�~� qT��jMO�zj%�Q[����=�ڄ�\5��SOF�����4X���8�T��A�M,����8X��L�F���̷� ��"]�^u�A���{�Ҝ:��0��%������.��%ԱlM2}6�m���P�V�GӻG\�h�I^��ٶi��h�[OKΞ#v�u3X����p�1��H�����V/�@,�֦�SO�T:�O�`T�?��^�f�+�g[(T/n�=�IΒ��^ i�Ф�'϶�mk{���RSF\�}t��_����&����*�� r���ؼ��߸?&�� ��3���ܚ��*����rQ#'St���C��m ��Q���*�דΘ�(K�8�A#/�.)&�d���R!݅1�;��=� ����Q;��2�Q[s~RgU��S@ݦB> ��0�^�\��A^V��g˵�g>�2Y��S)o4��ïg��>�?��2�:eM8���*���+��&T��k�%x�@`v�����b.�����Yf��}�� 1~.g��@~�y��l�q�_X�6�iz�� şއ>�$� �${IW�_���"�F�@�w=7ƿ���XENvD����먙�~f��b"_9*�*����a�r�� �y�u%)�>�-� ��YQ�G����9U�i��ڂ�0�����W������{�2jR��պ��!<���X��~�ѿJ3��D�=6/��W���^IVH��L�� y��پ��/�f�0e}�1�h܆�|�V�P�EY��[��Y���Ԕ��p�����I��g��Lώ�f���t��j�Ex[���U@5�:Ƒ���Z�W�E?� r��$c<��6�F= ���w�G8�$1�|ߓ[��q£}K���Z3�{�����|��ɉo]�R��] qdN7��L#] k�ޑc9~�?)6���N���,<��� �jE�͵^�ޒ� ���g�tsb�� ����ϰ3-0�_� x�a�E��)JGX��i�k���Dž>qrK��\e�N���J˼��c�l�%@-0�U�%c-�g����:Z��62���\�䌆��!�ӰK�P�<U��ʕ��绦�ʫ�D�A�~]����r͠�B�ʦD]u(�!~��0� �Hҁ��F��[���Y#rͲـ��;6WK�D20Z�Zď��PdS����0�;a��r�\R�������u�(R��q��s��&��n�+2�M*Mw@�ϯll#��Ĝ�P��J��薇A�n����sb�S�7t����g��R+i�Hy}�ӄ�$c����Z� Jub����H#�]&9,���(H܌�R�n��w:v@#�j�cT��L��GS#v��;˾�p�����3��a�Í��;pN���ᖏ0pȷ�ɚ����������Zen$�o'niQh�=��S��gv{$�m �j�|����Z��Z�H�����,�\Eߢ�g�*���I����(5z��� 88�ao�e���J@���`)r�N^��c�~(�jJ�d������d&7M�.��9��V���-)�O���$�Uhg�ǰi:���4z��FG�DW�D1�A��������oPH���v�]�o���E���1L�{���u h�<it���]�#lB#$��6�VO�����&�͵���v���S�X+���Jn��8K���j��&� G�=\�� N��l:=|���<D�Z�`-@�i���l�� sC�0@R��(�=�ls�hp7 �G�qH��w�.�ѻq�Q��q>C�����5�o������DVYs�w�u�}���ذ�lP���N�=k�.�ן.���/�z����I��z�.��?~� �����j��/�SL�v��� ��gz�~C!�=��#�#C��vAj ���Y��3]�{6�>�ۘ�Ц��hEV��3a�oYc���D���9t2�������36|P���d^K=�;�7�ҬYb���^��j�&��X��ȹGӳx�i7U�ck\熤l�I�G%F&�s�������,���-Ax�m�S����[�t��f�0t��xh�����exU���&�M���'�䶔i�rW �����=�h��}0�9Œ2t|!�>(/)3��b��g5�<Q��G+����V�W�xw���h�c�m,�^����%��D#쏻����ҿ���=#�6�N�n`�C��&j�5v "��;��\���50�c�7}��*T�Mt�}^:=�'��1~_ ���";3;���[��4 ���CQ����R�&T�s{�A���&!�^�K�>~S顋�/�qo�D���z֛$%�^ �O#��l�t�?с�ȹ�K��R+t�a�p�Qj�,��&�Xu+ʲֆC�]``n� ���oU���׀_>i,�mQ��нm��w�_0������E�~��,8�6k�{�+5��������5���0�m�T�A9�uC6�/C��VȬ?� jp8��1� c��B����i�$�>1�kn����C��"��Ѵ]��A��(G��!��5X o����^��VC$`?�0�%�>2H�w�m��.O�f�H-6W��;}93��(B��Q���jJ���O�^t��3N��A%�#�NKV� �,O!�ހ���\28�<f8�; ����e ���������4�3E�b1o��4jmǘ�7*���:*�n�ZOy ��P�Ga�0Wć��r�痺�ԑq�(Y �qn��zM���rL2���uO�\A���d�6e씣d�k��>U�p: Bⓘ��A�+{D����e,슃���� :r�Cj@G�6#��ׁ��F�_���?؈乸�j�;��v� a��(�t�/6)^Z{��[�ttw��Qm��h֮sȀ*����.�b1������{�uk��s�t�Jǯz�4E�ݱ�2��7�G��m��h���5%|QI�v�ۛ�>~�-��>�H�g��{$u�{�m�O}�1�����)(�1��ٖ�� ���o�^�H����s1��Mȟ/Hnoїf�H��)�@o��h}����%���'(�n�ObG 5~ �u-���"Wpn�𗨁?"�z���t�56���+� ���`bv��t��;G��P�y
Static task
static1
General
-
Target
95e3c8ca5085ec31ab14.exe
-
Size
8.2MB
-
MD5
35baa4d15d16cdb950c050d24dfdaa75
-
SHA1
99c3747463c88446d3b7682698cd87eb2c9ec582
-
SHA256
2306ff587c925dfec3de78f53885d62889af4e5f2e7d15437b02882870b3f085
-
SHA512
d7ba7df7a10b9c2da314172b0f4bd6ab5bb24ca77aa0bcc6a9d5ad173c24db2031e6b0115a777f82c5938e2e90b0642abe4ad894f4451ae761f84c1aaf7dcc1e
-
SSDEEP
196608:+xMJUsoZxRGUGHuAvVch41AoDdVkSkeOH3RL317XC41:FJUHRxwpu/KdeSaB7V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95e3c8ca5085ec31ab14.exe
Files
-
95e3c8ca5085ec31ab14.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wXb Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.9(V Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n,u Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ