[.�2B��A�����{�2_�a7���C�N�\�b�5��]M��$(�.�����ٳ��)��i'��"YW�' �?Fq�I��uU<<<(*̵�~�U�;ͪ��,���ژ9^��mp"F]��@ c���}�c�j�'8m�K�8�1��R�e_�5h�?'����D�� �E�P�p���O�-l�<�(������A��r�ً2]��qp�l8��jWn�NM�6�^9�����PY�[�3=gP�z����.���xQ(� j4��x��mW�>"|u�DT.������h):���x�t!�J΅���Q>����F�f�'ը�a3�4?l��ǮZV{_Sg��r���z�Tœk Y1��,�V��,��� tf�����ޑ��+�?�����D��;�0��I�H�f��\�i�"<��kn����ޠ]�:��l�<�5��A���,��彡�$��gTՋ6����߮�}�c����E�pKX��=���F�����`%ƘJalY��\-h`,#�o ��|~Y�V���{�(���H�Nq�W�_aH&�h�^�8)zx\�fF7<����_h��N�X+�o���Y���X����x��������ҁ�2��ˀ��1n��~s��l�oӻ���5H�m��5ԃM+����@H]�1� ����G�i��CB�uTᑷ�4 ?��.��AXQk�*-dNWNGNx-m��'�琂�ڒ l"d�䇇荸�L|�V:d��~�=.�н)T���wq�^x����\�nF��!5a?���7�CO]��#Fa�`)�'q����R����]�T)��K/��f���� PO�4�ʜ�2�Hꗇox)�x���CL�>'�7�y� Q?a�l��~�����>+%:^'=��4ۏQ�UY������˯ 1y���>�r�5��C~yJ�+�������8{�U��Ǎ�~O�Υv$ JDI����))k�k����ԁ+��h�/�Q�K����+ `� >��W����Lr%����R�n������3� �>���p��$���'���WI�A��'�'�g��Y洽�A� d34�M7""���C*� ������{�tϕ���$��Q;�s���<���d("�U�%�c������m�_,FDğ23�jM2��;1�V��ܙT�����J��>�����s���b^��[��ك�W�JGt>W�n ˪�2�Aro5��)� �WSQ*ޝ�Qn0S��"���r��P����-��ML���S��o}�ݤ�x�J���E ��M|��x��xS�͊8�w��fX��B-�Q'?�O���Χs�@\��?]ʞ/�Y�S�x��/�}@V�cFԚ��3 ��SeM�K���=Z_s0;��"_��.�^�& ����(tU�/D - �|�I�i��X�Y;x]Ak H�r��q�`��j�hN�ȧ7��1�k�7v��R�R�O�TX�&��%�I'������G8/ދ�������X�*M����AZ�H�V�m�ppf��M.�C��C]��2��dF�����v;�ӳ�sb��'.���0d��"��{%����د�A�s��&�1�� �����5�g�Z�#F����mW(Y.A�2kG�4�m*7�5�hb�Ts�)��4�<m�CI�hu�}.d݅� ���OK��z/�j d��Ľ�� &�%O�(���˚z���co"R/<+�Ї���0�D��g}�=h�"N��揇�͎���& ��@+�kue����롻��q��\[P��<[ǧ�TG6d;^�OP/���w�(:m���X��M�j-l�@~�x����b�e�'G��p����ve���[Z��k��-��n?�j�N�*�H�]4�����P.7���۰|A����/8n�� F���Uc����la��4�����l�F��o[w�z����D��P�q��{�>"QiH�-���ҳ����\d�xG'*�'��7*G��b�a�L�?K���Nw���(���3^�Q�$�!u��MH�qjZ+fSfv+ݝ3�n �3h3 ��~{*��6�`�ɿ��qۯ�İaik"d˴�enM�}����<���A���96ʡp������d��juϘ��[�8V �1��w��W#Q|`*��a���nt���[)��#��q�y���.A�%`�kD9��hq�ث�- `Ǔ�L� �������4w�&��4 �ĵ�e����ˏ���A�w��kZ��g�\jY�@�H)�'>c^���AF'H�z}�K4���/V��%Z!��O�ghjR2N�>W ��� v��� :����+tC�[:��gx����_�h2tg���l;�p�*<K����EMC��[hDv`w�\��7�y�lX�����xf?F��N�r���9^��~ߓ:�Oó.�U)P�, �D�h9�*17�$���D)+y��+�������J"�Y�QxJ���@��;��Z�q��ʇN�zE�D����y&Q�]a|t���B��4u���-�%?���� )F�Ki�Z�}�8��e�pAs�����'C�~�"��!���L^��A��,a�F(HU��q�9��4�]x���َ��Ԧ�H�<ࡀ@u��P�D�躻#�J�I^�$d�C�uHմm�E�s_w����=J�A��]#��*%8���E"��#���NпH�7���>&7l ��-C+���hM���H!Z�����w4X�i�Lr�8�r!1�C&�v���3>pPCw�������4�ku����a���U���cz�������T��E�1���uI#ѝ�U��T�t�b�ɥ��~����Y�]J<m�� ���-'�Sk�}F�V0�a0���>P8{�Kx�#��SB���BY�1C)��B���U����R& 6�u ��`�8�&4W�����Z;7N�>ϦxKQ�H�)F�� �UZG�al��<�t�c�U�(�NbCF 6@o,1N�!��V^ͩ#/y��k��j˰I?A��'%�q�#�nj�сɕ�Z!'M�&�DC�{%����.�c`) �O��� ����x���G��+2�
Static task
static1
Behavioral task
behavioral1
Sample
ETH Chair.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ETH Chair.exe
Resource
win10v2004-20240709-en
General
-
Target
ETH Chair.exe
-
Size
5.6MB
-
MD5
730af932e4405a61de2705fcee6b8fd3
-
SHA1
0dda55bb0c044ebd517ea3cfc2a4de344aa6763f
-
SHA256
dde5f4ac3c81c3a7fd57c5321c20b85ed8928c8bea6688e70ed425aeabc319c2
-
SHA512
5adc75b1f34208f4f6092bccbe0a79df0c07d361b42cb199c4ff13836f49946e2914e2fcbd3aaf705354f4c3cea332181bf3daa4eae51f7d9cdcec2848f34e24
-
SSDEEP
98304:qep3yhqKiHnqTciCLAQw1e3JLBi36n1CC0lNGcflmX7s3HmG140L:J3yhvcRXw187poC0l/fILs54
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ETH Chair.exe
Files
-
ETH Chair.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ