�>5lx�S9�xR�p�Ad���鹀�u�>R���Uc,�����W�x 7���c��l�d�o���+^�X�u���CZ$'�l՞�lL0�g����J�����H�P�ش�#��۳�yA��1���( W��q��/^ĵk�q-�"����9x�+�C t���AC��*��{JVam9����ud6Z��F�1?�e�C��#*����^�}��e���;�n����짡6ܰ��x����lЙn�� m���&�Ճ��+� ��y�ST�i��'U��:'y8k�\��^�!�J9$|n�sZ�o��$��ܳ/��u������e�������Ї��-�wJ��T��X/f��`g(�����_~��o�o����@~ϰR�o�dD�ѬO���xR�$��i�A�4��I��+�*��rJ��)���`�E�~���.?�3�@f��h�Wj.��I���F�"�)1�j�[��u3�ˍ�"�M�����p��(1���YYʡ�0�����^!��2a�LW�Ȧ�~�Q|����z��1�]�i�8h�&G�>L�O�����;����$Q�)J�d��U/�,�ȸ(�EM5����G&/�� Ǩc����Y�QgԱ}S�f�����^��ae^�0MYhĂ��� ���<�%v+;������N���� $U��of��E�9���z�����6g~7K����D��\�NI��ԲG���t�Į0��[�O~/k��IM�W��6�K<?�4��Pp��_G>�U�z�N���ic �x�Ҟg�ś`��������G��È�9x��Oف�h���5w��%�^���H£��M�t�z2��#�Ms�ʟ��Sw,>�$���4e&f���9����j�C�=�$��|]��HB��_�Pc�yi�#9x4�ׁp�Ӎቪ��*�n:� p�E�x�a+Vʥ��ê$Z���WLU�0DϺ���cas��]k g B�$~��I��[��=oqϹ�KG��c=�����H��0�xWD�+��'��R���p��c���XnZ��������H�LA�pjlsq��ye�i��K� ?��d[�*�t����j�:FG���~%*#�[����;�ʌs�D{ϥ��Q6^2ܪ��A�v��)Q��i���oP�HĆM^��Y_ {7,@�T(��K�m�O��p��C,x&H��;��@ϿB7����ۍ`�i�<~�Z٬��#{���!4]�2��5��(�Z?�o�[�H$�!����g�<��佤��sK�vY/������p(�2&1���q�#:x ����?'��ʩK� S$�R;��L/�YEFZåLc���g b�0?�6ksK��{�(;'Y�K��P'��L�_]l�ԩ����Z�J4P�O�X�'��r��'���i!�r.�5_I9m����K�N�?��*�p���{��E���� ##"���'��C���.��nQ�Y`��z��0A��Q؉���w��.ML'�0f�~8��@Jt㮮�V�ZKQN��N�XAk:�_Y�w�܀�![��VNe��f�_(lO&�� ���Vt�pj�� �pfhl����ҕ#n �e�����3�%��r�����q��gHUpv8�7�@BLN����}ܟ��Y�дe��������|�S�q @�n`��W�`S ʅ#��ޖ��}D��v=����r�����^�p[���owo�@�@�L@}�by�p?(B�X��^�˼v� ��r��J�nJ��t�D [b��מ�]ξ�Y�������Nf{�i�����~c�e�35K:�s~�ᚺ����sS*#=��2���gZ!�����{���O�タ��1�.�K�2/>��Q蔨�]�9�VV�Z?�cMS'M���s�6��[I`�m�����7Y&��lH�g��k��с���Ϥ�Pl�͏��Zv�c6��B��I��� �[�� ~I��&�Y~l(��zh$N�� �e�gCV �LO+13Qs�<P狀��1��X���-��ꏳp��9o�����ȑ���%����x��_�j��|GVj9�vu�|��lV��Y�6��ӿ��e|bx��}t�2�H��,����#�/�;Q���X�����'_�{֠�%m���ܙP3��dн_D�F0�Ԥ~$@7�}�'=�elʸ�p�8��9��d|1��D�Ƒ��W����1�_W��U�}�-��?�@J���� ��0��+���xm��n3#���l�v�g(�&g��*����������`�� n��� �/w�q����f���R�T�N{Z`|����>���"8�l�\�Ԛ9�1[[�Ko���X�l��gć׀U�ެ�[J.p=F�F@c������ )y�a���v'A�P��I��c�&v .��Kȵ�?˶�. �71��]��O:� �՜�d�G`ʾ���"y��I���{�&��G�����h�<�I]/%B�k���lou�p6�+�/����~�3��+�8��^�V5�3�\�oĖ�o7%������R�<����-v��j-��B~�c�kf���E��>�TdRb���=�?��ΥyL:����(�"�/�V��k�(��C������r ,����=5`o�$����=P_M��j�P����;�G����ӧvbݫ���N)���i���Һ��=���7�����6*��Y���,���,�>䭅Q]�>�2�����F�`(in��q�5����1� ��>�q A}(�,_�Qh�]O���$�P+ �c'�:ZbT��b��)�R0�G��"�N�(�(0�M�J�57/.�;k��m�~Kh.}�B�* T��Z�+*���&�&�X�{����\�r D���6�uG�Ѱu�F(T��I���ˑ2=�E�I�{X:���f��vԴ -���3�t��mQnU �N}c�qe�HlU����?w��y�)$�F%b�|}"�_'.�ۧl�oWPj�i�@��ܭ5���G��"�m�{����n�BCY����+&�`��|=��$�r�K��9�>�^��^K�%#y ��'�ʼn?���(v$&"�z6�A~�s(�ܝ��]=:#�B!��k&�\&�f�z'V
Static task
static1
General
-
Target
b3e694ce12e6f67db5db56177abfddebbc29f558618987e014f47a46996a8ced.zip
-
Size
377KB
-
MD5
e05181b02917a6db38e2cee5c692802a
-
SHA1
af14736540a12cac96999fa4b4773dbdbfe8c637
-
SHA256
364309e91bb5fa9b7a6080ebe44a35238456aabd23edf5b1b2baabc03b528d14
-
SHA512
21822907b70ca054538519c2d77f34ddb4dc8ea47bd5bb1b26e8516ecbe39b4e554f97c677bd8fa43d776fc214b8563d367d9af7e3852d40f36c5188eed73e32
-
SSDEEP
6144:3TKK48V5udywnFoA7zEHcT3e5SiBALDiGm4fHuF/qgTm/ESP4YazpqbzQy6RLO+R:3TKKpVodywB7zEH6uoiY8ir/ESQtqbzs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b3e694ce12e6f67db5db56177abfddebbc29f558618987e014f47a46996a8ced
Files
-
b3e694ce12e6f67db5db56177abfddebbc29f558618987e014f47a46996a8ced.zip.zip
Password: infected
-
b3e694ce12e6f67db5db56177abfddebbc29f558618987e014f47a46996a8ced.exe windows:6 windows x86 arch:x86
3438493da98812ce65ca190bcc67ec65
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 291KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ikhbvfc Size: - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ikhbvfc Size: 583KB - Virtual size: 583KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ