#��[�3Lgڋ�gZ[�_`�'S\�i����^ ��jV����<$$ >��3 iҠ��N��Z�k����~�֞C��|��6S#�ܴKz{U�*G{ޤ���+��|:�Z�2�kc����\_n�s�Ԉ,�I��*15���A42�.� �I�on;�ꢔk�'3�8c�:���W�N��wB?��\��H�q��=%��&��w�rY~�\��@�!������;��Ƨ��B��a��$<8a�sQ�c��U�+� d��������Bf�5���ߞ���Q�kn������'��8P�v.�?����~��z3��>���*�4�#�y��x��9~Î����uSז����P�ιcR{lNQ@j��6��|��2���~Tq��,���T�R �<R�B����tޢ�*��({�y+X��@%�,��]�B�R4�B8]���\2 jp����_�+MU�urr�]�H�0�8�à�y{-�BU�9f�.�i�� �-�r��aK�mVM���s^6�!Q��jQ��O�0ڑe�`��3v%�R�:C��l�T\a7�9����8GT���?fjGCg�0���5#?BG���a��5,�����a��d�UjecGH��ZuT��B�T�&Y0��7��Me�ޣ)��6��N:A��.��e������3E 0��U��ڨ�c��>������9N�ܱa�v�+�)4��m1��.����KL��(������`t��/�M�(����DM�'B��sA|̿E�9�6�Y[�Q��k�Ϊ?�:�;��wm���^�R��"Ōg�k�O����ݢ���y��Ŭ*R����Q\V%5�Ւ�7�� +�F�����{!��� m�B��5b�����!z�(E���p��ΓP�2�#vS��Ѓ*�j2�(6ηA�}�O�-p���b@L���G{-W�x���gX�,k�J2�����j�"�|��'9&�����Q��F<"���:tVr�� ���Ƿz��o1a50�T ����,v�N*�G�W��d8��l8��e~md �dHĤ��X��%�'O_K���������쟀�8�����n���<�{e¯�������Sm7�����Ku��IC��yf��gPnx�^�E��)�!��g�2`������2;�$K�##h�9�op�|"�y���J|��>���_� ��� q�S��Ӝ���4ܮ٦��I���V�]A�ܯ$��� �kٰI`���q �ڸx����̦L*���s�Ia� ����( �N>�`��������C���Y`m���8�ޱx����+�b�ǻW���C\?4ý'-J�c�ӑN��03���̠�o��tʌ�Gء�b���z�m�kLau�m*�Q���d@R�Aa+�d�Qy�Ўڦ�ul�Q�/�������z�ꎦDA�͂�W_�b%O����/�\L[Y>� hdhٮt�u�zz��m�7E�R���*L sc��֙#�Hĺ�fg���������g$�i�9���^Ҍ*�W�'ӟiZ����vU�T�8�����cc5��X��,�\��v�#��(�`�g�p}a��fq���N��f��T[���1F��!w)����+�=���j�eg0�ọ$Y��f&<�'��%KK�\��R��/P���tA��rQ�,��S͟m[^��[X����TuJ�����T��"5��X-���'p�ib�����y`�p� S��߉ M*|D�0H���0����8������%�l ��"d9�2u0;��f��1 le���`��IA�)�4EB#~�w�_�B�Nh0Q��tkū�hFd$,�rZ�Y��ܧ��2�%k�}�P7.-xb�g�d�Gd>t4�kC�p��q�Ze�ڇ�=��I��`��HR'�����?>\|��X�&=���-���r���U�-ɕ:��dY�����t � ��d��@���;�^�z��4^���!�_o��-���0�h�i�"�.���6!�H�MW��'q�-|�h�G�sCo/f�n4����VQ%��m�NUD��8���fO}��? ������6������o�1(ɉ�Ѐ����.�H�ZI�?5�]�T^��T�[o�9J�$<�fF2P!K��2ٖ��O������S��b%Ј��Ğw���5ω����(�s���p�X�>���zHo-&[z�\����U�M<���ꗌ4�}��� �_|��R�۱������)���_���Ͽu1꽢��Uo��I�͝�y,z�R��wd���Ld�(I�qN���ȱ2��Z��[�m��H�K k9���<�ń*�E\kڜ9�s��H�U~��p��T�W����3lw�$T�A���*�P��;K�5��;ch�e�1����4��^R�5���`�py' �= �@�������s2�hg�p���t�� V;=�����;__W�99��dg����5��"F�!�ߝ>wI�=2����]��d� S� 6g����g��Dqr�V�2U4�#d�B 9�?�PY���X��k�à��tz�,ݕ(�����A���L.���[�I�D�� VW,r�|-�E��L-ס��2��L�� �wu��dzg�Jr@����,����<^'S?�͗��w�l���jԋ�� RV=��<���E-F(o:��<�f,��ܺb����</��c1�}�_���(�T�0� ww��O�U���:z �"7����\I;����x���=����d�xV�ِ��kӰ=�k��I�������+���zF�,+��""�R:���G���I�����x�`JV���I����ޔ����P t.Htނ��R�../����4������U�T�Q{���2�L�>�����A�q���������x����U8{�;�W��Fc����+W9+���"�5D�Z��:DO/}���Pp��3V���o��J�Uԧ���;�#��]�;�t�Z(nt9���#�s;i�E]��tMh��t����=%�뾥�v�/�P��F��6>��G3�1ު�dc���&h��Oqg�آF������b�|{f�(�B[o�>��N�j�_�b��2��o]�4ꃙ7�
Static task
static1
General
-
Target
modest-menu.exe
-
Size
7.6MB
-
MD5
ca026bdf12e2dd537672225b342c5708
-
SHA1
9aaa9956313f35194b71f9ec4fd1c21141abf49f
-
SHA256
b6b300d51ec33133e760f0e52cdf8505fa554d04f66245102daba0f255637224
-
SHA512
7560dc3c49d5d061eb7a96cbaf192838f3997b5f8640786916fe88dfdb96b1bee41a2b303358b7479b0e89fed9fc8cf3ba2443efefc09b42c69f1fa17df1c041
-
SSDEEP
196608:Cnbz2f3seCngkST7m/Kb8vov7y8C5MpRH:Cn32/sbgkUmI8EufWP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource modest-menu.exe
Files
-
modest-menu.exe.exe windows:6 windows x64 arch:x64
f7b0d035062873caab9b038c32b03be5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
GetWindowTextLengthW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
kernel32
CreateEventW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
DeleteObject
msvcp140
_Mtx_init_in_situ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-math-l1-1-0
_ldsign
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-string-l1-1-0
strnlen
ntdll
RtlLookupFunctionEntry
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 891KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ