��&��\M���'�G����z� �gȃE1��h8�������GA��j���וƺ*��`����x|?p���6��wmfy����������&���}8�ԏ�Z��S��`Zָ��3Hr0c�t9�v:Zl2�04J7DA��M$��U$-(D�r���ϱ?�:��6�*�T��~p�����P>��w�O[l�=�z���+���r����C���qpхH��!z��N��=L*��l��xFU��A&E5�s�����h������]O�2iȋ��?c?/�4M�ߺD��Z���5Ah-C1F7�Jn�>HRl4't�%g�gm������%�l@wz ^�� KBg*��Dq 6�g� ��c |�1�-�]����jk~�� �p��>ɏ$�VQ����%��=�Hw��s��(�hf�/����a(���Dyi�EN�h8e{���b�+s� ��fP*(��ڷՁ���e-�����(+{وG��1�a�r�a��7)���� ,M��3�����v���S��2&[v�vRY$�n����cM8n����6��B�ʚ/��YQ9�s����� ���L^���e g��J��g�Ǽ� ��!ȵ~}�2�a7����\˶�! ��?�klui䎲A�� c6�Ѣ4�9�"����{�C�۳�&�Y�FD�n ��@ G�S2s\�����ۆ��R��TR�y�;SŁ��>�$3���ZVh_v��q+�V��X#Ěub��ɂ��ā�� �8�Ex ��>����Ĝ}� �n��"��6��h���_pn7N�z��p������f-�k��s$n�7��8�Q���|.�'� 4�مG}DVQp����TB��g���=���=ͣ�O�ږ�1�Ys����T����2�u�oN��c�7�a�����\-l���t_SR�LO�_Z��z�Hf}8/�@�8ϗ!t*B���" n���=�l�zk�Y�Z?]��MK���'𮝕kT)�d0�Ҩ�B���=��y%�����cz���$�ʊg�2� ��tq�"��^��v�Wo��='��Z 5�w�^���R��M��("�4l4���w�`GBmk�r��*Z/��,s��c���x�H�u�D@��$�e���a<���I��_��%d�e\���ВV��I��y�ണ��Y)�ٴ��n7=�}�����ܪ����l��=Lj��}�ݢ�9ƞ�ȂH�G'�����jr�=L%B[��l��>2*@�w���vD�G�'���:�T)7��#����O]l�ٖ��aj�V���n���Z9d7q�.�Z� K[ŋ�]�y�~�J�f�ۥ�hj6W�A�������'���b�A<��,op��a�AtS�EjD<�[+��a���\���PMۘ���ʬei����gɉr�<n��='�i�u$��7��>�"n�D�O����S������\�������,8��.��m��?:ITFב��B��Z��w��4��b�@���Z�z���-�W��G�h�:��!���֞5���ܔ�t�z<|t��)�#Gc�%#�ffl3,�7��������Hcv�"寇D���>�] �k�����NuG�>�;��l^��>xF�(��>6���g���ߥOke�R����QC�xY��t��ˣ�E�G�� K�TX����9A2� Q,��z��f�9N����f���z�i?U�ք���������0x�`��˔�������=X�~6�V�ƪ�qT-Y��DﯙXi:��q1�/��x�u%�~*��K��s���!�cx�Y����ݲ�4v�I��:@=/�� ��vxNS#����h� �kfr� �]s�X���(����kxu:%?E���e^2��+{�.Q����6����HF��[^�1vt����7��:�8��>� �h�$.���>0[�^�Xbio(v����Qe��t�s�`3�WI���y/������-,f�6p�f#V�W x���!�#a�t3����De�o)��!Ly��a�.�ِ����HcGL��^=��E%�ↆ%'B]�l�(���6ע6��Z�m��8ʜ�l�|��Mu[�u=L{dq��oP�܈�F�9if��yY�J�fk�g���<UdA][T�\�#�M�����0�o��A��zmQ� �jr�8����i{��Jh��U�O|@M���n�\ױ]�Z_Ag�P�=5��Mv�3e�~� {��t��^�Ѷ2L�H�d؋���n�}�ުx�n�Og���h�%�;L���>C�7`�&��w<M�e�ƴG~1QȠ�yL> cm�}�k�l)-�qTsp۽��e��#��_������av�������?ҽ=�������uXu0ӂ4�8����#�0�j��8]�C� h�U~��T@��j�!Sz��j,����(V�-m0�P�vd����~El���\ L4s��*'#������J� ��AgS6/�o�rUFp�7O����+���y��kؙ����l/U���a��XW�LU��O�_��������j�Ľ@���B�!�Xs���u�~]�{�~� 8g�o��;s��T~�����"�s)���Y��GP1c��{�$^E��W_�>1��rȂ?�A��cL_Ώ^�<4�*�'���9=�e_�@�^��bJ������x��`�_�YZ$5�B\��ߋo����y]�a�'ydL�n1�6���!�-�-�����,�~��<1a�Ões��qeQw�����E�{�*��Lxj��Zw��4\O�k���3w�%���,���ߛs��{$�=[���5bRy i���j��擶s��.�T���&X@s �q�����)9�S��d/�`*��ELw����ր��7*R�� e ���T����d�O��;|�p0��P��}��j��K��R�h���ae�'�ʢ�_�&K�=��B��̶���א��Ӎ@0v���Qz9� _�a~� |�K��UD5Ib. �gXD�K��cJ6�$V�U`�N7�Ҹ�?�S%V�8ר���%�93~���W؛�)N^��P��E��7��_���*��7=n�"��G8'�ƙ���iw�Y����=<�����9����` �?�Xw}�
Static task
static1
General
-
Target
ksdjfasofa.exe
-
Size
14.5MB
-
MD5
da53ec335fd6bb2159fae3651cdf7427
-
SHA1
4bf20f1127bc1e14f3d1006133b432cefbe083b1
-
SHA256
39184e6b43649968597a073960703413abf53c9584c48612ca5490aecf631792
-
SHA512
9dbf2f70f940570a9f2fb815d20bfc54b85e0275b3a6d7af809827052b40acf51415b6c8785a9de37f503d79cc2daf8292895d1dd9eb2dffd3a1c0faded3e204
-
SSDEEP
393216:0FnVqdWD3u1ylrqkDkM2TmlY1Fgw0OsrD7gytv:n4RZY/At
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ksdjfasofa.exe
Files
-
ksdjfasofa.exe.exe windows:6 windows x64 arch:x64
4c6e55d6777add3c8ca83778a076590b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
CreateToolhelp32Snapshot
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageW
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CryptAcquireContextA
ws2_32
recvfrom
crypt32
CertCloseStore
wldap32
ord301
normaliz
IdnToAscii
ntdll
RtlLookupFunctionEntry
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 650KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.<Tz Size: - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.# ! Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.]'l Size: 14.5MB - Virtual size: 14.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ