yV� �GwCfnIqvj�*E����Rk����h�.0����"�f�T�K�|ktp�3=�)����n��Ʌv >h�`C��R\3����٥XE�T鯊���l�\�~` 5_-�%� �cR� �߰<��]q��lO�_+�Q�h��Zv�2Ca�C���d/O��0���t�0��:F���l��7�=H����8��4��UBcH�^������e RF~Ɗ�C�di��A��[\��¸P���>�x�-�䣫,���(+?���~ �S����.y�: �9�� �d��)�;�va��r�x����i�}3�T�s�?'�L��.��:��y#3@�Ũ�@>�`��9�҈�~$1�e�J,êhuv(�↛�K��/�+sp��u�R�F��V����6!F��u(5Amq���e��B��h��W#��MSw�0��֧��IF� %����L�;u�Z(�6ID�'��ړ�7�Z��SFf�}i�_Ȫ���M<�0ٱ�̵�Bh�&@�܃�g�m�� �J��Ht�����"۸��Ąһ>!@`p���i1u�~�)%�:ò�g��Jz+x%��_f�M)�L����<��ۀ=����K��Kև1�A?��ώox#�XF����o�G���¬zYpV�$.�W��V;�2�_8��^�Ք��όҦ��w]A�VA3(^r*p��nDB� �"����ґ�J)�"+)�{��>�H~�������Bl�.X����t��o���I<�|5b����7����QƘc!a�}Ufi��S]Pe�u�C>�*��\i&�8^q:��EN��G�6+4+QJ\�u�_�Y�"��d�����l|c�D�#av�u!$9��@�[٪3�Čq�}K�G+���K���I�x��v�ܓ�_�g��H�1k��yl�GLB���i.V���gXǫ�`Ln]�ib@�֬�#�d]��Q<���_s§)t���� �0=+r��]�F ���.L;��W���Ĕ�؞��Ϻ��[�%�r#��3B��Wo����.��-�Rd�<0i�߉�I�YMdT7r�X��eQ���9}&4���,ߛwAhT��/��k�(jgG�G��3���r�+��/|�}!�/��@�8���z��Ů7���ʽ6�%���鮏El�{�$��ث~����FB���3����Y����ѡ?Z�t.��x2,��^���Ré����$�d�tx��>8�{����f���Y������r���B|��Pt!�@e�k����hl|g��Zg%�G��k��l�~����(��7�+ .=�rzW5�A،�hk#呿��:����u�$�D���%���<����;�x;�h���T\v�}Y��$$Qb\����S]t�u�w��+���e��zS].s�s�>D_B����<������ Q��<Y�G0+ܼ�1��;�N�G���P�VIC��|�ߔ����N*M��nA/�tz����',�Q Y��~�b���5V@C�]�zV�I�� ��д5D��`��ۑ��^ KgХ'{G?����Ԇ�B�c�W� �Ƒq�u���8�����cO�d���n�Ջ�� )�~ԓ���d�#R`+~�.����:r�U0)VtMY�J�q����9|Wj�0��`ƹv�tYX���@(���3�G��8F O��Ճt]�b��{�.�c1�AzF��MGv�����ּF�?Ј�A����5J.�l���j�2��gP���t٭�[�oi�z�P���;&äu�pӡ��j���K>�t��=��w\=k}��BѠK��Q��,����yWC0�T+��R �8�D�i8�h����N:���P���)�Ŭl�0�/��~ �V����dB�](�\�B3߅�`8|��e �O�jU*. ����nD�1��r0Ҽ�X�4����A��G�O3X oD�\��Xd�� ��x������@8��^2Zl��ڝ;7�z�|���ь��e�U��b�������_��"2�aw�w����$�a�2�ћ����Q���r��fj�4n��a�^��Xd��OL��O& �?��#r�[A?�j{�P�?�б03{��G�0�+R���5G�Dc����}:�0�_+����� K!�lE�J�g����Lt�\�}��{訿�s<�N)'��aM͋41��55.f���4�bɸt���,����5S�#������Mā� �9��L�(eV�����m=����" "^�7�[� evݕ'��g��X\>Y?k�pW������C&�����:��3��V��*lۻ��[�P1p:�j`ئj㓬����S������U�?���ҕ���l��z�A��۔6�Q���\�3ڐ��yu�;��_z͠9<�V�G+I�@C�&�V� �ySG��2����k�8���pT&8#��s:�ja�d����3��kBC؋ۛ������C�-9T���n$:�� v�A�"��Ț?���0i�_.���$*�Y�4�d�zra�+q~p��`�B;�����ǘ�L�ܛG+����8?+5g� 4�����>������g D�3Zh�$�a��$L��v+x<$P �}�-9�q4�"Cƙ�Aʙlڂ��D5�9�պ�Wg�L�B���g\��L�\��6J#��تc�������$�2;{�>�~\�%L��b3yuX�]c�N.K���)Įu 3p�b�G��Ín��%%$)Ώ�z��[��; �A��Qo�$�ZH9ow� ����at��o����aN0i�J�xc�ơ��uʠʹ����s�y���J�|�f�H�A-Ԅ.�}{��o��4 w�tP�&�g��e�Ȳ�I|ޮ��0Z��ʽ'�3�E�j� *� 5n���o z4r,��ѻ�=��o �c���oDq'��C��������2Wq��s�T���K��g R��2����%�eE/�8I����H^�9�R�g�psxc�txX`jE7�u�����]'ۡC���.��\'Y8ǫ��-�!V)�� ���iĨ�{8��"��s�zK(��:�$ިm4$��IV#��'�Z~78�g����>ҫ�jֺ��J��#@G˜�R>�2�V�QQ/�+u(���\��tK�wG�-ŴfT+
Static task
static1
Behavioral task
behavioral1
Sample
osurx.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
osurx.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
osurx.exe
Resource
win11-20240412-en
General
-
Target
1.rar
-
Size
20.1MB
-
MD5
0ecbe6944c793abbc605b70a1609dc70
-
SHA1
6a3925f22510cc1f8e163b74f5400b7b572dfc5f
-
SHA256
a574af4d0d9d344ef1a75bd2d83b223a853de39e7056fb174da58118d8ae41ca
-
SHA512
a8ac018ce2a02a32ac76295ce9bc89a71b42b0080f25b3a3a2436871f6b3ee627a420d7b46ad9147b8ba592aa17667de7f054650939446ebe42b9a174fd54161
-
SSDEEP
393216:0WMzd6T5VDF/mshj0Ob93ZWXqa7V4LCHmr7crNMjF:0WMh+5VB/mshHb93ZgR4L0eOMjF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/osurx.exe
Files
-
1.rar.rar
-
osurx.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 11.5MB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4.6MB - Virtual size: 14.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE