eE76.�J�y@�U\߀-��'���}�dދ��˧����(���__����x��H���\�M̾�����' �י�0��6v�u�N��瘜w���sR+ir�D�z���W�_@� t����X^焬�y��!�>��_��ǰ�-����9�(���.�0�8��Ɉ.�-eW.����/�R��:�-C�+pNEw���K3��I *������LDW�ɦ��ZV�ɓ�����M5�\H�����Q�\���JG$�nH�I�6ځ����f��a銈��N�L��g*�Dڃt��E��߸}nV���x�5y�t�PPO7+�է5�Pw�z o�y�1���Xh�Ϟ���_��3��L��}���3�(�k!�����#��7@��vr����KB0I�Mt >;���`n�#I_�=c��^���kjb �_�{��U7Z���~Ю=k_V(�>�3���ث=���oɏ�d �i��}NӆJ�HR'=���Z�D�# �pI����J,[�q��&t�����s�|9��h����5�j�w��B�V�#��d��� �/o�j����#���B&!�!�H���:W=G{��Շ$����N�،EH�T��&e1���~��=U��/�\�^�<���-�m�3�go�AN� qc�}�sv���}�����ÙR�R�p�����k�j^'ӥr�?K��~�L���8&��-�'ь�sY�V���{�Kt�&������;Fn�eS����(�|=� �Un�.��WH�$�>q{s��8��-O�5��V*+�l�Y8�9���5|%���D�P��Mյ�8�H{=�4������t��(�N��c��2����ō���u�(��6�ٞ��c h�D/�s�i�{���'�`���.�8���(�K��S2 aѡ>�]?��c��Fp���Z� �� �ʻ���g:�6Dr��3�{EQ��䭚�|���BX)^!�$3Pʁ���}sk�8tƴL|�$Q�h�#� �J��w���A����Y�ꁴ��/D�)��e��p����v�$���K����I�� hs��+2���/ˈ��C¿���.� ����A!S])}��87�� t蟯\OGșBb�Ïf^B �'��?k�gu��M̔�� b6<^���[�σ�Z;���a�/+79��f=����lY���Gn�>�]���kc�����AW�mc 4/���x��aX�x;E���O����d:L�=^��#E���9H�8Yr����&3i�� Na@������ �b'�%pc#Z�&<f��1�R�\��0{�)��6�K]H5^�*�Pk�;mM�R�F��rc�P�0?RP�a��rO&��&�kV���c�$S���ԥ<+*�%M��D ��?��j7p��+�ݾlȾ���-�xI���紐aw�v8���o�K6��rV���=����ߝu�Z0���qA�ᣜ_���7����#"i��5JD�Q�|+^Y�[�GC�oGܮ�q)�8?����C,,�%ÂN�0���������R��jE�z4s_��ou'!#�E�6b+N5����]���Xi|�f7�(�G��-=V �a�uU����:�1M���1�ih��rb(���W�z<���}�i��﵀�#�eT�f�R�}�)�w;�4,֙���nU�nv���~�� �� � ]g��Q<.㊭f�[NWa��|E@I�VjH���' �I��7X��su��'�jdX�����k�W��=i_��pӍ0�$���*��i�9��B6#��Z�"כ�d�`�о���r��LA�`�6���s����>[E�bo����?�-ŷ��u����q$�{��[�������^Q��g�@��Zƚ.��Rx��0���/�������f��4�6LM�cd���IH7�nw��sLmA=��ZsF,T�{�,v�F$) �a��{y���22�Q��'�Wt?]F��2����m�oAB�%�nA�C|��{3�[���J��"*����a|�b1��n$��'x���0�|Ƃ/J�Y�0ߧ ^���̍ �2��Fj������J�� :���SC�1���}�� lX�nb��|�������h�VUw����&�k��֕=��;�^irIϸ��B����l�����d^]G�Ҏ��Q9���`��X]�3IX%��Y"=|!�� �2]�E8���Ч_��pK��#�u)m��.$���Ƈ��?��G���u��|�މ�����O8�m��6��9^Gp� �ŢS�G;�������>*,���� �u�p����s��@ ��W� PP����E'L��J%�}`ͱݴ�K�v�+�l�.k��M��M�aY���u���3�{�BN��tc�ve��G�JRJ��:ֺ�_��X�ٸſ�x��Zeg7�%/���MZK4�2���;�v660�w�������uh�}TX��<ֳ}a�j�Hͺm�+hR��0d�Qҗ�=<Y\ ���#!N�#�K� �EC�F�ֆ/�3�V&�d��^�^���&�E~�%q;Gc��AAE�/��۫P��j�vO�X�Xn���W�K��! ��|"��y��HS�a)a�q�h{ ڀM�?�tF[7�ѹ�wё"�F!��!q"���@�$\6���?s����ٜi ���|D�˨l�@�Uܗy��2�^&,���oˋ �߆���1���0���40�Lh9� t}0}?P�J���4v��3D�m,Z6�v)�W!�t����y�Wߧ�[��o���X��w��B0�IKܡ�D�~g�Ԉ�Y>�곐�|���ҹ�fEc������� }+i�o���ŕ��럦ܢć��TW�w�U{OՌVw�:д�O�Bom��h���� ��o_�p�,���P�&��*ۣ5�c��y����i�{Dj/���MKV*N��l�2K�0�}�=ׇ��į��XAU{�=��n�������1$��-�``}���x���E���x�3��FteR�h�x�.g��c��KX���SJ�36���S��:$�寵��8���,�=���J�-��MC�;;.;�ty��#�@{�_�����o�_�����M,
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.FileRepMalware.16394.22602.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.FileRepMalware.16394.22602.exe
Resource
win10v2004-20240611-en
General
-
Target
SecuriteInfo.com.FileRepMalware.16394.22602.exe
-
Size
1.6MB
-
MD5
2d8171cea755fe0ff58fe704fa5fbe5f
-
SHA1
bb4a08ef6cc6bca3644a138be54ec6c04c6b8663
-
SHA256
006ded7d10a161c2f78fde3fda8ded62c0c80978e13e5733f52da355431c4b0a
-
SHA512
b4747a7c6d1ebc5091b9c6d49e7d82f7df15eb0cd222fb3d367d5f3f9fde01f9718dc4c579f6ee1f52a2403af56d01d3a7821de097e5ff036727bfb6ee15417b
-
SSDEEP
24576:azKx4IecEB4XnXRLSbP8JkkNGl0CsW24Ghxugx0ZqzeoAl8gR9hGjZO0WGqX:/npLUlkNGvengqXsf09/4X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.FileRepMalware.16394.22602.exe
Files
-
SecuriteInfo.com.FileRepMalware.16394.22602.exe.exe windows:5 windows x86 arch:x86
7c758b931a9dd4221c0644cd6ec8d7cc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffA
advapi32
RegOpenKeyExA
oleaut32
VariantCopy
version
GetFileVersionInfoSizeA
gdi32
CreateSolidBrush
comctl32
ImageList_Read
winspool.drv
DocumentPropertiesA
shell32
Shell_NotifyIconA
urlmon
URLDownloadToFileA
wsock32
socket
Exports
Exports
Sections
CODE Size: - Virtual size: 898KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SE Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SE Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ