��!��"��P`��y�M�O�B� K��"2h,��jt-��b��^�K�{�5��C?��&;�Mx�G���r���puk�_I�sX�;��r�ɥu�9k���>�h�L�K�m�_����Y�y�ΥYX��m!�)����Ɍ�b���[�\ ���� iZ�IO�6z�V�Y� G���$�� J�����:�KP�����:R-F�3���tʓ��V4��sQ���@�}sAPb�5ˉ�&�ƈ���ZWˆA�6E�-j��L�o�q�/�o����6�F����_T_~+g��C/�ĵ<�k�R�������(���E(���v�dBe㮸\߰}�����@��rF��c(�5c�ȸ9���yf&�`W�w���k�����ebnd��@M�o�d�I���h��P�p�-ַZ���=����V����4��^E���XA���}F��<A��#�&Sd�"&�[�*����1#���-[�+9H�]X�%z��ǥ�Wl>��L��f�g�^�Y.q@�0���=�NF)�*���ꕠ��� �4�H��(2$�C~�J��7uzA��O!o5��X�n1۽��Q��6�ɴ��/s����Ejj=��.��9筢�S�g�4��}��v���h~�Qa�v��K)Q%�!�.�N"�Ԝ�a3V�}@��fTue������IZ� 9�ɀ���6�%?����f5��Z���U��M(H4Ļ���@��4�� ҏZ������^��m� �ۂ��ڐU�r�9�}��$��[p�3hI��M���EHs�S�z$Q����X�@�����}Q�j�������ʁj�����5�C�;��>c2Ę.�eP���8�gI~$��5����~�ة`mj�RG�X8�'�v������G�g��|�v,�[EMs�|�~?��W�����s9!�.w���O����}�1�Cz��� ʛ�)p� �)�&�l�|���V�ذ�^��o��P=w1���[�����Y�� �� x'�c�\Ŗ!�+W��pN3���Br�6�M�U#Ps��Mz��89:��N��b%��sP���d�a55F���%�XJ��BJ�m=��I�>�ނ�`Nם$ےKxc��U2��oFf3/�&������D��%��|!�=)���GU�h����?��T!1S�3�VO�(L0����3�)|_=��w�*���v;��2`�A���=�Oe����G�ynQ��G��f �f6ǶЗ�V���J�"�#�������&ynJ�Di�����eZ �0 �`��3��X[�����hX-�4����\�ɀ/x�w!���1�yJ��kg�'�J�Ez۾�"?�������mп)�֟�Z(�-�N3f�y��t@��m��yf{�`!��I�^܌㫤�F�CSjZ~�!��%<"D&��į`j`����[Iq������i�y��F�>��dZ}�s}����˳�k���L��G��P$C��(�K�P7R���*��>���r����f�/���($��Es(�I�(�o�v�*��0Em{��Q�Tٙ��Y�u��wQ�4)��tŹ���Y#]s�JͶ~�����UY��ݞ�M���qAfa!��Ka�c�ڲ���㐨`k��}��f&���º%1�0�h��P�_KͥP��71����/'=�u�x.��7��Zp�����ze�ޘw���#�� %R$�R�u8�N�2{}�v|��x�3�KcGZY�L����$���.�d��/�]&�p.�aaѷ��%�dR`z�]:8Gii\�M8��hֶe²���z4v42�A�LŐ�0�?��������o;���p���9T��7q�)֙4S�H� �A����G�?N�TW�]�y�v�\�r9�|���&��S.����^���_��"���C���8�JeW� ̞g���g���'�8h.�O-��%s*��Ps�� ��b)�?��:D� �����!UdHZNΕH���"�Dp�I�1@��D��`��":��� �����q(�z��X�r��o$~�]��'�==�M�x��TFA�ӛ��u �7��.1R��a�GE����$���E{�]� 0���HXEr�#�w�����=E��h��?͚*��y,r������-˟ө���|�}1x#���JA�$Ei.�M�u��x��=B� ��s��6˭|�+�t�mI]9�2"�9r��Iԁ*�d�Y>����6B��H'sw~��TH���|G��x��y@���(����w@���d{,���{� ge|�u�� ��1'���ɭ��>������L�:AӸ�� Œ�X�����wSB�q��p�B�����<��9�3�1~6�RC@?E�5:��ڨ���c��0|��|u-j��Ø�r_���`to�����0R�Q���������ſ�:@b�����k �=3^�����Do�ʇ�qB .����l�I%1j�_�������R*Ī�����{)3���A[�n�o���VA���[��=�䑲��l���'M�s�a�yi2�E�*���Kk��M�@tAcQ��qA�H)ͦ%�e�يA�=��M���Ǐ�O�a��m��ț�0t(7�A_}��apR���Q==Q���o~�M�xoj�J�,���oNZ~LF$x���C�[;�#�%& w�}ٮ_� ���L�U���]��/Y�� �U�τ�C��|����p��Sm8��Oq&e#~Z�FXH8��>��,��CI��D�KX�!Xy��@����<��0-%_<�k/�� �%����#0��?�����\�����A5��K�T���� 2���|��i�'�t�B��Q���&��/���_��K;���2���DZ�E����b�^������< �G�0CFW�E�̈�`<�t*D�P�C������ٹLG!��� ���N&�y(�F����6�*��~f����NS�F�g���a+��UUzp�,P{|��b�noZ8���9����B�C��C�u��+'�{��d�_:�Yo�c����� �UzJiŘ��f>��k���v���ɒ7��n�U�
Static task
static1
General
-
Target
Discord.exe
-
Size
20.1MB
-
MD5
4d8db7cb1c81e8e22c0fe00386034b0c
-
SHA1
df18ce7b29ecccac55a690303cd5ccc6fc4b50db
-
SHA256
794dac7bff6ee1d9d9e3afe036507d5b42d9e68dd3b7dca2e7cfdf7b82f63553
-
SHA512
83d238a92c774226c7afe8b22e87b8529a3d58e45e2d4b03a9cc24322afb2ca5edf633586a3cbf29c885cfe4851e16b068a67e8038b912c8f1107c06ef4dffd3
-
SSDEEP
393216:COmn2rHCLJOsIhH+GoW5tKPsFmTB0J+sSU63gH+nduLmJ5:Crn2G+eGntY4SVgendu6J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Discord.exe
Files
-
Discord.exe.exe windows:6 windows x64 arch:x64
3c61220f013cd1054794e42c228a302e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
socket
advapi32
RegOpenKeyExA
kernel32
FreeEnvironmentStringsW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
SysAllocString
imm32
ImmGetContext
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
ntdll
RtlCaptureContext
Exports
Exports
Sections
.text Size: - Virtual size: 935KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 19.9MB - Virtual size: 19.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ