��Ԇ���Y�����q�_H5�a��^|ډ� 5�Ա�Ā� ����g��VL��Ki��a�?����|��i�am�[:�odh�?�M�v���rE��E����ؙ����Qx�f���) C�#�+��|q�I{��q��Nc�2��2X4���l{e�)�JQ]ѵ�{�������l�lkC2�l�˱Ƽ���E� N������U����U�b�Wa�'/S�m�{a�"� 'x�ߠ���dM$��&3$m����<��^s��g>!�-�9�mz#kPd��A�T��~ǨwX&�/V?7����e o�˖���O��2���q�<�]�5���$9~���sG 'p��P\6�͡��xC�dOI���/ĩ�;�bN��G�)�:}{��h��|x�{�g��)��b�{ 8[��"�<E�)����aQ 4�aT�{�%��HO�N��H��[&���p�i���W*�ING��p\D�5ֆx,�9�I��u�N#0Z���ҹp����j�k�������Oߜ�������j�Z��Ct߇�)�m�k��=���Q}<S{����=8�2�"a�%,��i`��K��QF�ȕd����Xͱ �(?N������+w'<:�Tʦ&��Ȼ�9���R�y^���-`ǘ�wտb�@y��Ċ�: ¸�C�چ5������B�C�q1\T'�=�x���{��R��y����/Lw�Em�hw0�ft��Q�Ӄ�IJ��k�l�u�#Q�B����M�1��:q�����B\���������� ��B�����<"lD���҃��!� K;C�5��y���������0)�BeFh�,��J��_�ن���x�P�*jM��}�����u��(����4�fӭ�14�oZ�$��İ\��q88U�\d����0�י���ٴ�r�g-���I�'M��>�n��h̋I%��k�>��S�����Q����q��;���^��ؘ���B ��;�F����j�������n�QGkӔĄ��� y�w����b����A��L[�;8|����>���={�����y�H�v3b_bc����7u��y�|{�-X?K�B x P���j��t�oZ�G����� �a�12���MQ���&? 9Yn�ZPwI��)0}��x8ɕ�Wm����"��F$P�ȅ���MdB�;�M�bH�?�Ya�pL$k!� i<���[��.����艞E���v]���_AB�x���`K5��� 0jl\�z7����|_��t�?�5EI�(�B �}�G��\@� �3��;>��y��(�|� 7_d?���#Qh��G���Y����b��T]��y����:pA'�7������:��),� ��x�x귚��Y�#���3~ � ���Gf��4G9:��<k�r}�;�0��#�??�f�,D�ԙ�HsD �̗���h�v(?�}(����g1[n�rH�Zl�j�i�|t���ƿl��Tr=h?40]�3���Ή\���P�g�k��+N���⤰ �+v�/�N+�?� ���9?�ٜ0J���B����Ga�����I�` �2�������.2�"��#�3N�r�M9$H�c�x;d�'��v�\��d=�/�ve2�>�����P��|�%Zy���v�qŖ!�u�@�/^��ewd{CX�)ޟyv�-�_�B��(�Y�j/f{vR �k��s)�����7��R�����ט9"g���x� ����Iy�<{� ������<��V���IG2y�Ncn�p`�Δ�&�5� �R�5B`��T`ߎ���@�b� ����"�t^�l�x�i��;�������>�9 t��;�\���Nu9a�ޘ��1 ��Ci��}��DKI��-�D��=d����d�+w�0�t��v��.��ځl��l ie�c5D�{���c�A���w��3���M�{��r�� �1�d\��Zy�(�P���v�������a_���B�anq)�4���4���0���~oS����A�9��Qa���7�����UH���<a?����`S��Viy9��h%��Ė;^]�~��E�M�4W�L��-D�7�(�<�h�z���'�����{�}fW����T�SY����S��v�a��1w.T�\����]�|���o�1���u���[(E5��/>C�����O�����Ou�y�Ԕzҁ �TMb��Ն:�)sbS̰��~l�p��.R��-�p� >L{�#�������a����HŢH*J-;�e�����a9"A `, X�l�E2`{�gz��`<(�������S�rQ�=L�����G$��{O2S��;m���2i�U�-wX��n߱���&�# ~�n����b|���z`�+i$��cp)�nM�� �<P�(i���5r�B�]����6�0L�0������ |�{����X�0�ފf�4;m��z��B^��dr���jK �)w�<>J��菉pW.�8�@d������Z;�qp����e��,��CF�nH�z�*�[(O�H�@��@�^���Hh��jS���D��ͬ]+�����J�Q�r-��ӾM$A)�[�q�YL$�@h�i�(�K^�s���X��&�c.�� �����i��u+��-s�!@��F<I.�Eo���3p�ʊ�]D"D�,G�X`�� s�k��D*���)�������m�|�,��[M�q��]Z����v��R�~@q9D@�Lw{������8��s�*��♤˳��������:A�qq�Z��?*��$#���t��6��Ug����TM��k��Y�����i���;����%x��� ���7��L�~��b$���u�2����K��c�~���.�q��H!�0�֪b�aȉ�(�B�v�~u�v,��y.��5ʋݔq�q{]��&?� nA@\ ���+Ht���m�U�����GI� �H��e����?�G��q��l"Va���4���}"_��.�����E�˴��!-�(�^��z����t!\?$���G����N�;��S�/� -�s�km=9��Æ8���h��Z���������
Static task
static1
Behavioral task
behavioral1
Sample
Google.exe
Resource
win11-20231215-en
General
-
Target
Google.exe
-
Size
24.0MB
-
MD5
e6f74111d8e1e38fc00c93a3f84c272c
-
SHA1
9a7f455227a32656ce07d65230dcd6e5b9c47b47
-
SHA256
9a64d538cc2b71b40aea1844072a905ea08937666a3a3d7d60a747c57b85cb2a
-
SHA512
41d214c3ac7377d58261f8eec12c85c56f1fe8686a7232e8955d8554b3895ba88b63d6280d6dc55d51ceb021dbc25e763a9c42705b9f9f13ff6bf00b6938f22b
-
SSDEEP
786432:JPoBi1sWBQMwD8h4zvFZVBchmCE67WSruMXu5:NotwmAezvFZVBwZKSrpS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Google.exe
Files
-
Google.exe.exe windows:6 windows x64 arch:x64
436f7cc6cb36360e453cfc2f28b1a0da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
CharUpperBuffW
advapi32
OpenProcessToken
msvcp140
??1_Lockit@std@@QEAA@XZ
winhttp
WinHttpCloseHandle
ntdll
VerSetConditionMask
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertGetCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 511KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d<> Size: - Virtual size: 16.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Nu* Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.%?8 Size: 24.0MB - Virtual size: 24.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ