�MJ������� ��i[H��9���7m*(`���kϢ�ϙ���c����>~�tr�]#<���zK6��t0#T5�ա���2�f����ɒ�̆�m��k_�c����A瓂%Il�j脧�)���U!֩bCny����x���?���1�C�b.� �h*l��gΣ�W_ə�����wꆥ"ZS�G���N�t���f���z���ʇ6-�"̯u|�}Tr�{�?p��^瘅=X���zq_1wF/|W�<��]C4F64ܐgE��wn��)�&�(�B3�)��|���a���\`�7�H;�^�FX�����IEi���������f LPLR� L±-FAZ6�8�R�GACM��ԗ)��'���$ 7O2��=(��9�Nb�M�[UΠPp�+=$�ӯ1����D�H�C�yP]U;ʫ�����A���?�AUE �;e�����*��x�ˬ�����Жgo���-&.������f� 1��y���`M:�W�BD�Ctw徫+��=QU��T�(�a��a��6��{��=�������6T�B"r#�n)Y�tp����k��poYJu�RdҒ}���V��Y$�z S`%Q�i1�?*4��ҭ��� ��'c�^�M�a�E�d̒+{l%�ȑP�k i�J\CB�%�W2t�� }�bW���k�Ƥc����EnM�}���R0hDk#\�y�Z������������cj�IĠ�M6��ʷ�>�X�o���I�g�ޠ|���@�]6���E�`�� �M�)봍j�g�b�;�ua���`Ǐ�Ʀ-�\t�:�g9���.F��~,��HwT<��^�˭�mH�c�e&l�=[z�=�o5�f�b�8� & |��ypzV2���3_ s�'���{;~��aX���^P���4W�����>��W�в�tt���ub�4��M`\G�����X����J����H7B�D�_����c��x2cx)n�l��:�1����.�_;`fa���7�lF?+�<�`M�zl�ej9�5�Y\0؆�i�y2��, Z���ݛi��i �j6p:i�@+����� �8�e�8m��w���E%D@�q�>��c�_ض���ۜةQN}?�6@�Qm��A �y��<˰�h�',�JCOCc G<y�{�7���������v^!�q�>� w&9��e� �o�}ya���ڂ�ǿ���u ԞY�d�FF�������/��95��~Q+���"�8�H�2`@�4�3"� Q3��ˈZn��L�+�G��K��gܟ-K`(�e�c��#Z��Z`����� �I���� �Qj31"z��*��]�a�����=�A\"�"υa]f�"�pU86�.x�[x>a�a��E���YY��i�����+j��(�O\l��n=@�N)�,�q�:[f��Ä\g�r.0q�@B�+��T���[��0B#�%��'e/%e�đ^d9�Χ��{+�g�6�ʁ��1]�v�v��C��^�F�f���,Ws�?3] ���=�!��+�f.��GU����Sn���` �|k�P ��v�xO���BC��)�3��s_B�!�-,�l��+����z�-iΙ��+��e˾d�FUAՀ�e] O��@�2��x2���u���Sd���Y;'�ӌ��W���fypkFÞ휿`N� u�Yɾ�B]�t�OSZ�k �|'�����f���5����P~8]S�?=�رim>����h�)����c�GY�rEl"��ǧ,Gw�n�U��/�=���-*&ho3T���;ڡ�� h��N�2�� e8p6R_���㙅����`�+��Xk9*:��p�3��Bw��������������|�������f�%pd����g������0b��y����I�|ԛH��^m? ��F9��������ˢh�䱑 \z�ׁ��h!�r�G��O�d��r���SM�i��K��yd��٫`�e>��]�Xc�d�*���}k� ���@������wĸn|R�a�}J=R����0��?��|`=ؿ������������O����a�o��b.5����@�Ϩ�0�����������7��4��(�$� �a���oy���������I*��s���Ɏ~��?����)�'��!�����R'tn��B�x�Ӎ0O6ddh�6R�R�/l9��cY$�!N�A�!A���`�2#�,��Br����l�����Ɛq��F��8l�|յ�5-�����@��^����>�@��4s6��e�z�"Jm@�������n���ߣxײ�pV���ŵ��pr�d���x��mXI�<Z���l�����S�� 3�����hs� '�|�Ʈ����5�݃>`���O� ���B:0������+8����D���x�k(����k"_}�yV)��گ%�t���/���&�`#k���0���g�Ȭ/���O�V �ꝶD�0�o#=2�k�MB&MC3y� ��s$E�s�;2f������I���I�"m��P�����kcmTB���<�u�\]As:�� /�(Lp7���DM�[&�G�_J8�+�����ӿ���G@������J~ȶJyz�l�B��j.� �8+{#Z|��x�,��5�� 8���9ml��f��k=ג�,�}� ��%Z�%��Z��D�z7_j���J���"��Z�{rx�W�&V��4���g����B>K�� ������4OkMև3D1�!F�˥0j�S���`EԒ^����6���Z����h�4| ���"���3�Oq!�*,���_ɒ#l6��-�S�g �/Ɋ(G}����������$1M�L��{8�'��F�(��k�E�S9eM�xg��j'�;L_��*���E:�B��I�\�,��L���ѿ��w;�*oX�����|�n�"u�T�r�w; ��T���Í� ~�+� �����'�l;���w��ŋ F�� �]����`'��qxND���:YQ�1�7ΑI�[�X��_Du�P�o�f+P�=�졐�}i]��fl���-��Bh�&����H'GL
Static task
static1
General
-
Target
i29Vey2Y21.exe
-
Size
5.6MB
-
MD5
17ff03c25b96f51cc2c7be7ba92eeba3
-
SHA1
15cd1e7cdeaf2e915aaf3d5405959c7620deb4e6
-
SHA256
20aa8ba1d2adc9a79ca8cb0989e0966535dcd01ef01a4f82632709b0986ea878
-
SHA512
3149fba79277147c581673f592dd3fcb008ba5ff139d203fc472cd386f2cd453706c167452fe511567813c9699fc532fa23f82c0f36a02bb9a4f6c3cd752fd6c
-
SSDEEP
98304:P57MfCaLEGJs9aXkYf5tEmEGo7G8HRel4iyd3BXMlbbqnz8FKI1O6B:P57Mfu0s9acZ79HRAuNBubYIU6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource i29Vey2Y21.exe
Files
-
i29Vey2Y21.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ