��|<~�_& @���l,���v��Nh��bZ^�ƠG� �q�l�>�}��)��:cg|�zF��qI���#�ֻ�~Ӊ����T�@��!Sӆ$Sx�ghd ��,�y�{���)��@w�Y�J~��,� �������;�[��W@n� ��'n�=��n�K��EY}�ؖ��ա��u+�Sk,⼈O$��2���;k����ay�[G��,�F�����%Rb' g�]@��ޜVv}a��+���2-��O���ܘ��zI�f~��p�sq�2��81� �'*���m��n+�Ԁ�UJ{���5HJ+ˈv��jԁ���NH��m\[ ��3b��ǵ*��q"�|���<ͅŁ{��,�h�q�(h3Qh����L�n��joi?{P�N������Ofd��K"�Z�+�<�K�q'F�[^��6����`��m�Y_�� �������A�P�̛�#����C5���������;�JN��������.\�.�f*�%�p�ζ�5D��.l�۰�DYH;��߲~��y�SK�4ȼ�A�[ �e?:��?��r���a���u���IᅖT�m�*m���O{�q����"V�oSnV�[����S49�V��g����A��V�*)Ibt ���H����hفƑB�W�S��yO�a��Q�-�*\�G~��t��˚����R�Y��k&#���2S�{RG��@�/<W˶�>���hCB�b�o���1`:�8�V��9Y~���UH�U[�^�mP&jR�T;���K]�]����dl=��k�L�ü,�@V4Ky�!D�B�l�(��5�~�ۺKK�;�e}�d��Pn�k�}���P���FX�PL��t7����`�y�k�^�����l���?�h���1��I�1����G�|���:0!gݓ~[� ��[�$v�+�06�.Q�۷�N�+��W��a@y1u�B��#��.�_�J&uҩ(y^.jz�����d�j�=�S`c_B����fhp4�eܵ���b�D�>>�+����g�Ѭu�̌]'e�|wt.Q�:D��.vv:|@��n$�)�-"�C9��[|��R�oCa���`�C��t�J�Q�� ���sEN"D-�:`%���6��vQI�n:e��ۯ��|�؝7���������R��u���Z0.�0t��@F�G�jE�WQY��I8*#��/�:��1��P�g�ӧ�a=~tqd�q� [����8o�x� �߽��+��r�F���Kr��1���p���ǃkC��ڄ�o5���+���������4_���� �_���O�X�)�,P��_�N��S�+������� ;3�y�� ��F���wK��!�B%r��d&R��|����U�tl%8�w�����"8������4�����:ǀ�������U/H�[\�CzU=i���0��Ђ��'�č"����<H�È؝6�Zm��UuC&�F�����D��� hR(I+���k �ġU!}�W �J����ne^ԑy�3I��dC�!W���&�e�_i�O_�s��c�����:�W�v#��ސ�(��9�Y(@��˒=��7<q��+1�]=�<3O"���l��,�n./ ����Hc��!�W���n������|�b\�u����=����C����f"�c|vrӧ�Z,�ѫ�_��2H�T=�ɓ��q���"ɋ�%/W�����ڂ�l�v�0�9��Mֱ#UQy��5��:�>I-�l�đ\��O��L������ �]Q*�"}��%, ��d�O��X������0�Xh��J�,�.��ڎ�����馳����C������mR�-,dSU��;5�6����*'�ţ\�=z���n^��9�-v�P >���=�]0!��6/M�r�ͫ~��a��Z'͕�U�i���Е�c�J �)�T8��3 �S��L���gkJڞ@�Vn� "���-8ī����+�V�%�k��WI�����^���n¥��#�<ݷ�Q�UJ�3�e'�=�2��IFcY����'��z,a�J�\(a"'U��--pɄ��6��4{{�fm+�9+n��i�۶��QEs�Ͷ:�)���w�^������a4�|�#�;�KQ,d��h jF���4�Y� 4Qq�v2>hDJ���79�i{�Ht�&����G�5iƌ�Ё�Gw������#�,�22I���sZ��>Ԯٸ!�����]�����wm���jeI2���x�0�OD�̔���7*��w٦�c�s��Q�1���+�v��/[���]�aw�*tZ�O2"�)6�!a�[����uC�`�� �,ۿ&��+���iX��T��q�ږ�Ӑ+��Ŏ�@Oz*$�/�>�Mҽ��P��HЭD���8�%iBhAo&�Q!��:�g��A�m`k�"��N^�ک���lj+����mx41��ZYH#�����j�~�8�Z�,L�5"3Ы>���*���k>W_U���e���ʰ��"�[IC��>� ��f��[��������VqAY}�;I��D/[[3�g�H5��WO���)����v�+k��W�Ea ��H^��(.ű����X��F\�.�-�r�6(�w�k��/ҿ����$x���p�`��̺���n?�/����H.�6�t����m���b)�?�5@�f��һ��J�O*�����'+����'�ސ�\�P��/�K�� ~n�t����J\��3Z(�K��i�X�����F�dj��x$^&#Q�G����.[��j>���m\��K�����1Ω��z�`Ż3� R����-��<=�1s-`:PW�N�K���-.�~�ٷ� Y�(��p�a�ӈ�x���q�OE�����q5�:�p~��fP�A���}��`@�p�K�~5-����L�0���Uf��_ �,�\Ǡ�Ւ�}}��&���2~ G��z%]:H�Mk�/ ���R��a��ۛ��Vc���%JK���7�cUd�,���D4������"������X�&q�vFl���a�p~&7,ЙQ�� ���?�QY<�(�̣���5 yKf�N)<�����[:w��t8�-9A,�;�N��}"
Static task
static1
General
-
Target
NewVersion.exe
-
Size
10.8MB
-
MD5
a62541296eb6722192a033913c92b4f2
-
SHA1
925bb6cea7866e823377f459201292adb759b6f9
-
SHA256
e4c1aeb14a89098641b66e92eeecbf97c555279a9de9311ff9c0e5fb61d83312
-
SHA512
1980d6e939460e760055091549a49271ab544c44538a0b084ab11ae642c669a968b443d6416c75de7ca11685c335bdcb25027813e0924ec7750ceec62b4786e8
-
SSDEEP
196608:OPmaxzmdAzdPXMe3cJXmWP6gZllEr74sQwkA78ywJpVov5R14vaHPiV4DzW:OjxydcxXl3cZzP6jr74VqoJpVS14vePM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NewVersion.exe
Files
-
NewVersion.exe.exe windows:6 windows x64 arch:x64
Password: Nico2024Niklas
5e43deabe5f8b3893720953e2c05b9eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AreFileApisANSI
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
msvcp140
??Bid@locale@std@@QEAA_KXZ
ntdll
RtlVirtualUnwind
wininet
InternetOpenA
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChainEngine
ws2_32
select
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-time-l1-1-0
_difftime64
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 639KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bat_win Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bat_win Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ