�E@|/�up���3��h@)���%S�lA�ʚ)u�,� D3�̈ki&�����%� 4�ン7�m�)�U Fno�hlK���%a���>��QU^��dV�4��cJ�%H2�$�7/��{�ָ�4�S�*����˩�P�f.���$c�,m3����oi�C���)i؏M~ARO��ag3ˉ���K�p�T'��O���fL��^�~ ihI�/�����Y7u��Ï�e��� �����^��Ǔ��f���7��rɚ�GiK6x@mWx�MZ��H��V|*���K[�*�z�� 0 ��U����a+&�8$���pӲ�D�㴱5����5jiuU��8�&2���=����pi>�����jJ�r+����+�ɘ�9�Fa^�sPOS���i(8���%�mMRW�%P�(V#|�8���l�"�&d���œ�����d)k�Ue5���e�>���J�Ll��fpk6��\��ؚ�.��d���$��4[��3K���e�-�0��h�|�tS��Η�����|�n��Z�c��X�QEzk~;����d4=���{jRC�UI����������ဃְ�y��0GRIL1�:��/ZhL����l������Cc;�;�.�k��Y��sYX�4!3e �%|8(�ף��2,�"�C_� dG�F� ,=�I��' B] 0 ,�C�җ�f!���k� 7n�� }��وck�%�+���Z�N7�I ��v6��$7}X`�Ɣ@��[;z� ��eC`��ZVDc��L�A4�H�۬p�c����-�ma/��dѠ��0T��]������i+*�sN�����e��p�/|� 7�#r#�<Þb����A�k f$�!��`3E�mZ+9cw�[g��n�d�i%�s,�=tp�A)��rMNL}F� /�����\- JZ�ޛ�kƀ9W��o�������?�|��[؈r>�0��}�7��]��:*�6ln���\M᧤�:���Y���?'U�F�NS���tǥv��Z��$G�������~�B"z� �I0Dӫ�ϸ��X!��h6�R�Ϻ���Xd�,�>`PN�e� _|t���֎�� p��w�ZC+��f6��\6�p�VaW���)⚚��)��>;�N��fT�쏏�g�4A�8@���e?�������Fd��@N�&ßi���H���ZڌEW���y�֚zti����w�}a�毡���Na/\��롄�;���,~e���c}��|�A' N�����7�Ȼ!n4���*�\��x[��*�d0A�P�c(����o����x��j|EC�/ ���<�R�M���Ռ�K��:�MP�s��+1>���r�q?¦'��6[�X,�)̻qkO�vT��Dž�#��r��O�Ki(T7Y(��8�Q.��>)jK� H\*��0����:?s ��D��X��;����lgY{ �)YI��W�/�[���0W��^Ⴔ�恰>��������;�:�y�� �J��� ��h!����W ��x�q�K�t(WE{ol�����r~��K�$�b���Nn#�d$�[�ά��2NБ%��:�1��thC�ѩS~5��E��{�JH�s���\7��#�b��?~OU[{�vWPA�;��DySf� 3��%������ ��Ν�cp�;��V� r�d!�.�pX�"oX�{l��`_��yV��A=2��NV�������1b�!n��> ��m/0�Έr��7�gH� >��&|g�=��jK��\Z@@�����F�������(��B?Ɔm;�O�uq@o_RC�J#w� v=�x�\-��>�#C�T�o��W����Xo�9��g��(��\QJ�߽�sH�M0�7n����sH�Q�c�������ڍH�WrO�J�@�F���ޤmc�W�������G@S��:��œ~&�c/<�С!�T��}��`���+|�<�:���}���S'���6���qZq����"�2.N4�&X��)H��}Lm�w`d�+:|�)"������ξ:��a���#79b^�� ԗ�@=qk��o3��t̄��4%`�/��54ތ����e�auqh3�(�K���s{�L!�f�������Y�����%�����s�a��J�=��+�t!�����Z�ү�y݅H�`��$��7�ݎ��c���n(��k�`� ����y��b5=V� r {�[�,��i���e.��%���Z�'9�'u�����g� ,"�ހ[���6<p(ⶃ.Wfݠ�T=�l=��.�S������-�{�6v&��搏:��`�?�@O@�Gy�Y��e��--�{�G�!Fqko_h�x�����d������0#��'��bm&Fm��Z8�s�N!y��5���h�h���n0��֊�t�]�j@�1�Gv����sӱC/��Tv�=�P<���6Hk�O�/0�Ҹ)���р�TT��:&�V�Q#_G*O+}T�Sv|U a�z�6�d���u����妡�+x���%��wl������/��CL?�$�,bƀu�T��]�;�%��a�d϶����ψ?"�,��x���m���A戉b��/,��^2�*K\�k��[Z1j�� "�!ϳ�\��?[������&䡼)�U�-*�v���>��[Dv1. �J��5@�==e���N��D�uТ�Oo��BPmF:H��B1p�-����'R��q>^o��1�芘O�Q]����5U{[A�O;-e{��'Ū'Q �!~�D���K��yL/~���:@D@.��]%e�GL����j���Ā�o/����T=C5g��EPkQ�1���Yl�� J��M��E<E�a[�H(���ŋԙ��"��ۥ�}������uO��j~�R?�2���k�N�K�W�=H2�njT��HӍ�!�?��'d�1��J�����I���3�K�4�"�Y��y�qǒN�Dt�4bDٸ�J#H��i� $�o��˕�&��.;�`%C�ܷ���ҹ�q��d(���G��3��!6��C�R]�`N1���)��]�h�専� Y,�F{�nq�[2H����Ѧy������wаl�:/����J��n .O+'y��#R\g��|���p|��p�7馸-8�Y�ܝ_�fV8V���̭�w<���pL�`<κ]mb����&\c�z(�[P�����`w�r�z̋<��ю����d�߹!\ur{�Do����I� ]���P�PK�l���H���+�b��ro�� ��A�}*2A�Z�s����:1���n���� 5 ���"�Ì��U��`D�{���� ��dOmL��i�<��#`VDŽ��������-�o�R�0�����>�d��\+y�Ǎ�m���F1�,ޏr�$T���ڪq�F��:�l��A+L�D�v,�{@�+�9���H(�Yd����8Sr��0u�x���0C�<ʭuH >=�^���h�E��,���Ĉ#ʎ"��lOAH�G ��L췽@���s�ҫ%/��L9#t���},�Am�z�D����$7�J�#@_ �Ś�*��(WX�?0i��9S��ev����A�����ZCm�(ŠSc���P���K���7��\R����$O���r�W�@���@���Y��q�0c8��� ��8��]YA5e�9��* SG�JÒ_X������|<S��}��qk.�[(��)��3��������vnb���R~��-�DN�d���W��#�s��@���$�o���&����"x��ʟƧ�
Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume4/UserSharedFolders/markus.amalthof/PowerBI/soft/sharproast_protected1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume4/UserSharedFolders/markus.amalthof/PowerBI/soft/sharproast_protected1.exe
Resource
win10v2004-20231215-en
General
-
Target
sharproast_protected1.exe
-
Size
3.3MB
-
MD5
3a125233953bba0b485dfe864a395c43
-
SHA1
2b1efe665295a0e202b48c449a7b2c827c0496b5
-
SHA256
21c909265de0256fd8c1fe7ef99b172780f4aacbdeb7a50445452c3f7e4c9bd5
-
SHA512
a8ab5c2d3255a7119e27f50f3a5b456636b9e4a65d42a85b7241d9e73b604bf630d9bd4fae86acca356fe55e9f6385e97cd53acfde86acce9f3561f24bce7ed7
-
SSDEEP
98304:acWT8KVVpXSMqcgdRICYqePRK26AisW/98q8wyO+m:NSybnAPRF6d/98FwyOF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume4/UserSharedFolders/markus.amalthof/PowerBI/soft/sharproast_protected1.exe
Files
-
sharproast_protected1.exe.zip
Password: ow&b!54X6x_#4gT@9BT4
-
Device/HarddiskVolume4/UserSharedFolders/markus.amalthof/PowerBI/soft/sharproast_protected1.exe.exe windows:4 windows x64 arch:x64
Password: ow&b!54X6x_#4gT@9BT4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 62KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 92KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 297KB - Virtual size: 12.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
manifest.json