a���a?�b&�R�Pd�;�;��Dv]r>_�`l��r����6R$�Z�){��u�z���H��8���1�m#��$��Hq���x����u�ebnT���?.�>���;�^wѼY���;���1!8L�3�tT����K٦`�D�\ʻ�>c|�e�dX�l^�P��]4�0IW�%�p)��������8 �H��)܃�9�~~����� �k�r�i3�_���N��)ls�R2�����K��*T��o�>.'��w�J�W�:��� ����8/�rcÛ}f '/�,�2�V� �W@�p���&~�:@� QR�-C%6'�PIJ29F/671~�C�Y`l�U��0�IV"(��Ӷ��#Ғ-�D_w��H�L?{b >��?����oS U��|v��d����N��fV�Sʙ�6�Xh����i�z�q-<���+��v�s�\8Gk����:S�U�۽�4�$�M��ݠA⺬��6����ѳ]q5e�M�/�o#ƗE��P�g��J����aSmO������Cd� 6�6A�BI�0��E,�/��D�p���g^�l�m�^��a���ԣ2`Pl9��p~�s�E����'@�^�vwM�jc�[u��'�A�?���<.fOR��\�!�X��(��rZ�{�"R<%��*���������?J�\��j���*p���LI�sE� �vv��g�?=���p��r )֚��cߧp��ء&�x��<�(��3� ��>�X -�n���hÌ�M�9\A��>0jѭP�:�|TK�3>J#F*���-�C�eٝL��W��-qc��t� �J+ϺI�wӂg��_.Q�\v<�?y���E ���d|��p'|tV��Pt��!��u �U�*b����TT�UR��S�zt���W5R���j�}�a�r{�mhh����cLg8A%�Sa���_�ĺ����x�DQ,}c�����w�����kC��v�<rfoU_O�b�q�&���LC��h�DA�a�*tL v\;ozd�� �H>��C��K�M�Xn�_��E*�������S~���|�=�,YfGE��s^[�/����Z�E_7�m��ћ���IKT%D4�n��~��oZ��r�mef䯻��`�|/apB���KvlA��b��7��TL��:z/��C�E6:�Bƚ�%�QRW���T�G�pai~=�}�f�K=�)�!t�o<���BD�G�Ú߬A�|�T��̛�+"�94Y��I��-x��VS�ݬx�Ӝ���"u��n�6Ӻ��L��A t�Y�[�o�U0���[�CU���Vl9���Us���(����-���YTN{���0�Cj)j��s�hÆ��}�W�WP���q>zjӌ���d�R���K5�8=�PzL[7@�ף���?jk�b(����� '�����Ri�����e�K��~���]�o��2��2�f]vH��y��%�q��v��۰x�.��KtXJ�4��V膭`r���>�%�+z1�2J�;h��L��I?��O��!͊�@$�����Ol5��g���@t]�q��~:z����Ur�+����3s�dpV�`�����^kXK���ڒ@$���d�2�'��*Mؙy�1*��G��g��4%"�����5��nO�/G�>�}�Ӹ����ɷw��X���Xz��tr#����VI��?������ƪ����yU���W�d���X�Χ�"_s^t�5��`#S"��v-=y�9��1���V�/5V%�o���"��ʤ�Zo�TV]{W��t\�+{1Y�z��`��C���wN�n���.a��f����e������x�Z�i��@,�Dͷ�ST:�˘�c��\��n��yM��aJ��Ck�yS �6H�Y�v�������cP;�*y�3��C���t��.�+(#Y��H�Tw)w ��2��]�.l��OG,i� �9��\$7��)`���9>q�:[F{�Ժ5+|#J�M���0��������bj�$����JФx&(�����=�N�%����������x|��X#[?�D�� ��YNg���L�괷k Z%e��f|n�s� �����s��u{sR�>(�# ����o���Oߞ�}p��4����F#�d�-�xj�h��v� ��E�U#⍷x��0)'����*up*�ȝ��+�My8���NU���P ]�:x��%���F���Axƒ��=?v��kʃ�,+��(���P �߉����;# �.��8@�Q�m@# (b�EY*XY���0_�d�v/vY7�e���:,o��(��w��ٽ]���X�D/f�_����dP�z�aW@��Na�Ť7��,b����:��(^�MD��ĥ�<e� ���uy4�=�RnDIwo��i�K���L�(�}����O)n�O�ܝ����hA#B #�� �����5� ����cK�4$�Q6|LҦQC�H�А�cįQ���{�y�<PW��=�����u�)�����nW뎕��Xf�j���hat�G-oE�ur��~$PE栢��� ��}�*L� �(rc�l! �T�,F���� ��I����gK����+>��"W}�e������Wz�Q � ��v��&�J�A+Lsm �"��m& eV������ �sγ�"�~_�#���� ��rLZʆ��Jo����ROm��sX 4tn�7��}cX�.h.�尹_��>�u�[K�@?V8�F�����i��Z �g�W8@ D�X��QY5�E^0�� .$yE)����1����(�I/k�Su��bf��`o�)�� �����cs�x�cN&�~�������KU�[E�2�7b���4��k�w� �P^�ߕ��KH��� [���������^.e�M]��������R�J��k��>B\�^��9 3��B_����X�8�K�w^�%`��oN�c�iUY�&utq��j ��~������r{V�������iʑ���"ޘ��Y���^��e���.X�/u�ߦ��Q�|L)�5���NkqN����*����37��� ��Ҕ��=�i�+�?�OHY��;Xxi}B�M�K�x�Ԥ��2�^��c�����4U�B���HW�-.��|s�Թ�f�w��3�i�����0��zX���~Vع��I��W�� `otW��\�F�q�؊�]&E��*�����횝TM_��%^�h�ٸh��NkE�QP�揩yI�B���"�ņCg���Az�D���,�����W��j%}���c��_y�K!v����Iѻܘ�!�v��Z2�4�5�iG�MO{(2��?ۛ���ۗ��0:ݟ@���̇P��t����I'��y����zΨ��)� Vl7�xNҭ��J�"��p%��V����m=J ����GR�?Ŋ����(��� �Y��@�,���F�.a��� �Q�\�\] ������K�3�J�l&
Static task
static1
General
-
Target
woozVi02.exe
-
Size
3.8MB
-
MD5
2ffe5411c2c5f11a43c469e31b0e0587
-
SHA1
730da081d01d17ef4a8f285e5af1bde63f6e7df2
-
SHA256
3c910dfef1c730570546fe0783f0b37d9e9e8292df9b7b00f3d550dce0a8990c
-
SHA512
fb48b2b79d46df8dad37e43c548debf16c0468d0ae1c71e005f02f44be72b3f5ca3193f39413db8ab42f5465adbbf271c6967b1030fd757b2b32a2d94fa4412c
-
SSDEEP
98304:Srn+4kzwtFCM13bo+1G9XGzocS2mdBdOwuuZJ:an+v0tAM1rlLz+hd6Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource woozVi02.exe
Files
-
woozVi02.exe.exe windows:6 windows x64 arch:x64
Password: woozVi02.exe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 363KB - Virtual size: 752KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 220KB - Virtual size: 456KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 115KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE