W����} 3��c���g�W7O�7�3y����I+��pi���^B:��7��q��4����;��?��F�tO�ށo�~��D�����6 1�?EY����bUk��{��3H{:Ҡ|��@�v�#PJ,�Zt=�uk�>ʸș��,��j1�¸����b�uI�;p[�Xph����Fn��Fw$Va�o�*�dW&��%Z��:B�%5r�S�k�96���������\1<�7_9�GB*� p_Z�ЬO�����Υ�Zw��&]�L������*�] �?wy�p���y�3�������T��� ��[�I6�S�W��L75�FI�F��p�8g�D �����t�S*�N:�7�zO��T��!�C5Uj l�L�IW�����;�������p��9�'���4�a�l�X����Q�_�jc=��B >gH=�? A���(��5�-�7�� ��b���U� Ƣl�y���bG��<�� ��Hr����ቩ��~�(6��ͧ*��@�A��:�̂hOyr���2Z:X�G� E�|����C!��r��[Ɠ��b���6�������nt-g���-�[��T��>�9�H�o����W��)��X�w�3���>�g�T�>JYTK�$7g�7�-���P��89�.}t���}�A��m��M}�&U�A`-���Y��cPT/����KX��|.x8�yT�} s�w���U����6�k[�O�{4J�],���i[X��h@k�S�Nl�z�Y�,xGw�����������E����;� �6V���{ϠU���*��?:y=vR$�ԁ�v��:f�j�Cd$��<!��ތC��8���vn�oT�d��)`�"�= Ɍ;Ll\8ўhǼz>Ǝ���&���ZK��z>���s&�C� p��۞Nl���b��H,LyCRx�H����F��4j��l�s+G �12� ���8|{��~w�寺p�K�Z���_����������j �e}J�s��9����0pt��6S��~����y�u�A�?ϒV��_)l��%(>�1D�����s��ϲu�ӫ�z/�D�P��ZD�����9O�Fvv�ľy�'ǀIL..5qϛแ����ҡ��i��3A�rzJ���ej�ʕ�4��,v-�Ȝ���� �l���;_ۑ���Go "�`�g����2�B�I�'�MZ5�0K � �%�� ��G�a����c;�z��,r��-�����G,U_bӮo�j0�m������XUZC� ��6_��d�}CTW��7s�<��kzs,����"��f��g�>129���� �7�',�[��j��t ȱWt�+��TT�����Y��fC���BFK�!����r�7�mH��7%�h����^M���8�w�=,�3!ɄM��k��2���+\p�^�`3I�6~�Ѓ<J� �X��ɍ��zŸF���^��4[i�:D�V��hI1�c�_�}��.])�����z���z*�W��v���0���a�� � ���{���ﳑg����URǘl��v6�p���1��|�ZD[H�E-��2oS�ݹK�h�KݘS�f9�"�w{������6�C]٬����1�8AtfEG����H����;�T=�:�WqA�M�c�ɹ�v�����3'�q�I���:�� ���ʆP0�w����q(d�m�s)\��YY��������CA�K3���ѩ�J!�H�M��Q�yn���V�%��CU"�g��*����@%��7��_����H|"o�D��C��ji�筑73���_�>[��܀�+5��IϗBM�Ws�����fB�ٵ^̯r�=��j�����&�H�Mo�u��>�E$B�q�$�� �T@*��{æ?� $��W:P���"�XS���u��%w��vĺ���;;c�?w��h#�G�Q ��Q�y��r<Glh���K�8B`ٳ��{an"�bԬݗ�6?q��Z�Po�����)Ӭ�ִ�L��������*�x�!�t�~�-^& � ^�tR|k�T�]��o~E�k��}k���]����-&Jw���_C��"�.�����F �(��W֒�N�,i�D�����FٓoK�1�zF�Ӥ-W�� ��*pߦ/-]�G`���I��vb_��,yWC��,�>y=3�l�2�l���p�ui�Ԝ,�3���5bx��8����!�7��7Q��_��&taB�6ĺ��P��0bg��홚�L�8l;�"�'ߨ����'曕I;,I�X��eB3K�|=���v�nݡ��[8���&�;�F�[S(_/�8�)Ԝ�ϳ�c�V�-�b�����urxD�^�1�<�"���@0�:�'M�K�7�aZ��� x:��J����jǗ�hf�%���̜E�|E�`�B\���H_-�$;N =]]�pC�v��zG.��p��1��dh���� �AG۩���r��NE,3�G� VM�w��0d���`���^P�ۊ�a���P�Pe%~�zQv�~��w6 �~ a��g��>�U}ќ��J~�b;��>��;K8lFa=sD�?�#�xj"�"n�+ X�Q������ *Tڃ5@#˳@Lf��*���aZU�{K6��nՃ&w�T�yx�iz.�ǧ�?(D�h뭬���_�`�{κՂ�6t���6����U��b�2���z�i{Y��x��ۣ4zeEoΚ�WK�pL�B�mG�#�N6J�}1����+Iߟ����|�)WoՋ�&|����h���s�տ�W�Թ�֗Jˏ��i��_����z1���`l�,���:: �j��Ao�� ����t{�:[̓��i�Ǘ�t(R&$�1�R�Q?,���wN��OW� ����b ���Ƨ�˷��q;2���\T�5��g �M�I��h8[����{����S���f�F��2�D!�n3q9� �lP�Jn�*!k'���B&6��Hx������T-���$hZ�x�V�ؔr�Dd�_�K .kGf\�C/�%��mI{�ts�Sr�h��n�L3H]V��M���Dk���v����?wr
Static task
static1
General
-
Target
Google Chrome.exe
-
Size
5.7MB
-
MD5
0ca3ba45832b269600fc99e3ff040fd9
-
SHA1
3624b4af66e7069fabf3c2c3d9710a0a4bb3773a
-
SHA256
eb4380c049d914b24fc7122d4b926896a3e21e5c3235ecc9b0c2cf2b738d1796
-
SHA512
bc605036c8f6d18f2a6f4fe628843cfbc6874e8c06333054cc3c14f228a275817b34b234dc1ea0c7f83d2b168345e09ae8b42b007386b77b7fcb37e7514b8f9c
-
SSDEEP
98304:toMh1losZ5ZSDmuqRujLm/sNT462VgBpeN3/W390jv/iXVIse5Rvu:zo05Zyq0jsV6eZAujX03e5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Google Chrome.exe
Files
-
Google Chrome.exe.exe windows:6 windows x64 arch:x64
378d6845e37354d045af076f901363dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetEnvironmentVariableA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClientRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetHashParam
shell32
ShellExecuteA
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlInitUnicodeString
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertFindExtension
ws2_32
WSASetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ixy0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ixy1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ