�O/�2�����ڽS�� :���0����4�k����q{J���[�F�=!B�t¬�l��C�?��&�r�{ �9[��g[�9cy;Hb�p}�HE�Ҷj���{Oݑ%��㡝�tӦ��~0� >0M�3�f]VEu壚�5�99-�?����LA;_�h0{���Ì+/���X}Y�T�b�;�������A�6�;��z:p���R��|�߀|��&-�3��/�n>T���*^�8BWh�\"�0��}LK�t���Yn�\�ߥ��z��m�1�e����k��#��;<���|�o��z�N߹�T��5|�e:L<�0�ve ~hh���I?�]T'? 5G�0����V��cY�>㎬��Ό�V̲�UK�MX���h6�:�Dj�N�\89!��P&b�Dr٘n����T�c�o�t-j2[��G�WW@ޭ:X8D�ݗ�>�WN����a:��[Z=��$B�'�u���n_���n�z�i���f\^�Z��%l��W�a=�T�:��P�+�˨��V�3�hNxf�a+��u���� �`DT��S��C���*�(�}�H(�8=!�q<����y�C̦}������/3�=��H��z�����L�� �'�i�?ھ�a�j}4�LW������gm�� �,�Ŋ�Uyu_&�[�G+'��Q�i����/�.���m�p��_����4hS��z*`���/�L�B�W��?�eN$~�m��T�`(��Oߛ��?����̌��It��)���D�&�Oe����^���8�_{���~�_⪌�=�rv���8��{h�Q�/�ɓS�.��TL���(Б����# �����*�e�O��v}-l�s���t�\a�L�q��W���7q�ݥdzď�&������eG�&�*�O��Dðj��@0�Y�sFԮ�ΐ�fB���#�"�_��+��z����)f_^a��='j����3�~[��'[�4����.�wq{�� ���hR{}%�<���u�Z�5 4�-��* z�3��Q��N�����Dj�� @�1ln�5�!42K��f�H����Ǥ�*A'���.Y����f� KF'��-48�]ٯ�u�yv~�h��(��" n�͠�c��w^o<u���PN���\����4�23��C�n������ A����Ut�p�!8�"z;ڍ*���nڗr2��^�ti��;9 ��A��e����2W'<�R&'c&�����U�Ǚ�$3v��b;�) ��˷}�����-z5QŶ7/��V�C��|��Y�5��>>*�]�Ax;���d�w�p��qg�����1���{�� �ە�2D��7����o�J�K��4�B/.נּ\qyԆ �.6]��JI����LfJj���J�1�9N�=i�0��GJC�����ѿ�M��JC��_Z�����MrR�4�����Pn>nrE(��-jV:�I�?7%~I6B��|<Ut=��P�Z�s�V�că���ri��`y��n�4�Fʹ<<$�e�=�����@JH��NFjZ���~��\��ɉm�23����+6;�N-n�j{c��nًڍjp���(����@pT`��m���+!��X�����$~`�I����S�� ���,$*�4��o�`��������[K�K{J�m��"����,���I�e��<������Js�����k��F���%j1DyKZ��K2�l����1�"Ngx4�b����c��[�4�`���ؚ��b�1yAI�p�/FA�#�f�-�-}�U��u$+Th��9��(�M+M�Pp,��R�ne��=.�D@+I9i](\@p��5�j ����`ݨ�;�*�j��#( jh����� L|N�ozN�v;��g(ƒ�d�a�J�qt�e�5҅獻��2�r�GK�S���O��w=*_D��~".�#1���D2 "�i�l����hL:������",q � �v������䤒��������'����;X��MA�t�v ��<k��\p�i��QC�&��� ���Ʃ>VP-ڔ�ɝ�H��;F�դqeA�:K|�?k���V�غ�ɵ#>o����e������Ą�E�:��z|CڒM�jW�@{�����Ζɔ@#o�{ j��f1ZZ��c����uv�f#�$�×���܍/Otl�S.R���y�[b�qxr/*CpzP@G�.����k/=�V�ĵmh�W��[m6�_��:�=�;��V����?l鞥�x�1ϯD���P�Գ��� ��*䚵g0����芔�zM��%�0T�-<B�dE�X�V��L7>P4���ڐ�V�&ڙ���T�9��ǯ̔xa%����E��ɏ�����X7�~M�Z�} ����16�%�jN�i������d�4ڤ����_���:�تܣ���s�J_�0Slh?�At$L�>�2E,U���x�J¾kZ�Ջx������c��n���F0U{�#R�X�����/j������H#����i��G���C/%��T5�#:�調�|��E�]D�8ʔ(th�ׄ-M]�F�M�4�3MS�g��b�+�������;���������'���� �ԕdĬ'B��R�?S�\�dSWP�rծ~f��NE������x�A�5�iK���Ofܟ�������_#�)�&��U�fu�qu������ �l��j��;Q�4b-ݭ�7�4<3"�`��� `3�%�����,F��{J���8���չe'��j���C�w���v��^�h��T�#i}�9�,�2�%g>\��H�����3��=?�߷��Z�n����M��1�Ѱ�B��>)�e>e�4X�r�!�F��m�+ ����A����w$f�FTp� �K-�G�$뺲,zKz`_4�1��]:�j��4�e����Z� �<V�P��I'F�M�6:>�,����i�7�d�:�w*D��Ki�����{[����p�(7J����gp@���0h��xy�+����m[�_h�N"���/��<�]?�e����^��;�� ˑ$�r9&f�CUA��OT����P��s[P����*$�F"�W�Cp�}�bO���s;oF��J���E�$�|��"��� ���8qj0�-��� �Hщ����mv��c�\�$��/�m����=�Br����u�{�rDְc�ݗ>�zE�����mmzr`�D�T,�LEAk<tX>)��ʇ�2��'?\D�Xz�͡t�|-8"u>�0���C�E�qA����=g��� �]�>��)pG�� �.��Yx��]�� ���`���W}ʓ�'����b|�][_7'������� ��m�����KL͘� �@�9qg�p���T��@$�Zb?�]�A$Y��o�%$��
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.FileRepMalware.20494.7181.exe
Resource
win7-20240221-en
General
-
Target
SecuriteInfo.com.FileRepMalware.20494.7181.exe
-
Size
19.3MB
-
MD5
af9764b5224f18db51d592d641caaf28
-
SHA1
e65b9a26d541fb15f265be8caed159e365a3f6ae
-
SHA256
95c7b62982bdcde9fe8cc12839a414a1aa2171103a133454e9de2e406f3a3012
-
SHA512
26d217a958403adbb8728a7b9c7dd42614c706679fbf8b23f3914368111e891c2fe242ca946139228e3f9d8280bbba4672f9ae4d6e0db25fafd369338db987cb
-
SSDEEP
393216:RJ0sCQ73sdQOls+9JNDqWxFi99NX7GzwYVqOz3t:osCg3sdQC9JNDqW7iTNuwMR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.FileRepMalware.20494.7181.exe
Files
-
SecuriteInfo.com.FileRepMalware.20494.7181.exe.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 85KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 37KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 51KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Startup.pyc