�IN�� d���|,���d���XU��%��!rO����6�6� �m�|�(P�Yl�cj` k�0v�F����l����!���b��iafR��ۤtԤ����I�!vyS�YZ�T]��ި�o�O��)���ܱ��~۰t|��)�o�z���p��$�P��&)f�I2�v���f��4#�ÂQs6#���&s����ⷣ�p5u��\�����r�L��I�\��nK�;S(�L�1~Q��Z�V����A3b|�ʢr�2PD� ����ÂD��h� Bg�<��Da��r|��Y WjI0p��p���� �Cğ'I��֚�~����������</�55L��L�q���]�n[��e�m<ѶZ����� s�2��(�5���9�h ���mi�}3x��l�x�w�^{�iOjLH8�[lk8�>z�D�P�YNc�Q��/`~BH�H�S����.��k�/�Ǧu�-��g�"�d+�F֤�����ǚ�%m����b3�X&����R3T4g<�4 ��> s�)�v�aP��>�ڬ�����b,�b:,�{�M�i�k�:��yJ�ﶆ�mv����2E�#�ɬ�rCy��k��2�{��J���,nɛ�t�Q^�Ǥ������ii��z$��W+��Q�l��a�5=�K�ʫ�p�g�9���) Qd:�bZ ��|B����0)A �)��=5Z0X>!r���y�s��D�J�$0������y�0V��@D~ ��M'��"ym|0X�L��dx=[����k��^�[?��'@~v���X˥^n2���?Y?��������gc����)��{ʢf��e�Ӎq���AI�20k�F�DC��"����>rPM�U�lьE��q���F��������.��<�!T�y�g��"px�b�S�h�3xc(�7Hb&vz��t�V��W+���o��+ث��Q�_Y�VoX>#��y&�,��y,��Q��h8���h��x��b�{n=bD���ηd̔�6�H0S��lcD3KG�l Jg1S 5�ܜ�����:�]w-���-ґ�q��C0鴧���1+}�j3�Vh�w?`�s��5�$ ٲ%b�|�w\���P6J��Oao�߸��f!�G����]�����N�^h��lj| ��&F}���É�OJ�=d�GyrZ����?FfH�v�M�vt��w���Ҩf�"g��U��^'Ba'��K"lgdo5�=�5R���^��T�9t��>xqɏ�Y�e�dmpqc��J 8n�B�"M���a,�V��l£{b�-�SF��-XSC�pqZ��Y'��q觗#�R:Vt� 1H���%�3��*�k!�|x%Y�f�kh7�"]-x�y�T�V&?�]�)u��$��`|k�TG���y(���~d������rܯSѕJ��y��u�*����F���x�Y�+������F��z���p��(�O%O:��vt�bm.A�R�o�|H�n"�$|�%?ir s�B�$COJ�q�]�#xy $/)����u~ơ�>#�����s�G1^��u$gi��Ԭ"�y���f�bS���q�+GV:^D��{k�T��.�C�=�\���d�5/Ǩ�X~�HĠ� �y����G�ȃ �H�e�2!����4��ƫ/�(�;qB�b��i���Uى,2��y �?���G2���+�V��<����T��B�ǵ|�n}�������[��&��f���P��ɛ�W��X�m?����������R��X|�.��N�N���(���2��Vg_��ʐ�m\r�c�#���&&K�`�n�� ��]z��rV2�h����qI��+UƳ�/BŜ�a{�����+y�e���� #��[�K�s��{ �����E���3�bb�����i��;����>�� "n�$��p�kj<�t�К�=�*l� '��0%�1�]�@YLR��.dzp�$br�w��x��;�9�):���3�Z:��������C���(̽�k�x3��^��ǃ.ż�;J���xs���m`k��=���ݨ0Ko˚��b%�Qg=��*��|�gA���#��<ST|B�<�9c�!�JkDDžb{��MQ5��y��:�z���9b���t�K' ��[�y�k��x���y���7:|�j�2���z��[��ߗ�iف�I��y����z?"�%�HMd!OS�����&̠px�G���� *F� �ж"6,�0��"�~m��r����纸 ���]�M��әw�� N�J�������(��pE@�~�]�#D��֍����y.Da=l:�V�!x�'�C�F�� �7�Ģ��� I�Qw |L2�X�z��8�N)Z<B��.�E������E�L�������;�AP��m�����Jjz�ܕ��B�'|*~p鄆vΎ��Rjܒ��yx����8�����aZ�ߵ� �4�̔����a ��-��[�]iɳ����������d�LW�m�J�e���d� ���%쪥���'|\Ə���o��>H=VM���K2|A��WĚ��trJO�j���yǾ� ����@���f�H���J�����{�y�&�D<�=���goP�>e���vS��G�����W����<�-}���^��$rjp���H��5W��H�R�w���W`Z��GA�N$q4p�P�_�f����+%�g[�0EL}�p������ �����2��X� ���I(������<x��|�t���>U�K�\�s����jA���E�b��#˅2W�0hJ ̺�)�?�4�K ?|a�!g}��yg� L��T�1�{ړ9�B��살1n)G\�R&�x�ͬ�gnE �59K���Q ��I�*ͦk��8'9?2XzY��i0��1�H�=�ֆ�z������P��a�q}.22�!X(�VN���j[������,PY�f+���u���$������O{ N�����[\�����?q�Q���z���+�;jSi�0*(�&q4�ys�\Et�&7�bTw���h��̮��9�#`��`��7Ȧ��K)�ìu�f#0F}&N _�zC6��Q�
Static task
static1
General
-
Target
Byr723V3Cq1.rar
-
Size
5.2MB
-
MD5
1c63ab152b4be86d6d56d53df4b93d16
-
SHA1
ed2bae5cf23332708aa81c0cf63f53bf347da3f8
-
SHA256
b3ad3d9cc8a88a7b9adb031fe5e8fae969e1b7d6be2001745b47a3f2e166dbcd
-
SHA512
45e38004f06ef0080823c5c82de6be296cfff9cf6fa44b3cfde678d076bed368ff2e4c2cb7678cbfc2f0e74d715639c128d13ceccad754135ca06b2192d85f8e
-
SSDEEP
98304:2yzhY8YuuG+0rEtIc0665g9RVSkF3FTopYBVA6MQwOGHxfQfmesa3eAQr:2yjNuwRp5qR4kVBLbd0RIq1AQr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Byr723V3Cq1.exe
Files
-
Byr723V3Cq1.rar.rar
-
Byr723V3Cq1.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 461KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
bsod fix.bat
-
instructions.txt
-
w11 fix.bat