��e4t�Y�� ذ�O[�+���p9^��W��D��)]��`���ݹŘ�=ni���G��|=ĹK�b���,��{X\t�qg�q}*Jz��E��<�W,�z9Z��=ǖ�aU�㏺��j<�?w��$��^�12%��V�UA��6�~�T-1�l�QO4qH���U�Kg;�����B�,S�*����=�U�0#��(A���o+ݶ��$Y����x��hF����k���� o�ۍ$�x�نfpj���ٮ�H�ῑ� ,f}#Q�5�*�TO�1Id����}��.@���А��፬���m���������<��^<�R)�!rJ��K�Ц��J�FK�8���v��0����G�} jU�}�t�����A発�o��iٸ?���]�Uj������ aj�[�^ �Λ�T�e�H��vK��lE�!fz_�^����Y����0�¬4�����&����n�n���p3����7��#���P�4 M0�`�o�yD���m��7݈����o8/������j;�H��[]������j�b�$����)����ľl$�>& ��^�,,������;뷶h>�v�e3�˖sJˑ�����=Z��>�/h(PP�.��[�%>�K���?�R J��λu��r/1�I�j���Q�%D���J��[1,|y�� �?���0CxťLs�����ؿ���c��ъ�6rk���ۖ�sBz��y��t�2`�J����`�́u4���K�2^&��ߝ$���1w7�8f�"V���ÝhI9�Q��x3o�p�;Sڍ��jI��}���:띫st�贆(Bچ|�S"�Ӭ���@��p��q_1�)�7��F˕�><�=��87�f]�z 8�\�������ь�Dv�^jO9����#P��7,`_U&ܤ����̇��hS�`}Ҳ 7��D������U�_79J����7@&��SNOh6zq"�+��f3U�����T��ew>�?A]i���P�p��"�IE�-�����_�RwYW�E�����t��֏5��M���*�`�E�m���n�#v�aUW����}5e�u%��T�e38 ��G��Ai_(�`�DP�4,F �@�1w� �b3�L���<�ǂ{ϒ�k��a���a���l�:{=iR�T�틕B����T�7Of�����������v�������<�`���]�q=�x4��吲A�W�(&v��9�����o"�iH)���55�'�pMX�a �n�l��� �x9��g��>;�ޥ%�����4aYl��A�8쑪��x�Do�H���Һ�f�LV�2���S��@����8��]�Z�=�{�>��}H�aS���9�95,#ļ���AU��ڈ3�c_�"]��.g5�M�/en�J����y�~f;��`��c���F�A%�b_K'�L-� 61,��e���K����P���i�V���mǟ��>k���s���)$��7Z��Nxp���a�*fh�媹i2S(�})�%�|[������1���uR�W�������.<]��-�1�r�O(�ڂ���Y��gf��v���E�oU��v�ZHD�� �7��I���"��� u�_�Z�����c��6=SO$��S��r�&K����$��.�S��=�h&4(�$9uV�@��+!�5kٻ.a��� H�"J��O�jKЀEz�d��Py���<�}�����w�\C�����P�?����#G%4���]�4�j������g�l.";�䋓�[2E�i@V>$�g]��߭�½x����{�.��?� 4$����@��jKKq����t.�� )�k��A�ʧ;�炢"&�ӧ�mp���5#ǖ(,���[�#�����tz� �'�>����R�)J�*|?� ��B���Gg��V;��LS�W�:��3��e4���[P�T�(qGJ&�ͱ=q�;�����`v�,����X���p:#�lpbGn�d-n!�YZ���� ƨ���"I�w7l�2��A �vKe����`*g�c��Q�q<x����s��^:�)r.p�ɟUh9ii_��_�Y�ae!���������3*:����6���>��� uh oj(%z �]���|t`�r �2yrܙ>":�7껐[�Q�#JJ��ny�͖rmbY���b��8�ۑ���|���~fCJP��I�ndoO4���Y�u��Yc��綁2l���m.�{�;�p$_�z�R�pm� Hh�.�j@9�!.z��2���#�ILj��<�@��zI��IՈ�HXՐ��VǏ�`a�����Ŵ��Qt%�7#�t�ڙ� %w���☨��|A��#a�i������γ�@��o��śX�_u�b���P�&;,��x"Б����h}�ǒ[�,���|�������j93f?K�����1f�����V���$�u�{��;�F��2�x2-s��;;+�H�k�&��1`��6����X��ӏL��;�/@��*cہ9eE�ҷ��cgCa^LZZr���C�q72� bIVt� ���A��pU�_�ӈ'�0K2�{er g ���5���܆�C?1�48zZT!�b8��$�R���6��M3��4/U����S��|8 �-�: ��O�Al�P~/`T���&�����B��f7�Ȯ}��w���^4��~�ש"��Fd�����H���vUäO�@y[<�k�6���pi�+/��i�b�����b�^� . ��M.-I��^a$��ڀ�F�=����������d8�W�ԫ�uyO>֜ �Ԏ���}*`}wl�h���iiR˳��'r���w�B����o��S�^RN_��FE�0fAQk���&�b� A��6��G)騉���s3SD��Z I�����5!�VL�� �)��u������y\�F}���u$�T05w� ��n��/�ڔ�GUJ^ł�M����vfT���K�=HC��'��������o`�\�-�9�"���v��ik��Q�[��|�s�o�;�?�wߋg���&����8�^�t���
Static task
static1
General
-
Target
Fougest.exe
-
Size
5.9MB
-
MD5
37c6e53c86d99a51129f796ca2afb962
-
SHA1
f451da489e3b9a19a35c44928802930dc90924cd
-
SHA256
3a2f25909292f11f280dbbd4a45be6b44d5264303e8c67f88d87bd1acfb2f368
-
SHA512
1ce831af27d8c57154add23d1ec9b38e13c356ac37db4615b9878824061b684ee3518b86169bfff7ef3e7a8a9597fdc01b43992caa48d69e1d3608f10b3fb40d
-
SSDEEP
98304:7Cr9Sqyo+Z95J5pOA0ioXiKgKtp5WgYtjzVhUoBO2rycrQT+8O:7CgS+75JTOApjbKD5WHtX62k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fougest.exe
Files
-
Fougest.exe.exe windows:6 windows x64 arch:x64
Password: 1
7a4bfd4fd43b2eb84e58f7648e3703ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetLengthSid
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord200
crypt32
CertGetCertificateChain
ws2_32
closesocket
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-stdio-l1-1-0
_pclose
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 419KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CC$ Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.VY; Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.{(b Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ