���E��}� NHQ}�?N�6]����{�n�V����P\�汴M��.���߈$��:30���j��m���o� ��>2o���0�i �����)�L]õq^�L0��&��k>&ߏ�0���6�����yF)�ߵ��?���8�3͍Rh���y��;���\�uMW���A�J+�� <u�����*n�G!RRn�>��RW��x��j|�������v�h��z����&TFҿϱY5�麙��&Oc �)Ɨ��%{ᣱ�o/��'����#1Xt �H b[ ��2��G{o�A��S4�bQ%<v�4���A�-.�0 �V\;�6/!M9 s9o ��IH�LK�w��#����p���7����-��W�=�sY^��0���@�%�A~&d���Ӏ��B�du���1��Jl��$8��Fc��ʰ���H��m�����i}֡5�dޜ<�����%T#�q��D�I (�F/v��������RF�����)�J�)$���o�( ��-��o���\��cK�]�Hs�K��X�� z�>�6�����+f���=b����B*�Bލ���!d����d.��GH������Ym.�|̀����bC�X� �2��ݕ���[��[��8��x���3�/�o���֯�]����<��6k�5÷DK��B�#���!�/�>������%hS�(m��:��HH �n)D/���aT� ^l���8��4q��܌sJ"�֮�&�n}U�I�-�m":_᪥�G��X�j<v䟒m�(��?�� �M>F����%�?C'���9� �[m���k*xSle�CQ�����L�(���C 7�+���|~h�����H�S`.P�����S/LU��Q�����p�n��*��� ��K�n\�lK����n �t�<����֗���i��A��t�J~OCmq[w�C)�$���!�'u��`g&R�b�҂o����}d���ufx+:��p�݈=:�;�/d��A��rZ����i��݀AK�-�P�C���\ ���g��d��~K��,O҆u�f��Z{vT�h�>�2�D�� ̼�4.��R��� 7iW��P)/� �cǞ�R�*ڡ �C�usʧ�I#C��v���i�ɳ�����3b���o ��d�����pp�FG�^Y�Ȅr ����#K�&�2������'�I� C���L��������K%���m/ϻ����mDS|�#��������MU]�TV���-5�%�vX��k����z9� h�) E������dP\w���� ��4j1¯�/�V���Sw����v�<� j~E�'Jl,�ZZ�����_�Gh�9g�sڬ����1 l��n���G����L���g����N'k�3)�E�I��$��-���)��W e��咧'�z,�#���o�m�ft�ֻe�h���י:���|8��<��9���l���ְ�b��W�N��~ E�n[�aX���%�*�x��=��K��W�T��oZ]1g=�g��t��sn/Eߏ�IJ~�tW� Ρv�r�w�Ű�<�8C�֮Rϙ<�V�ί��u�����C�h0<i:��[���8��n�k�@�0r������zј�Y��"!�b�}�:ȡ9�i��;Գ���gppYz涱Wne��Jri>#T��$�N�*Q���B|�F�Mi�p�'=�5 G>`��zʺ���K���7oQ������e����?J_���V���#\MэL �DQ`���l���6�q��H�~|m�j�sl�p$n�0m3ׇS�cp!���Ϗ!F�C��<��S֡G���A}�$� `0�ߏ�|� ���ר���;:�峘�����δ,����Q�����1"s�I\(�F���<��� 6y�d"{�'�0��A ��?�@pq�q�SF����Gf�����aR<5*�m���Z���z�ͬ�~�Vژ����c�q�_��P|�cm�B �^�PB� JF���Af�_<=m���������6k���u�=���? ���_&����Z��>E�G��z ��R+�woXs ��ԳW � �N��(*�Q[���>^��{���������ޒ����8���I._yo��C�ʹ:���ׄ����g��+' LdX{��B9�wOIO��$mSF�+�k��EmZy�G͟�ej����h��!)>;�q���j�CDE���r����gA �v;k(���E�R�Hט�D�6 `m�H�v���&3���q�2�$TOshҰ�IF�a�[���7� ��Cbq��C�Zp��3����#���$[OQk���T�[��~�|֭�H>�&;BX�������ⶾ�$�ӧb?���1�=wx'�߱�Ft� G��qoi�E7�P�_g�j�{M�VP1�:����|��.�[3� 0W��5�@�T�D�����~���Cr^����BުF�&����T:P���%K`�>X66^� ��2�:6�x�1r���y�%;��l��Ize|}r��="zk5��}��ա֪����ݮY� ~�ӮS�()e b7Q�X�w aD؎ݐ�.!R���6��RKW���l��,�䩁p��2��S,������w^m/�M��훹�s/ONi�K��yKWۓ# �h��Je���=ؔ�m3��4]E2���hv��H���N8�e )��;��]0�gl�ux��{*��)��ܢ�) � |���~B�����7&Űw��,��r�B�p8�V�? ڦ��D.����:p1��HE��X��T<gLP���%7j�'����$� %�s 7�̛F��8���o9x#nio��~��X�~�]j��{j��.��ڞ�H R�Uh-`s��+�Ć�[ۭR���^�� ��,�՜�9c�\P��="=P�\JhH��䐄��(i��Uj����n��(`F.�N��> k��mnwW+q:&}��ֹ��q�o;����ю6Pq�SI�GL���&����2iGKQf�M�}I���:��\��m���A�9����X&G~�-�Eq�f!?����O}�� Ŧ�*Lq��'ܤW���L� �eC�J�C��
Static task
static1
General
-
Target
PaypalOtp.exe
-
Size
14.8MB
-
MD5
8a5f1dbaf20f85b5ba953662011b6fdd
-
SHA1
0fde5de35226d87191934755b7f299bfd45c84f5
-
SHA256
64dfa31778c6d9c456472f8df2a8a639fb38786561ac17e4f9689d76ec10cb45
-
SHA512
b50b9560c7520671f87418b7c9c5efba39bae48cfba302d5806aebf4fd0b4a995c64dc6631b120eb56182aa6c4719b742eed7ed93f48cd2ef037fc6c3c9cfd5e
-
SSDEEP
393216:C9YW2P3s4cM22145B/HHBhCWeTPwhZH8n+SVMdolLV:CeRP8m2zBvBEMfc3m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PaypalOtp.exe
Files
-
PaypalOtp.exe.exe windows:6 windows x64 arch:x64
9cfc7e5db1974002df63adc9ba2c0f75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 945KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug_g Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m_} Size: - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 993KB
IMAGE_SCN_MEM_READ
.#6m Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.%R: Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.#Dh Size: 14.8MB - Virtual size: 14.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ