@z;�l��jF2�>T��/�m>�8CO�bA�L[C%�hX ��):���e~U����:=�)�D�R�3�Q�}��7�j���@�&�.i�+���۠�Nӊ�F�Y�g�����m1��~'/�����Ɏ�dS�Ϭ��6���m�q�P���)I�z%`I�.QT�� {��AOm�������uA�� �?��Z�߷�����z�R�hkY�C�5��#�tH-Tz�f�C�]*��3�J�� �8��4O/�L<��1?!��3���(�Y���3�X�G�CB( �R�#cQ����Rʷb$�f�H¥2�y�Ov���=`��Z���05����x�(�iݮ Gkj��.�`��� "&C^� Wx&)���xr�(+��!.�Q/L*tq�M����A[�2�/¡$P)��E��L�����ܱ+6 ���8� &�c�����%�@��"�Y����砄�#P��4}1����`���]|v���^;�����#n�u�Rv�E/���l�d��j��X՝�O�W��t@�T���k�r|щP9���6}��8�ׇ�+^~���"�z��dF��;�I����7���}ޟ�P�h%��ϳ_-�c=��i.)�D�z��m���ğ۹�u��;`����A�;���Ɖ������l��wX�RT��aw}^#���R+����+��T?$�\��9)� ijH�M�������z�al�u�IT͵-��� �D�k sM3�5#�xچ��<Ah3�U(g�5=��;F?AiI �U��d�/w&U�An�~L����������(I�N-ؗc��[�ٹ������:r�\3����a�;H5�E4 �jtN�ѳO�b�+������Cp�>�?r�{�.#�2�b 8� �;�E����w��T& K���}��S��Yu��ϡy4S[���A������Р�N?B�e�LlXa���Iwx�~ %Z���h5��.xq'%�-~Jt*t�:��G�5����*xAV\a1b��$��ᛶ�#y�$y�G5�?�#�75�Hk��Q���u�22� �=W1��B�4=w/[m<�x�v�l/�� ��^��Y�+x%¦a�����3�7���������:0[�\�1���j9d�$����Z�o�x�����ܷ�_��.L�r�#���f�����"SQ,�X��%߁[�Ω>���%�%�YY�#Ϟ���W{� �@�Ij9e�92�>^�w���:'흐D�c�ާ!b2~�ѡ����;�i�g'���V�R���%o<����6���H%_�n���|#�Vn7cl���%�_o|z~ld:�^^}�hg}�4�3))� ���,���R��|�/<�<�0���9��'G�w@)9?�;�����1&<�t����K<��z읩��vx��� L̕z��-<�-w�n�`�F#�Tq���s�LO�����Ih��D��$�p� [�����)�6o�'H��{�Hm^�_�i����|�������6��6G�NV�2}oOa��A�w<�2N#��� ��3�Ķ�y,����q�ع�� ,#R�6�إ��֑j�\{���Eݤl�6�{���4ī��� ���?��c��eH}6*G�:�c��9=g���W���7\����uқ�6�;l���p��8��Jr�;��jQ�(6教���Jj����{t�<�\��'���(�\:&���JJ R�}Y�`���I7�����(����Y��?���2�3:�T�]�@n������~��`g����X�a`��5�C�"�)/0�H �|g}=��s��%%�8N!�E�%@���+�3bE�1DbX�O���j㒨,�&�����`;W�������[�迆`���+�5 ��`-[�Wj-^=�M̄�E����$E�4�E_V9��Ŕc��,$�h6\��Fu��&H��p�Khؼc�2E��2܂�FC"&*�*��߹�����ؚ+pk! 6����%���o��|ͷr�"����_�!�K�G�`�k�¡���$%��x8�����7>@�R:�{W�A����g�I��j�5��}�j{��ߋ7��I�����L)�\�f��o�4���uuFp�n�D���$����ɛ���n���S�py�|�����,�э��N�W��32:n8�@���4��}���ϗbx:�q�*Ԇ�ʐ�J><L_��L:���H]�ԙ#�;����:��صE�E4ǖ���q��kM�Q)�k�����U߈mظg��qR��>9���*�<��h$>�&��Ө\�����i��y�� ��B��C��ؽ{���eիJ r��T8-�*0��� y�E��ܱ�/�m�8��� N�Qѥ�7zmN���3�i��wa|�{��`�"��b+F8|2;�{�p>�"����Zk�I�rx�]��Z��L��T|��s�n�.�'a<�)��KpJJ�β ��+M#�qa������COX�x?Frf�-�ؑ�%� ��4b��M�Xܻ�#\��=L�C��5��f�e��j�1 �q"���DCJ\{��W3V�"h���ZZ���\�B =9��^H����AP�XM��,�����7�'�����*�w��� ��5������\&��i��4ZY�����Ņo�B1ї<�F����ō��d-���Gbo��{�2� ��0c�v"Y��[3�Ow*sI�"ɴ\��R����_˩����A��3 ��7�EhD���Ŧ�Ŕ��{��p�>2%QU��*Z<��8I|?�L���eJH�^4iq�Z��N���7�Ip��DU�}\��>z�+�"�R�� Rc����DA���Nk�yS{b������b���e$��J<,a/�|T�^~�� ���Ci��01wHM@���5s��݉�����ܾrdy���{EI�?����qh1,��(��t:�]n������O��]=za����@z�Y��%9v��Gw�������{la���i��bfk6,�7��!�%����&�M��U�c`�'p��[#I��vuȐ+���k��DJ���>G~4>ӱ*Q@^�Z9B��d1����RC��,?0����vd�CԞ�>{��؊\cB���!l'qx��tF�F��f��O�n�/EC#��\�ܡ�n/�?^- �#S���7�n���yS4.6�%f��w_Ya�pQp!()�6������r����K9�@��Cm����
Static task
static1
General
-
Target
Etabs_v22_kg_lavteam.exe
-
Size
4.7MB
-
MD5
011bc5f5e4332daa1020db279df859ef
-
SHA1
f67d7f770548cea6e2e2401d70c94a2ec0df028e
-
SHA256
c99b5ee7a610bce9dc22a662ab358e7cbdeb7180952f3e852087f81cdf63cbc9
-
SHA512
b6517bd76bee031e269bb7434c0b0a76afaf0b7659ade5d74157cd089d3f47a5c335e9214512b4dfac7c8268ed99222bce16d2376a54f250012d358ab241f47d
-
SSDEEP
98304:lB6MXwiQUZfDCFSjus/7yxwBFZxe2moNmJNMhWwlRUqVO5y9LqL:zXo0Udszx7PeVoYMWwlRUqscLq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Etabs_v22_kg_lavteam.exe
Files
-
Etabs_v22_kg_lavteam.exe.exe windows:6 windows x86 arch:x86
Password: www.aportesingecivil.com
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 348KB - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 182KB - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 14.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE