$=/4�Xʆ=Z֏�d�ʖc���'$��3,���C�� Ą7�m�\�aS�W�҃��r0��c�G��+����5�ی�5ni�A��fH��K�Yy����LXƪ��=�_!�l�`E��)���>ٰ}��ֺ2�ߵ|XR�*&�;�c�a7�f�ig�,D�a\1���z�ԟ-�X�:փ;p���'O�:��G���E�i��;JSvq-1�<���0��~�e*�L�5��T2�X��襦�O6�mL`����S���'qd�Aww��{�F�S���oU�(k����خ�wT&�j�p�����D��켮�o��]gY#�j �/��c�l�T�<�|���,�4S����u��~v��R֜�#�/��) ��g���8��'�zP�Ͽ%�YO��|���6��� �����������ڂ��Y_N���̥�b�K2���;� d����1�Q-[;�x>[ș����7X�R(�JB �� f�3�E�2�T7hᵀ�'�����;��.1����Mn�(v�c�8���$CIT�n!��y�W��%`z���T�4���jO�����Tn6H�KW�$����\k�9��W).Ja�qDe�{%��J�<@�iO��ӈq=����J���"��q�ʹ*���� ߺ+*~z�dTd��6��a_">*��I� ��nȳ�%c�ϡ"X&��T0G7�_�f�#��h�%�(�� @S熊D�'�-C�[v|H���R�B�� &��t�Jt�Q�"����Q�i�?+ \.5l.���֝(���eK�7T�y��_>S� Y�QP`х͒ߐ1r��ٕ����*� �y⺪�W�� ��k��>�(�'!,I�Mu�����J���i��F^qTY��jg�U]�F̻��u*T6��Β�_ ����T� �V9�'3�=�j�$$oI��̞u��o��MmM�o _£Y����7A!���n��]���b���˖�p�Ic¯]�"t��!�~6�)h v�e��r����j��?���|j=L�u���_���r�Q+�Y^k$2�5��5уjLav���4Z=Rc�_����v_��c?� o��ٛĸ� �9��D��9\��:�։�\=��lU�⃤�����|��K���d���i.�b�z�ᖒ���uk� �������V���<��[��]����c9�/��,�?������D*k��'��H����%ũF��Պ�j٘{eP�����S�|Lt�7+GD~#ɨ"��ZR�g�|��~N�Pp�L� [�9{w�dKw� S L��&�+I�f��% ������v��ؓ��Lm�DM;Z��X;�j��9�"n�L�B��Oڐ=� .^�$�*��rfT� �beF'�^�}ע��0�Y|+����q�g�����]�����X�2��ofc�Ci��Mhh�֡ n��pL:��{Oɝ��ۖ��s���#���A�9��E�,Y��@SKN<0�]�8T.�-Z �X��v ��zo8TO�����jh�T�4F�������5�*j��R!�����ro%4FmS�V� Y�D@��Npr]L's~���Bɏ�w";=*mJ�����J*>��s�q��KmMPB>�p����! �E�-���?�L��#�1Wʧ�����j���;S�\8*2R�l�OࢋF�Y� !i�H�R���g��10�p1�{�9�ٶC��p�Y�cIm�O��<���N��("�Т�su*���^wM�M ����MG[�Bv���DBE KH���e��*��4�.v��P�N��<�>z\1Df��O+zz��.ȃUE§���m�ND�pHC��c��6���髌�F�Mv}=��s(A��2�6��h��?�{r����y�1��z��РDj��ӵD���E9�o(2�GZ���Sb!�%�s�c��W�A"���w|� ue�z�O���ڇ/�X�s�(YZ�� .����ReIh>8��|�EH�ޗ|�gϔ�����8&���l$�.�vna��a�����%|o��e8��&��og�Y@�i���Cm���i��mz�?�Fo�Y��>�?������%�P�'�l~I<d�x������}�i�� ��+ ��3�5�^MT ��0��\^<zkE�F����� ��P��=�4��?�@fV�N�^�w|������\;+�?�sz��o.�3�a'��t�I�ݗ���&�c�E:�e���:0l$v~4�Wh|�ԝ��}}��/���)�Z�V�qG��JX�gK�O��a]����2}`�O���P���^�ϡ��g^qeԌ*N��G5�Mɡ�����Pr�8�{Y�!n�5�h��2(!���~�q�.xp�քb����L�/���n����+�W�?o|�����Y��P�9���Tm�^@(�Sz�Ev!��}y��TUV��;p(�M�#�n��Nf`�Ǭo>(F�nȥ��"ba��y�q�w���)��ԀkS�M�x�z������ ��O>�PU�=�gbh��T��!����x�5��Y�yL#��Z���*�+t�|���C7�gZy�/�"ɒ|�L4��@�5���G�����vb���hg�p1CZ^as���a��a�&q��q����P� �$g�}µ�9Z�rq�\4h�B�mWI��Z�ֶ�1 K���� ە�fǘ�At$��D�S���L�C[?ٙ�D�`X�j�[E_1�;��֜bm�<~�Cg�|��85�,2+Na�s@�$����L�ǵ���?��և����9Y1aJybc��͗�5�5!�=�8O���1�6�;c@�谛ڎ�2C,"��M�T��D��� �R��"(벣Ą����?���ć�����f]�OIG�5��T��#����Y~@C�����s��5k�����x��͵5�7n����Ij!e��\W�*��r1�������m�`|tߺS�ug��0RPY�^Qv�<��HJ^&F��p�%I̶��D��6�[��E�����6=�^�(�w�W����U"�قkJ�p���+Dv�c]�j�V[i�RHО���kkNfY� U�Ν��ov�͌Χ�A ��%+ ��Tk�
Static task
static1
Behavioral task
behavioral1
Sample
launcher.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
launcher.exe
Resource
win10v2004-20231023-en
General
-
Target
launcher.exe
-
Size
9.8MB
-
MD5
4aac2cfbd4dab7ab69ddd2c35418965a
-
SHA1
ef11af4171a73774ef4224bddaf561fcb9791176
-
SHA256
bb60c30a3d8781b377268997847f7c1726d6c94c3b0c38dd506954b21167fd49
-
SHA512
15a0e1f26ea331a0257cb029a4f6b6539117f7941cc6967fda4f9dc5560b626d9e22a0c4e812399d83e8a86e1d32bb01ec0bf008d15759381e7c538f252338cc
-
SSDEEP
196608:/TYReKrNPFho7UzsyNhaD3fqYz08tHihjnwFXokW8oHDt:b6DrNPFiksyYI8tkwZoklsx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource launcher.exe
Files
-
launcher.exe.exe windows:6 windows x64 arch:x64
7963d3a67cfe4f19646b23c68d457d1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ