XuLN^�L����ھ_=�T�1�G�ʞ���l�{� �\&��8����`�����a�rI<ek�X\�`nĿ��97�����z���u�#��C��)�*�7Ȇ=��u����*ӍKV��]���(o�����|���Z�����Nbz�$�|E������gWG����l�2)�4����n�hi��=��ߊ�M|�b)G�4̠]-�S8u6+�z��o� �*?����+������N���s���r���+A,�J�6��:9M87�VM�z]١N�f�jM3�i��F���0�y�l���S��yteRe���)9��0=lw����Ѥt��ÄC��U�j�͂�%2O�99Y�"�ՎP�]$p�ɟ] �R_��u �+9[D�����Sȥ�T,�k�E�K,\�V�JE� ��"�hC� $�������'SV�w �T����������m$� �iV��ׁ�|���o��+�I�����N�%"֪1�岦æ-89���,�>~�O�aR����W$(iʹ��1�#��riMcǝ�)ګ�5s�Ea��1MB�FJ�f5 ��NV/|o�L����鹍̘��\��0M�o�H����W͇�)�f���Gx����tM,q�]��:O",�������� ��)<�<�2�f*�ql�$Xh��j�������n���D?�>w`0 2�&�8��1[^��*����b�"c����}�E�d������-X'��v�%Ρ�>T6am�wz;c"����Eģ!(�%���>�4A&ގj�+ɰI dO���ب��V�u����-��M�=C�I/@W�CJs��n˦��\:���TҢd �a�@�`i��*�s�K�j�5!#a��=<ub0rQ������KBZ�Z�1��˺��h7�^Kj۫'`+C�$2s�4拶��M�g\J�!T'N���Z����ڵ�m'���3�?/ˉ�}O��m 4�b��/0!^�-ɱ�7Bi�����-��W�xٗ��HU`ػ���.]�c�q��ʚ,m*���e����a �C�B+X-"��x��,�yӘȄ��N���d��Y����V�K���֣)"p������Ɗ����l>�zT��V�1����eR!0)��~,ֻ��]OyD��<ä�Zҡ�vfUH�kbI��${/�X*C�aއ'����'��b$TW���2���ެ8���0��L�cՠ�� l�$�zns����9/&`T�Q2��ьc�Dqϊ�Y�`�;������a9�t��\f�N���.,7�*�Y�).k�Nd�<��;ohd�C���B��M���\ߘ}�!�W&k�c�������7aAރʕE����K��X� F�/e�%(�zm|��P@pKa'���.�ix�������&����r���FS�����Dm}`�����1"[S�li0W G84������;Nk퇋�o\C+qsCR�E�xL����G4}R�?���DjCu sa��]]�Z[d���4�Hϕ������ߌ{,\]+{�`Ŵ#��i�r��k�[n���Ay���Z�%xt�Lv������t<}�����Υ�M�.��G�'�]i�'���$��=K8)��x���B���.���RE6|�v�A/5��zց�F������8�H>0sWkSL��*x����ЩF�`Y+���@gGD宯2�:x��QD����'(S:���f��w����X<�S1)ML)`�l��.��X�P��E����� �0 ?OgN�o�����u���F8+�|�qNy���d�a-)� ��{:�E]����j�LS�B�%f�|�[�f/(Ѻ�W�t���������h XqS�7�������֍/�p�D�ǽY8-�jov��0g�l���A�*yU89���w����h�hDP�F>����^Xg]�|/�U��� �؛$�o�us;q��uq5<�g�IJ�<p*�|rT�l3y��(xR.�Z�����=vZ����l��u���b��i�6J�k��y�S¥$����NfP��p���[a���VP#�I�r��1g!1��Z��.� �N+A��'�(� ���A��̏��9X���N=ŚRAOmg�l]-6?C~�����?]�JQZ%�l�@���4!s�V�&ϩ �u=|>���F>G �q/�K>����)��u����ϻ�9�����k��o�v�D-����~W=�����z�G~��0�-{Ѣ��\1� ���[���� �-��u��\8�&�A�SK�&��f���A&�yYf|��:�����O &�3e�ƞ Cx�b K*��a\����mX���|���Nn/���v�؏����@r��p0���� 2&`�JB-pY~A:S�*t����s��t>՚/X�/&J���3i�M��F�R[�$F/e�h+�e�P19Ѥ���(JU�x��rf�KU!j�<oI��j[��2�h�L�ҳ�eU�F�_�:s��a��N2����c�0��caAxr}Sa��|d{��i���\�&0I�rR�בH�t�R�h�{�cM4j4������a���U՟-�<{�+U�RH�g߇���녡�+Pb�bwj}�)6�$̉I�5�]\��Y ��x��X��F�*�@o����.&o3��>�fH�ދ`&MY0�-��am�>�1��#NG�=p��}�b��e����t�?N����bL��`��ZƧۣ�E�Y�6±����^��"' �ݪ5���I��*vx���5x��t�#�p%���|�56�"DslRM8��������&�v���2���͊b|�A%�3w�����謢��ѿ��T�TX���˱ALO$[ѡ���P�b��\9ya�f�q.����L>�lp�!�m2�K�Lӣ�eH��Rgڃ� �`V+¸�*�uw���x�+��背�}���w܀Ko�u�[�m�V��-B�Xe����:�mY[X��������$�����[b�ؿ��1�����}�� ��J�u��YW2�(���)OJ1SV �}��?� �9�s�g�yH����8ѵ[n B�'j25*b'*�,3�kB���:�xr�
Static task
static1
General
-
Target
33ad727a90aaa6672a41.exe
-
Size
8.2MB
-
MD5
00c772954d9668628f6c279612870d62
-
SHA1
ff2307760f8f8065fd845c42e1e7b1dcee5ab1ff
-
SHA256
655a0a383600bd6e8fe07cf004e958423f7274aa29ea964a9ca492a1fcb95f15
-
SHA512
58ac789e4f9d3647a1806752a666f82ddb1533a00a38c5022093360d07be469bec2e7da052915ce3e0771823f76f5ffc6f788af123ffe9c908d966936d6c84d9
-
SSDEEP
196608:whGq/ipaBwXu1ZK0zvae2mdS+k463ov/gGNs3p/JUsyfXOXh:G/ip3T0TpJlk463DlJUjOR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 33ad727a90aaa6672a41.exe
Files
-
33ad727a90aaa6672a41.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.%YS Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.)3f Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Ey} Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ