qL�;��d!��!G�>1��"f�Q����E��H|2���V����Y:#C��o����ˤ�_kմ�4��9 �͡�u�&�'&e���M[�?C�Ie�J��82'��p�����eDR��[B�@�Dz6>`��S�}Wu��9�l0J�=��� C��WTZ�NI�~�:��}\o�(E���O|���^��㜘<8�jb+ʰ�Y�o��M�,^>.$P� 4�G����I.�(�E�ˉ�#+�si���RA�CS�< w�]XD�m�������$�z����|���P�}�����}f�p"�1��(�b[�! � l��u�{0�5������=����:��G <�I��Gz����0�i��:F-8N�I�o����������dM8f���w�}R�?��f���˖����i�"�n78�y���pr�s��{dWҖ��2��v�������sf(�k�#�Yls�S�P^0x���H��O�2Gi_���p�x�B���ウPI*�/��a2�j��:� #��p̝R��o����WB�j�C�< ���<`</waɖ��\f'A�t����ԨŮP�!X�[�/����}�'��Q�B�:�l�"ݡ�O0E6�3�\.��dZe���^�}guy1��+�[��=���n���|X�6d9�]�uWA/IB�2��H�ܒ^���!* Lѿ������]������:�=�O�����c��9�Y��{�����9�q͙[����S���ɛ$(Rm���-���|i@�'E�:V8+�J�B̎.8���3����z�G����1״�����k��e��=M#V�ӆ�aA��sJ���=#<��řd�L /�w/H2�2)�<ܥ Fpl@;^�� �y)����ƽ �w�|�(��0g�+lP5��)h�͆O�X1��K�EkdV���G��y� ���ùˢmA����˛��J&5gf_��z/G�@�9C<�J�u��^U��iV��$��O&Smҥ1N�Χ��8���!v��4�6���5�q3�u���G������Ge��9��\ oN�'�� ��E�Z��~�J��z���\����{S����B[�M��2ʧ�$d98X��q��?��B����G��bq�e�uw��������{ ��e�L����.G`�i,1(=�v1`�q�3�xy;��UA�.���A�,wM�g���Y?W�"�C�(���X��3�`��B����z9�[��NM٤sMY�X���˵i��>�=��������s�浿.^s �����r��k��N5P�,r�f���Nv�����h i��(� ���<�{ų���z���\��������LāJ��;�`��6r�Z����}+��`��1�;�[������%B���y�ŭ6MW��
Static task
static1
Behavioral task
behavioral1
Sample
Ban Remove/Remove.dll
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
Ban Remove/Remove.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Ban Remove/Remove.exe
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
Ban Remove/Remove.exe
Resource
win10v2004-20231023-en
General
-
Target
virus.rar
-
Size
6.4MB
-
MD5
8ceb67df9e36007809ea923b96ced272
-
SHA1
ea21a89b3c81f874a1ba0d7d6a67e2b268f82cff
-
SHA256
0a1c2c58e6701eaa92ddcce50a104c0a6962eaae6db987a32053a42e89cb5111
-
SHA512
efa7e19b1b8cce3c625a64639cde8f774fd7cc7408a5d607ee6a9daa7e4ea0226a8e73c05f367315c636a04ad9e8fdf3678b204b70eff1baa865ce7313806511
-
SSDEEP
196608:fkHC7M8qJ0j4FaEpRsqsIQJpBgeWYXrmCD:fkZFJ0jE78hDpB/9XVD
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ban Remove/Remove.dll unpack001/Ban Remove/Remove.exe
Files
-
virus.rar.rar
-
Ban Remove/Remove.dll.dll windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Exports
Exports
Sections
Size: 112KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 95KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 88KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 271KB - Virtual size: 11.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Ban Remove/Remove.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
���`^�Φ�\~�N��|r4�l���p� @PD8�;� kt)A.+�t�S� �g�?o�ė��]OR�KK� ��ebj �� �!�+ ]�b*�79X#�{ԮǓ�j����f�Y�4E�g��G������]�[����E<�^��z�.G$������"�ܘ�m "�r���rM� 弓����nD�lj%g��kKx��q�@`�dSn&!gçm|(�[i����K�MjHB�s��S�_�HR���PWLH�)\ΰ�����ؼZ;���3�,߉�����*9,�)5f�?�=�b�o�8��[ �1�Q��/�W�A�C��g="��&��ʸ���� D�G��2^�p�:�����7��?~FZ{��4�]ն��[�9ќ�)�J��]9T�Sv��P� $�zz<���)�0,�e�T��U6���.�=B���R3A+���އ��:�7��$Y��@��7�Gzx�G �!�-?�m4���^ǃ7�š����v|��|*��P���Yk�mV)3��#�Ӂ�����f�����ᐭz��m�\�&P��ti�.:��t�a�d���*�vD2c��=5ʚ �X��BN��\^�u�Xo�*�{P�n���f�?�I�������KIEJ�{H��"6��z�K>�[��2Ga��0T��g��q���I�����_>W�fP!D��Qϕ/��AI�D����I���]��]�Uk4�ֵ�������hf.�گs1P���Fp��7mt�=S����{�G���2]|�S��H[����)x1���#S���Ii�I������������.��;꣐]�RaQ*�Q��!T��qu�<�#s��ۡ����pꭔ�Z�c��[Gy�'6�����Aߥt�̔�K��>ؗw�( ��v�&sL�RV������Q�OP$�)�ߊ�9۹�OMGJ_>�����c�s�`m ��4v��E��~�]� S�5C���Ѭ���YXuP|!e�:�;�Y=�/�Q!5�E�ƫ������.u���C���ED�r� ^��l_?�������ߐ]����]`�v�K��q� ��V���qӆ&�" ��҅� !k����y~X�q�|�_�-�R7P��--���6K<9��P�Q/mo̘���msj/��S��v��e��H#��8dr*1�`��R~���O���f6{�G~r�o�ɛ����5�Q*�R��`$� �_�8�z�U��'�r�K�d��}#I#��m`�nF�ͧ�V�CNY~�Fr#�?<�X}�eD> �~�V]dh���H�א̜<�v9y�{�U�c�u[�Qēz� �k�B�c������/�h�� _��ئ��X���=�\\C�h٤��0�=f�p�^W�Z�D�(1N��������ۘ��^�����W<���]FMڮ�ƈ6�����J���~���h��e)AB�����'�#�G\\l��cd�i2F�:|Ie:I e�GFH�qT�(�Y��� ��:�=�Gd��T*���� "�/�y�Wϖ7����٣sS���&X�=+>0�,��s�����4�������Fb�ߙ�����C�q����,r�`U54����S�G����x�������B)��K ,� ŚC�e���� ���WΔ|�HъHL�>ȁ�� ���j'���V�?��OmW+ؕ�'��j�)a�]b���J�7E2�y�_���6�VdDԨo�DdO@�]���J��&:>�]��V\KTPH�����t]��6�N^��@�$�"O� ���d��2���p��5}'~F���wN����Mg�����b��^�n�.`N���:zw��EodZg3�T���� �����.b_E$P�y�j���9�u�]"���$�g"G�L� ��/��x�4�xdU+���n���&��]�.���� ˷iU��hs��eq�Ht|����˴K�.���V�~�F|px8����_hA��V�V�S��c��l�C����\ rfF�&kz�nkn���l���?!ڊS#�~ȿ-�B�L���a�����_�RaBH��TV����m�Q����D��=m#��5���4\�B� M�'v��<L��[�u�ڿ�ܥ3�l��4D"�* ��16Q���?4��2B��6:��ʂ!��h���>�1�(���'`9$e2P�*2YWs���ޫ"�s�eo����h�<8��Ü�<��sڈ3SuG�V|*mqS� �����o�r�E5�=t�S��0$����2}��KVJI�~s����\Y<��ƒj2����ص9y �o�co��:9�Yi��G7�FH�N$^��~������3\��~� �F�k�%h���&��U�Z,��l��j�T�HJ+���u�P�Y����*4�� %��0�x�W#�ZL�>r����k�+��l����^$s�hcgq�s��ǥy�B�����C��x;I�}J�D���^���yL��o�u*����������OS�侄��1�6_A��%�R`6hH�Ŭ�C���D��� A\s�M��C��{�7�LjT[�]����R�&�A����n�Aq wj����I\H[�% ̥��Ia���I�{�#��a��$Ӵ,����B����02��2�!p�H[��1N|�y�-C뤋1�W�&�]��y�}��R�z��%�ycd�F���J[՞�$d�\+1�ΘO����g���쾜`�?��ވ1+t�@<��?���o��/Wsh�#��0n=v�E��2�dˉf����^e� ��җ��k�EqS��3�(�x�3���j��XP(�}��~{�܆�Ȳ�S�տ���ѓQۀ/P�a�0�!9��_�wg�H����X��i_i���k����j��O�gv��..d��Rn�2�����4�f��9���*��ٸ��<жɋ�G!1R����<Ɖ�,�Օ8���������4+Aln�p�8ec�X�<�R���W�G�g6�4j���F�m���]�$n�" ha�l�]٬��~��+��\G�~yM�U�ј���HMVR�����$�{F�&���m��4F���*��*���r�Ԧ�:�^�~][�� ~��������b����5iȢ��d������%����g�9k���X�����#:!]L�0�^;�pkK�Wלj�3��S;�������i$T@��C�3@"�� "i��0Pcy��3������"H�:�oF��3pQ��F������ ��m�sߣr�X|X�6ޤ�� �c���������q�u�x�"_�H��[��-9տ�����yw��1���������HR'������H�����:" ~ �wy���K\��2*.�l~|%�)�16����Dlont����_�K��V~GuA���)M=
Sections
Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 69KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 271KB - Virtual size: 11.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE