?�W��e�~*�fDR�*��x� L欛̵���0̥��f�����9��V��²�L������b:˖�dDa�/A���:�9mn�!j� ���)���o�ך�o�l�L�����K(:�z.�8����+����Ӵ��A>E��Ӧ&�d��e��g����lL.��>d�Dj>?�n���(#Ԣs�I2)��.���VLn�z�p|�p��H(��c.w� ��<[*��RU���#L��ʁ��C߳v��$Ŭ�f$�p'�^č�ː ���� Qn�+0�{۳����?�7�-�\z-�F�5^�9���y֭5�g���L@z�<�դ�� Xp�u�}�PA�L���i[���5I T�\�oĆ�\�Ҁ#�����J���~5��O�~N��z!���gw�jV�no��=����ǥ5\g^�'NeK��q�3����B�b�Pa\��թD�v��x��E0�Ǹ���Y��j� �6����B��I6TU�m2|��5����6+��ߣow���v32�ā�9��B�˵)� �eٷi�8ٛ� G������ɅeR� O��4�=�6�z��ڲ��8@(����G|^�����p�t.���o�3!�G,}�Z6'�6��o|�Wi��&���K�.�'w|\�w1��y��|�oo��m!m���"~4�b�*([OL��^N2�p�s�8 �4��ڣ�-GA2V�v���P�_,n*�U����7*Oe�:�1�7���8�l�8yc����F�(�����D��W9����a����6=>$b�<f�D@�`���#�(��.�!~(m����!��-z��D��C�(GR��ۗ]�\�4��~� bK=U<�\9u����wfO�b����}�����捘`��щ����4�l>���k:Z�S�)����x�6ߩox������a� �,<Z�ܤ$%�D@�E}��O���U��L�+a�ut� �X�'W���k��;�XJx�a�Ӻ��?\#��p�f�Tm:�������fߓ� g��7|���q��OW=Mݔl�^/�T��ZfD��a.V; ��hVN�6l��ߕ�@%V�?�x\��H7��s�}�U�������:P3���/�2a��R|q�F�5�;�y6_[�� +<4�hn������$mIV9_�J����m�6:�5��>t��y/x1� �N���y:�RSU-6�9i۔M���d�?�S�-PN 7ӆn�L�O��="5�i�h~r�<n��7G��&y�����!of.���'���"z������[�R��ma���P+*�ށp�&�})��+k`�� y���~s��*�Ҙ��igy�{�C�Ix�q*�Br��4��;# �ӝ�ܹ���p":�����F6� ��RZD���B� {@Q�y�ﮪ��^���J�,�J�bc�5�M����#i`��V��Y�����K���YW}4������jű�����l~[�S�!MG�C���2@�'��i2E��Z�r�:�~��ҟ+�/�A14�q!P�M�f�S�]�]H�b����:������ �Q;��[��#� �܂�[w]�׆&-�x0������Bڡ��t��D�]�]�>�mͣ>I������0���n��w���-J*�-��Ws�e��iQ���B@��7�֑qtJ"�����f���='��+B1��A�>uf���v]e ��b7d,��%�����|�S.��6���� |F����0�-������Hm"�:.�'SB���+~R�e�W�1ެ��(v�c�U�]'|X����!1& ��6�՝���zC�B�Ȅ�F�sHE�>u�A��a� sD�kËt�R��)G/rV�r�����A��'�I��~5V���+FƜ�z��Qr!��'�=;T��7�rݞ�~m8��c��8t��ĩ����hCl�%n����8�����H�蜬�2���1� �9���gYG� �-�o�'[q�L��/7�7�:�E�0�u���� `���-a�%����rJ�A&I��?���k���y"��a�`��C*���=���4�)�bEB�J��� ��o^�.�D�*�)R@�&%��=��dž.^�aGw,졠�%��(@��'��Ӄ��ٱ�_`�3�gX�� X������ �C�[DޞB�����h�2�f��Q�}cYi^�r5�hW��>��g��V9�<|���t'�o�c{w{���>Us�T�KK��}k;¼�Va���a�wp�0��F��2�:�KhEWg���HQxW#����i���������e�s;De���9���}�Xi{�v��Rx8������J�)�Z�($MJ�a3s/^YF��P�H{����-��+��������5%��ڝ�&d~�j��Ӱ�y�$|,�?Xdc��vLs��{c��eg��[����e��NM1��L�4��2� �]a�6�u_8����6��-��*�B˽�P9]���c� ����y����8���~�!=_5Ђ ��j��C{{���$�ٽ����RB.i���x���p��K�%."0����)mΖ�id�b��K.Zӷs��e�Wf�FO���Y�gw��s�͑�fR�Ol��C}Q}ʷܽ��G�6a{o?ƴ]�����>�"@G�|&�s��庰��(���Vt�-���K�����Ha]d�߬4#����q�i�:�|>�=Pu%Gi��G L����T�Z~�d#`ț�?<b���K���CTB��y�i*�PA��^ᡆ6rg�ql��&��W���n�l@ꁥ�Cv;I�w1s#���y��c �?E�pÂ���1_=ޮ�o���FEv,��ƍZj�&!��F�x/-�z��U�|��ԓ.���[�e�{�#�'��F���b�J�����QT��,��cR�������\R��y�A��O0B��T��3���x8&G�GN���}:��ШI$u�d�����A-��t!s��Z,F]u(��s��{U��!��C럱�*�'t���`]V�v�8���W�%�Q��@sm?�P����4\Ƈ��۶:�A]l2�E'��0 �/�X����
Static task
static1
General
-
Target
Fama_69.exe
-
Size
9.0MB
-
MD5
08021e625dc5576bb56ba9c81444bdca
-
SHA1
5cd9451b63a33ec9744a8b2484cbc8b3aebe6a9b
-
SHA256
660d3d1ee217ce067bb2dd624943cbd94ec6c047ff67b9963c772b9b47f6081b
-
SHA512
dd89bc93de4667025bf64f032485bda45d4ea30a7ef3614b1566839f5c642df3c7404bcbd70bc12f6c175c7c682861364d37e4af94f7e4b0b8d5f421e7feab3c
-
SSDEEP
196608:3KAskBj+iNAFFPe/bpv6vR0HjK+yRKLcALr/FbF:3KdoUFPMbx6Z0HjK+YC7LrZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fama_69.exe
Files
-
Fama_69.exe.exe windows:6 windows x64 arch:x64
77bc9686142052899c97d01e2b54c342
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleWindow
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMenu
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChain
ws2_32
recvfrom
shlwapi
PathFileExistsA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
NtRaiseHardError
urlmon
URLDownloadToFileA
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
Exports
Exports
Sections
.text Size: - Virtual size: 445KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.3w1 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.6n_ Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xkM Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ