�Q<�Y,{�]�A{W&b'���ocoSk�*��X��A6�G���;�ӿ]�,X�{<������Pd�������C�!h9���Ұ8H{C�0�1}xfG�2�(e��N�jM�փ,t������dt����͚ ����+C����KSե��!Ht�6|Q=_!� 0�������+6���|������<������i*q��߹h+49M�WvN97���Y��R�Y�凭�{$�/�Uv�o��w�V�T��֝���EL�ۜ�/��K�����<��[��^khⷪ��ԥ��Î�ƹ���bup~�hd��ѯ�Q�D�|��PR�w��g ��R��(�̓N��L��E�h�ө�[�oΗ��9���o9�燵!�9!��~���S#�l��d��|��<�0pt,����A9T18��U�p=l4Z��s�����*��ʝ0L���iv�B�,V�'L�O[\��Po�/�h�w��F����]b_��jֈy{�`��d %���@����Z<��<@�E0G�5BIB4��D5�ݮV��y����^)+m��{�H�>�vE��}���V �Ql�Jߐ��i���R���W���.�o8����#@��C��;A큭+��>�b����AC�TF??>���l�o�'�O?���h\+�h�P�&�v1��7�ck�� W)0J;a��!]% e�֪ �k]�_�%���r�N�=%�x�����cH.̟�?�h �?K���V������^�Y���#'SA�U_�cu"�ҦZ���W?���*=-%�EE��>F�2���Zs*,熦7Sy�!MQ���/kS;�?"��7�ԋD��d�h�6}�t@�O�*f�U}�b�a�Z ?Ş��_6�d���FD4���Q.��&Pr����V�d�y���UQF��gƶ�U��'�ڙ���O"�U�oPo�oT���gSz �Fb�C�Mo)i����,����Ax������A�]~ o_H� ��s���n���Yk�����4���e>��O��֓��=�>���w\�%I��v��O�I��"ֿ��d�T�X�ƿvIfp�Ѭj�5��VhJ�~\� S%Y��z ԆB�*#v���M�=�U�S7���Ot���T�L��nE�J�P� k,L�)��E��m/�8� `�|O9�)�`Ģg�U���PQ8)!�x}�`Gh��(��^c@��4�O�탻����K dm�P�����f ���I����T��x���v��� 1���O���ֽ��M�x���Z���hC���{m�ߋ%Q����R�����z��Is�HIA0��2�Qµ �����D2���]���X�V��Ϡ~e����ѐ�Lm��s}\��}�����r�M��Z�P.��!���[?����c�z��S��O��@�2fϞ�I.j��9:�T0��j4�n��=��ۑ����s�����&���Z�f���:���6_k�GȾ�/��|�������d�@-�+���DC�3!@��.�K��菱T<a�����m��!A&}��v����Z�������0ځ�Ԫ�X�v������%��s�Yh�G�ϱ�u���̹ ��Q��?I�o��8�ܜ>'�~qz���Au#A�#4{��Y'����,۳��l���A��!�0��O�V�x��vH �sus��Ó�Y�+%�_�*n۸��۾F=��\C<���>Ok�*�j3���UU.#f��\��g���2 �[sNou[�n*��M��!���S>�=�,���v���y����˭H�X�`��ɟW>�Xj4�Ms��zM:i:3���|�t��}�'��D���l�%���cT�`7�B2,bߡ�Ҡ���@}�=��4"��p�������3�]��߀�B�؟���珺Vb����8���n���� +�/q ~��>��� %�゛ t�+a��,���K�ۡ<s���"P����c/� VfU��1b���'�[,pgp����IpKxNˤ�a��Jz��^���� u���őo9�)��=/�Q�%JcD�����&�Q�n�&7�}ji���f9���!�����?�SX��mG��a.�>7�gЅQ&����T�}�vYgps��S{6��fO��q���G�������g<q���M����J�g��s��3D���|.K�C�� ұP?��|v�����>�-��Z.ҧ?��m�lF��6��|[�:w7��{9�p2[���n��4~��!A��s'��{G�5����z��4ɊO��L��v8l�`}}�6m��x�>dq�ˑ��:m�E�рK��0R�d�D�\�;<�6F�0�,���O�o8�t ��%K���9b�D~��ai�X���(�>{;���<�r�ʳ���1'�ȳ��x����A��Ă�j�v���c4e����K;�@fd��kԅZ`ɸQ��Q�ź�fx�9d���!}fq�h�7G�,��O�V��#���&�u��&@�����J� ���H�!9ξ3�ᶂ���j���6��:�5���{��ۆ��Y��Tn�QQ] 5]���J�=��K�����D�ê�e?(<%�YD�t4$���=F�z��:⾈�_�y�w:qw&`�Q�"g4m:*aC��D �u�Ho��_k0?���>���x�ªؔr5i[O3��X��� ��S�^3>�h�x�7Z�Ѳjӷ�H2�e��n���-n&�hL��!FH�3�n��KV�"��ؔ��5�����J�%�~�?*]aJ�'T;��˧�z�E�=�G��a���Vj5��|ܤҨx{+��"Uj{}a罻�툚 (PB�{J�`��v:�%�E~�.m��3^<�VTm�3�0'�&��� `�!���,��?�F�6x��&�ϋM?<������5c?j���-L�Q�~F�����O������0���y��V����`���� 4�U�N�v��jL�O��נݖ�-�zH�_�ɵ�)·[6����$3���Q�{�E�w�ZM��eZk�K�c�мV7k�`����/��� �"����0B��G (�{�]��M?��� �2q�)~�
Static task
static1
Behavioral task
behavioral1
Sample
qh9chflRNvQlsQWF.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
qh9chflRNvQlsQWF.exe
Resource
win10v2004-20231215-en
General
-
Target
qh9chflRNvQlsQWF.exe
-
Size
14.1MB
-
MD5
9920336f06d29bc5f3be9ed55b35e879
-
SHA1
49fea20b09e76a453bda1803dc55f20f05207f13
-
SHA256
8863774e4f5a89e1eb4035e86376ab763a59cea2c8048d4b0f77d2fe9288f580
-
SHA512
ad16b1a4faf113bfa87f94f0ce5ea8830063f0fa64ad10b357c150c5e0551bdb86dfc100235f93d00c5eeb88e77f9211534c42029dbbca01cd58e75dad9d86de
-
SSDEEP
393216:NOD7Bt1UKNG/meajuwWBkn4P/Ia2DeBfIXh2myLihViWUK+qAt:u1JGee20qY/I0eRTv2z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qh9chflRNvQlsQWF.exe
Files
-
qh9chflRNvQlsQWF.exe.exe windows:5 windows x86 arch:x86
b15c610e5b983356413b09ba17ef6473
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindFileNameA
kernel32
LockResource
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExA
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NVIDIA0 Size: - Virtual size: 11.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.NVIDIA1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NVIDIA2 Size: 14.0MB - Virtual size: 14.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE