�~� qT��jMO�zj%�Q[����=�ڄ�\5��SOF�����4X���8�T��A�M,����8X��L�F���̷� ��"]�^u�A���{�Ҝ:��0��%������.��%ԱlM2}6�m���P�V�GӻG\�h�I^��ٶi��h�[OKΞ#v�u3X����p�1��H�����V/�@,�֦�SO�T:�O�`T�?��^�f�+�g[(T/n�=�IΒ��^ i�Ф�'϶�mk{���RSF\�}t��_����&����*�� r���ؼ��߸?&�� ��3���ܚ��*����rQ#'St���C��m ��Q���*�דΘ�(K�8�A#/�.)&�d���R!݅1�;��=� ����Q;��2�Q[s~RgU��S@ݦB> ��0�^�\��A^V��g˵�g>�2Y��S)o4��ïg��>�?��2�:eM8���*���+��&T��k�%x�@`v�����b.�����Yf��}�� 1~.g��@~�y��l�q�_X�6�iz�� şއ>�$� �${IW�_���"�F�@�w=7ƿ���XENvD����먙�~f��b"_9*�*����a�r�� �y�u%)�>�-� ��YQ�G����9U�i��ڂ�0�����W������{�2jR��պ��!<���X��~�ѿJ3��D�=6/��W���^IVH��L�� y��پ��/�f�0e}�1�h܆�|�V�P�EY��[��Y���Ԕ��p�����I��g��Lώ�f���t��j�Ex[���U@5�:Ƒ���Z�W�E?� r��$c<��6�F= ���w�G8�$1�|ߓ[��q£}K���Z3�{�����|��ɉo]�R��] qdN7��L#] k�ޑc9~�?)6���N���,<��� �jE�͵^�ޒ� ���g�tsb�� ����ϰ3-0�_� x�a�E��)JGX��i�k���Dž>qrK��\e�N���J˼��c�l�%@-0�U�%c-�g����:Z��62���\�䌆��!�ӰK�P�<U��ʕ��绦�ʫ�D�A�~]����r͠�B�ʦD]u(�!~��0� �Hҁ��F��[���Y#rͲـ��;6WK�D20Z�Zď��PdS����0�;a��r�\R�������u�(R��q��s��&��n�+2�M*Mw@�ϯll#��Ĝ�P��J��薇A�n����sb�S�7t����g��R+i�Hy}�ӄ�$c����Z� Jub����H#�]&9,���(H܌�R�n��w:v@#�j�cT��L��GS#v��;˾�p�����3��a�Í��;pN���ᖏ0pȷ�ɚ����������Zen$�o'niQh�=��S��gv{$�m �j�|����Z��Z�H�����,�\Eߢ�g�*���I����(5z��� 88�ao�e���J@���`)r�N^��c�~(�jJ�d������d&7M�.��9��V���-)�O���$�Uhg�ǰi:���4z��FG�DW�D1�A��������oPH���v�]�o���E���1L�{���u h�<it���]�#lB#$��6�VO�����&�͵���v���S�X+���Jn��8K���j��&� G�=\�� N��l:=|���<D�Z�`-@�i���l�� sC�0@R��(�=�ls�hp7 �G�qH��w�.�ѻq�Q��q>C�����5�o������DVYs�w�u�}���ذ�lP���N�=k�.�ן.���/�z����I��z�.��?~� �����j��/�SL�v��� ��gz�~C!�=��#�#C��vAj ���Y��3]�{6�>�ۘ�Ц��hEV��3a�oYc���D���9t2�������36|P���d^K=�;�7�ҬYb���^��j�&��X��ȹGӳx�i7U�ck\熤l�I�G%F&�s�������,���-Ax�m�S����[�t��f�0t��xh�����exU���&�M���'�䶔i�rW �����=�h��}0�9Œ2t|!�>(/)3��b��g5�<Q��G+����V�W�xw���h�c�m,�^����%��D#쏻����ҿ���=#�6�N�n`�C��&j�5v "��;��\���50�c�7}��*T�Mt�}^:=�'��1~_ ���";3;���[��4 ���CQ����R�&T�s{�A���&!�^�K�>~S顋�/�qo�D���z֛$%�^ �O#��l�t�?с�ȹ�K��R+t�a�p�Qj�,��&�Xu+ʲֆC�]``n� ���oU���׀_>i,�mQ��нm��w�_0������E�~��,8�6k�{�+5��������5���0�m�T�A9�uC6�/C��VȬ?� jp8��1� c��B����i�$�>1�kn����C��"��Ѵ]��A��(G��!��5X o����^��VC$`?�0�%�>2H�w�m��.O�f�H-6W��;}93��(B��Q���jJ���O�^t��3N��A%�#�NKV� �,O!�ހ���\28�<f8�; ����e ���������4�3E�b1o��4jmǘ�7*���:*�n�ZOy ��P�Ga�0Wć��r�痺�ԑq�(Y �qn��zM���rL2���uO�\A���d�6e씣d�k��>U�p: Bⓘ��A�+{D����e,슃���� :r�Cj@G�6#��ׁ��F�_���?؈乸�j�;��v� a��(�t�/6)^Z{��[�ttw��Qm��h֮sȀ*����.�b1������{�uk��s�t�Jǯz�4E�ݱ�2��7�G��m��h���5%|QI�v�ۛ�>~�-��>�H�g��{$u�{�m�O}�1�����)(�1��ٖ�� ���o�^�H����s1��Mȟ/Hnoїf�H��)�@o��h}����%���'(�n�ObG 5~ �u-���"Wpn�𗨁?"�z���t�56���+� ���`bv��t��;G��P�y
Static task
static1
General
-
Target
95e3c8ca5085ec31ab14_dump.exe
-
Size
14.7MB
-
MD5
7d45404e254d919642ca2c277adc213c
-
SHA1
843535712b0c9f457accb6e5a6e229a3399bfebf
-
SHA256
50d99337f0669627138cb8acbdb14458759884b757a8d7e5f86addc3aef1fe4d
-
SHA512
46a7eda6fc497c30a2ebb256337183ad348231bd0ffc1889b91cf9348e1c859ee95a418376b6053c5ab1dde6eaca058346a7cd3a02accf255970180fff006d92
-
SSDEEP
393216:t56/WbobdBM1gpxJUHRxwpu/KdeSaB7V:t5gWbobFJUHRxZRzV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95e3c8ca5085ec31ab14_dump.exe
Files
-
95e3c8ca5085ec31ab14_dump.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: 1005KB - Virtual size: 1008KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 536KB - Virtual size: 536KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wXb Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.9(V Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n,u Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ