�V��Hđ�`h���:����*�����8&��3�^/�W[<rm���AW�*�˨#��� �_g���L5�b@�;W����_-��@+y�[���#�Y+���TW�%�]�^��Ŵ��WJb�����p��{8�D���1k�(������V��-#��}�R�R���8-`�~@�fԢ��(qh�T�fQv6|"����nFh���_�XXF��>*�x���y~�8xG�l�.�6���e�V.�Ƀ�n�]w��/�|�`�BW��Y:��e��UA�X����yY�ǻ3�_)#���R���ңAd�cQP�?j��3��������yMg�̢�6�����^ƽ2[�k��<RA���j]{��D�����sX��&���B]D�'�a���j���M#!,E�����g��肓R\T����2�4}7aM)S��{��[c��^�r/)���G �8��J��(P#�䔆�� �'^��G�t��=��$=���4�ע���Ke|�������|~�Tm��W�b����\.����ټS�T���S �<rб�)p�Z�I@*)U����R�pP�.�.B�����'us���y}�r���~d� ��U��G�V�ژ�ן9��O�.ڇBT�t�3w�7EHحd� ��C�p���?"-N0�}��0Z���h�G?HS�����P[5��"Vp�*Gu8'�7M{i������ �����R�K�Z���cOz��/g$o#4��M�s\h�,lQ"p�I��MⒶf.�{�8�l��g�7q���|�㷯�/���Ao=3I�P�������g�]6�H �� bⳔ��G�/�H@&�]*�d;R���ç9H��R��i� ۴J����0����|E�Ȑ�n!����q��6�وNh�D�2k�Q��R4a�ut/?XI��/y������H���ÊRIJe��A�\�C{g�N����ُ�)Z$iD,V�IQ�ٸIuRu���\}L�gf5�����b5�&t�4�mO����� K��I����i�ڽ�N۠f��b�_� A�اe6��D��o�!_3�_��l���� |g����G�.UJBd���oB&���e�{8��Nu˯�d��57��1����}����-rS��D<�N&�U���3�E��jX�䜈�����R6�Xv{��e��^�������gH�G�ؖ��H����di�4�����2��8��C��Y"]���ޔ�`_����Qb��V�RM�3����%�aO�?����e<��7�t�Ar`;6 ������L/M=��y�ݤ�����5��]��M�_�����r�.���@˅�l�O��O72��r�C�3J��>p.Bolc <����0�or����%P�UU�**ltxD߯��$�GkD���t���b��82�I�I#�,�`N����bACieE�a�;��}���!�����3L�� �9�Ҳ�F�@$t�͔�9B���J��P��F�*%��L��}����4����d�$D� �. �L��//:�#�Ө�F��2vtr�[)f&��\^?^�Q;v*9����'p *�}؝���nr@)�;L�^�_����!^���w�>9�kV�(\�5 k�e�7���\�tSJ��F�i��\����9��,/cw#����S��=���7Q����f�w�]3=d ��2tbX�(a�����{���4!֮/�U����,f��&_#��-�NI_哶��Nq Ū�&����2�>�+&���eN�"�b�m�^S6<8��`��htN�����?.������o�<x��6�a'�^H�����-��/X�� �gQ����Ap��lF5%i|���>������<H�冃� �������ɟR�o�����J9���jf����&�s�tDS#�l&���� -��RD�8�w �����/iR��f��=�5�w$:w�c��?]���]yK��-'���53H�LϮ=DBN ��F��ߦ�l:p#��V�S�c��A�N��/��dv�^2�h��R4�u �����n��G���,�W��<���e�w���#|�SA��&嚊�~�JD��GsQG���5.��>�l�#��_X~u>�\�g����,#� ;5�&�e:Ĝ�#�� X�7�kt#vp3^'��y[�6�4�dδ�>���Kw���%�&9��o�4]d����^R����Ug0-:�N��.�9�}�j��ܸ��:lN+�8����-��H�j�Z�k߬o|.ͻ������b� �s��b˜�s./9�1���Y"(�8n� o6�(�GJ�Q��bH,1n�@�f���2f`a^K������Qv�ė������gn,��v�A҉���T6qe s�n'z�w�+~��XM�_� f|���!�f��&�l�Y*j�.�̆7R�:�t�f�ci��^B"�����t���]����d�Ba��E�ލ�!B8ó��b�;z�Mrd=d䡄��I��k�Y�̈ M���:�W���&Dݽ<��!�e�_�����<4j���2�*��4�P����� Jo�~Ћ1M�v5��й=:3$�Z������$T�љ�͘߈��%[�4�� i ^��ZT? C�'�`r��N?���������Y'�_�.l�=A�n��A���ӿ8ݠ4ܮ`1�JS��h�N{Uh�,Iզ�er�p?�sXa�98��J&2\��Հ��V��f{`G�/�Bk���y���ʔ{[��I]��R�Qn��H��o fd2"l����*�{?d3�Za�Y9˵���^��}R�@kBɗ�}!��v[��x}�=�[�K��&��tŌ2�A 2���� W��=���2F�ɟ�D��H^��Р}h� JC��}G���ؽ�'�3֘����5<����]_˭Γ�P�����t�w"���C�nK�`M}���u�% �U�E�I��/��=��#��yΗ�n<�p98l��q�J��bL�Ul\�x AY$Q>H��x�N:al�� ���vE�<�/��˽a�� ���_/�
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.Evo-gen.32158.26956.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win64.Evo-gen.32158.26956.dll
Resource
win10v2004-20240508-en
General
-
Target
SecuriteInfo.com.Win64.Evo-gen.32158.26956.exe
-
Size
13.2MB
-
MD5
23dab094c2fd668b46a91cf7062054df
-
SHA1
a6d03ad8ea75d1d44e7c90e971d336e3ebb88c65
-
SHA256
9250596f990b94264d818cde82c3e721fd6e33dfb06a7dd02b3951bef5391b68
-
SHA512
cd29cf2166b59b8909c68382959eca25b8e20d2d49b69cae3556786971710e2dd60c98a5e1fac4132d59c57d0a7107dbd37e53ed3d22af2157ce86b9c40bc468
-
SSDEEP
196608:y0NWDisOevLXZO1OAL1CKhjrLhkDdq838PCvu2de83c6q7OIafbahndPoEd4KuWK:y0Uis7XZO1OWcz35dwyc6qCP8d7dnS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Win64.Evo-gen.32158.26956.exe
Files
-
SecuriteInfo.com.Win64.Evo-gen.32158.26956.exe.dll windows:5 windows x64 arch:x64
a912853504211ef72b8fdbb6857a6b49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__iob_func
user32
wsprintfW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 12.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 516B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 288B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 51B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13.2MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ