H��j2���Sa����뒔9kR�n�����|�&�c��$-�&,k�/�����5�����t�^M�( }ŏ�[ͲT?��0�M�y����S��v N��=���X�,�]�N1|qD˪�Y�/����&��e�Eс����M����;W��ղ N������r�D�ܫ0����H<�� g�3�:�m�h'�+"��V`���v�0�Xd~�X���OD��K�D�i-/�?�y&:z�6�,� ���w����֚���C���[�/5E�S~�f�:���p5NIWt%��^�ξr�Nq�}�B�tN#�E��Hu��B�R��6�*�ϳ�ݚAN ��}���I���q0r4��>.�P�rA�[��:��A���H���/X�Zn��π�H�(G[�>A��~w�[���gi��v�i �Sбl��xc�L���ޙD� �+z�<���֗�����|���),�I��S<���X�R{�W_�í�deR[�t�iw�t'oG�����'������i?��w,Z_�6'�y>q@��@�o rĶ4�x�����HG�qu��Uz�R��G���1�}��j�C�"�]м�|���+���c���v ��2�#������>X��[%l1<CS�Xġ�d�2-��>[��z/�<+���QR�*x��ᗺ\ �W!����� �+,�T��p�����5T��[��04ai(�%Z�F� %��rXAX�ƍ��7�V����H <��*�24_Q�H�Kn��I,b�LD��N���X��j&��Y�ʸ!c�]���KU� #m��ں�>s���C��5��&�PW���5�KCm`�Q ���Վb��������t%」=i����+�B}:1"��{G�#��<i�j����,��?7������N�6g��PݒNs���(a�c��-�5�D��I�h�G�ޗ�����FA��3�W#f5�j��F�o��+�/���!i&̢�V��`��������o ��!|E��Ta={t��-���tS���,FF�QH#Y����Y�I�l���&j���ȰÅ���H�<C~a�S?�K�i<>/z��^Yg�Fs�Wx�!Gf�� [����Hc殸��\ž���\Qu�άnd���_�=�K�#0HD/�L���[���m�-r�x](wo��Ot[҅,�J�KMd�l!��B~���qs�zH�ک�p�01��ŀ�3������Q�ypF/�8sx���2d����zU���}��Zl���E�e���)fn�"(!�P���\���y�%Q�wF���b�+�]Zxq��V?Vq����}�|�U�N�A�m2�+���4��G<�� ۥ��iJ��%��^@���y z=G��壬e2H'$� kNOz�>��?�+�Z�O�G�)� qfɰt�UL#)} a]&��r�evl{����t�v�D�A>���8D��m�<J1N��]�)�<��o����~Wy��ph���c�MNCnM�z]�OR�J��$�O-)���D�c74������XK�5�sxo�������8�|���/�e���U��� ��6-��*X>V�-"J����"'ނp�O,>$�9t'���Nx��ʫ��� KK*�����Y~��4��'!(���5������U?r����LX�j�b� U�$λ�\��:Y�����U��?�i,���A^/D���<�R֤��C&[�f4 Y )�\�Q�j�mki�������n�VH���|�Q���A"n�<߰n0�w����2�D�eE��Fe���t��d��q]��o�%Y ��.�Y��� �Pd�ڮ��f�T����Ez�; ]��e\�, ��N+lt7�� [<T �h�8�-��I{��`�ά�����������[�YӐ�fXxO�f lz&�ƹ���>£e5���/�w-r��b'��b�#Yܶ�6gx�P�N�(�-�p���`�y�;_H�w�nV�8�9G��>s[ha7L�K�g0����x$b�v���y�$N�b+����|��Ҁ����#c�c+k��2ưU��nA � GA�sK0�;ӃƏ��d���3�C5@�6ڠ<:δ��6�C�!1�M�Pg�)�c�\��sh�Tz�>�F���?� lK����(d� ~'�����<�b�����T�,ս����6�Wäp%{����^�ʻ��:$��t[%c����O#�xgO!W7o�A�SV���9 ��E�;�we�6wb�*R��,��Of�X��dؽ����@�*#�=�Ll� ��&j8cИRsf�����ڳ�&� �OBp#$6`�g�;6J���-sY�[.�4 L��,�;������J6��L<��(��ajl>��;ޖt˪�/���N�[�j�F0��7���mn&�oXNm�e$��U����d��p-�zm�{A�9&a��!}R^�I>voYڧi����AG��(�E��M�m��I��k�QQՏP��=�Xv7�d��),>�����Y&����3\Q��O�����o���j�fa�c@}Eu^�����M`��n|J(��t7��\t�|S7�����z+><��%�ᡩ]OV[$���Đ��6�fd1*H�4Eq�D�K�4!�����?�TgI#q��!�5�iԐ�%����/�-U���pߍ��q �F�N�.xɏJ=����颂�Ѹ�@H�Jf����=sc��ksZ��h���$��~�;"��=���:k��VB��E�f]b&`�ܕE��p�R����L�{���b�Xh��S�+]iCŀ�B�~��,q,�jW/b�9R^��(i6Sv츗�1��:��dz#4����G:�m��?J��_G���|2�,)a:X��2lюq��%���Hȩ��SyzF�}lfC:�6��SU��$� ���9�.P�U��7ODd-)�_�b�����C+*`YL���t�%��3���M�"Y����7߹S�aD T(�Ur\�EU1Ԟ�b"XzVEnWM�?�~����c% ���o���є���3����g*3���Y��k�>�M_�>fI&�;�+��������?�څ]��F
Static task
static1
General
-
Target
ChessBot.exe
-
Size
9.3MB
-
MD5
38eb92ce90ed91cee8de9b58eaa6cf66
-
SHA1
a35405f4792bb0d6e29e102f3a5c57ece5baef18
-
SHA256
682e5b29a9eb157b070ec243bdd752e526de8233e5c72d503b5bb121625252c5
-
SHA512
cc8ec01cce27653cc8a194a578861e6201b90d6c816c5046b8894ac89d4beb0600c23390ca28b225eba3ca67275aca355efb813729ca3a3c341536226ad9b1d7
-
SSDEEP
196608:QZbW3KeteY0+VlP3GGTw1EeonUqlg9DjtJGIx/EhVBTMT:QZbW3KYTPDwCeonW9Djtx/OU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ChessBot.exe
Files
-
ChessBot.exe.exe windows:5 windows x86 arch:x86
81ab59d2a43192bf5b3189ce48e08a74
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
TlsSetValue
GetVersionExA
GetVersion
Sleep
MulDiv
MulDiv
GetCPInfoExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyboardType
CreateWindowExW
CharUpperBuffW
advapi32
RegQueryValueExA
RegSetValueExA
RegNotifyChangeKeyValue
oleaut32
SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
IsEqualGUID
CreateStreamOnHGlobal
olepro32
OleLoadPicture
comctl32
ImageList_SetIconSize
imm32
ImmGetCompositionStringW
winspool.drv
OpenPrinterA
shell32
ShellExecuteA
SHGetSpecialFolderLocation
comdlg32
ChooseColorA
gdiplus
GdipGetImagePixelFormat
winmm
mciSendCommandA
crtdll
isalnum
Exports
Exports
Sections
CODE Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1.6MB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 9.2MB - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 81KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ