р�덹)NQH%���U2�� Bw��}����3�!,gfƅ ^��!�W@�^r��;},,�M̫�n�K�)�4����cЁ�8]��Gc���q+���z&�M�<�H��`�A�h#���<lA�l�d����2����d���� RfG�U1��;>�J��C��Ƌpu�&��D�^������L(� \c���p['em6�y��|�6���OC�b����@^�2�RF�f�p�����^���� ���k��0�v<�=��>��g�L�gvIΒ�������Y��k�/@Ѳf.1JX-���!Q����t���6+��8-1����%f���ЗB����>�^.��m���7�4~q�ߎ���GD���y���C�8��LT��W�q�л����.*4ؘ���sj��4�3#^!Eծ�@����4�OdT����>�s��ǐ,�����~e�9���3��y�1&nus�P��9'@{�<? #g�_��(�����Y: �5B����� �<t6�� \��F��%����J�%쉺6��ʱ���^��7�%< S�ҵ���;{��Rq:�+t1�˞-A�>��D���¥ӂ�6zz$����f�e���Y�;�~�<|���o�����9�'����_�Tn�������Qy�9>�nxJ�y��8m%8S�m��kt�J �G>C��8���w�t��e�Wr�kA�G�7�ΐ��g�F:_U84@ ��sc����?�7���G]q,��r7����T$R֞}YӪ���m8Ӝ~��F0�F6�d�]}��c �cV�rv�?�cNU�c<a�� ��?ϰ���-Ť�;ޫ�HR�f����}�M���Uٯ�$�bW�>#� ��� �� T��WQ��1�t��m��(۔��~���niߝ�0G��.�:[�5Y�)lZywm����/G/廱hD���l�: *���O~�-�☥� �`O�%�q��Sj�i�rL��� ����˭k� y�'���'�B"��w�39yW��Rj72��@B��_1���X�5��&J���\�������\��IR�g�ς�����XL�w;���j�Qi��A'C;W`��L�O�\-�r�a�}��/ ��B���{�@�)M� >+uiL�0e�� �����{���ʞ�ee2[�8 S�x<7tr�ӽ�n���tK����z1Ng��;�}�����{t�B��>�[ך��*�m���o�~iJ�:�sԲi�Ch�ֆ�� <�LY}�M��J�:0R�~���I��юW������C��Q����"� �JcUߒ�-�Gd��JD�8,��|���+��"�f���M�D���[�'J��y:1T����M&2���6���Rf�iB!J�}:����i(���1y����=��ki�ʸ�ꢑw�Q����\��/ �����h�ð -7��4�R�5���\�2�y��Co��C$1����W��n����# �*������<1�������.���*?�L�7Aw9�K�� XC� � ���A#�8_���7[���Gv��S�lq�ճ���{ e�'ӊ��O1���Y|��&�0&e�����ݼ���A�����9m���� ��ֹ�_c���9N3g�x��~�gL�闆k ���ۂ���V-!p�&#\Nŭ����,7���� k+y����=�K]�!�����P2���� t/��0��#���A���z��Md1��6���@���m����%�ƾF��j&�Bq���,ɩGM+e��G�MH��P���R~�F���*�r �|����k�����q���-�O�����X���C]Y6c� -�9�pY�ߒ\��W �n0��W�1j��5��A�x0��)�S�?���i3V�p�σ�:���ĤjI�* g�+;:�SN �<W�������(9�K`{��A�^�ɦ��C�W�afa�/&�����v(?P��lj'�N�d�� !�hx&H�/�#���(�1>��8�t��0e�c����G߆l]��bY���Ҍ���A*���u�}��֒��rI�b�_�~����<(5��b�^̲��}��<9��.1�)�n+WE��@��$w����!�*?�S�`��v����1�M�ңhŅ����0b�>A!TZZ/`d�J�u!�2Iw���*�������Y������&��m@���y%�v9��^o��O�\�^Ŭ����l��E�t���Q�nxĂ�+V ����p���H%��`��F�0������M�D )��Kbߗ)3�DZ}L�� *%T���:����(���F��Q��$6�#H�����Q�~�$��q�Dž֯���q^uʟh����p^�D���ฑ����o!����˄��>��/�M�Yu��������p��f�:� Ϟ�B��ӄ��v������+�'U��8�y>���(�71����Ő �H(����dgܨ���zp �Y��a�*���Rϑ�q ݻ5�����Km��պvJ-_��O`~�VZBZR�)���gd�ţdCJiت~�v�hkx�QT�B��s��g�뒢� ���_��Vf��v��3�bS'}♶1y4��/QJ�m�������%���=/!���W%*����,��b�Gr���F�1�bD������R?���= !�έ�l�54,b���V-��xH����i��[��L M��P�f��%�x`$����a���G1��*��Y2Lq�~؋�3�շՒ����6-.d :��Ppx��V-�*�,���������~��4sP�&W3�ݙEҘP歟��^��W�T�Q���eAw���J��{O7b�OTd����IWg�דX��&�G�?&���Fn�4����3mD��̑��N�����[��Ɖ�ۏE�vѨ>����߲�*ߜ���X��z�᳨��/z���0N��[������&�����<��>4�dD!�Q����D� �s@2[�<���}��f� bV2���M���Ft+�e���_����^*� ϰ�*�X٩o��Q�F�c�ܵ�6ۉB)G4���GT�z�����
Static task
static1
General
-
Target
$RVPBEKE.exe
-
Size
6.6MB
-
MD5
8b5eeeeed392e1ae5bad0b5a94c5690b
-
SHA1
da3ad5180bd3bb9021c8b9eec256c1e2aecd3b4f
-
SHA256
3fa20a022ceafed663d70a0d7d41c2efe9fb185f1f9d2ed947e608c6076e9fae
-
SHA512
42fe98a71de00f25e3628ca82a78c32338abf2214e7d6958335e381d3890cbc55d02473b6aade8ab7192d883fa04bb30e9d1a749d7e7e5265d8dec5af77e31ee
-
SSDEEP
98304:R0Wrsjet17vxLYLD++e2+S1ycVzjr5epB1W9DkfjsbQ1/cbAK54oMjU1:Ui1dYBe2+SA0TczP+RMjU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource $RVPBEKE.exe
Files
-
$RVPBEKE.exe.exe windows:6 windows x64 arch:x64
898a8f01053c83a2498539291e52d918
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForSingleObject
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Throw_Cpp_error@std@@YAXH@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 972B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.by_noel Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.by_noel Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ