(�nj����[��iu E�O"�����t2��Bڽ��:�(�E��{����)�����g �(�aDDu���S*�TF}XOF4��^*:BC+���|�D>&2���v, �:��n辖��nB:A���AZ��' �:&�dQȏ��kK�Z.0t9��=,�ҹT�Sǧjfǡ�P~��tN��!m�d*�c�8[�R~0Ằ�+/�n���Zb�~Cݳ�'w\|��Ⱥ�1���PU��k8Sx��L=�ވRH�,�9]8?�j����������YsBI}I W�y�ɿ�s�(_Ml���_�y��u:���:�CQ�R���A�UX�������Z�"5��U�e\��BN1IA�Ʒ�Շ��4Ö�.�ָ������J�Xz �Pg e���f$�$ �o�g'!D1}��g�z;quSs��vz5O�x 6,,�,P�@�[x��3�V�o$�Ρ��V���^H^�B�u�#[�T����,��0;�f�"��E�L���[7����:�1DiF�U��+g�k��gD�)�q�X�\G�i/���\�koJ4" ��2I�$^_�ܽ�a����^�*���hw������.3*F%�sX��N74��wͨ��\���'� A3>���]*-�g�Qq�n�cr+UT�� � Dh�^a�y��EJ�T�3��#��oL�B�V#�%�2�F��Tym���&L����Z�]�_<t`���/' *'%�vn�Ν��������j}�o�W����CnJ�9���u�9�{(�5C-���V ��,Vk��>p2��*��7�����&q��9Jfy��ʎ�q$?"ju��+;Sd�K�X]tYGo1t��8���kX����`4�e2Tk�R��ގ��}�t}q�J�۫Ҽw�� �Tl���J�wb�M��q,I����Dһ�p������(�qm�z�q(\� 1��w�S>N��$�i���_�s2U;�~w�����и�h ���'��2����3z����Ku�Zc���λRD�ar'����z<�C?����e(ȁ�hT��:/�#b��}=+6a҉W����|� 5LW��>I����pZ�Tt4��p�����=�9�4����(����FqZ�Zg�`u��g�H�%钕��-��G��7}����ǡ��3��)"�!w��I��=�6��pF�?9�B��3���$v/�'M�c������s��`7 FWO��bB��C�N����g�UtɪDd5/�����t� ��]��Mߜ��g֥<��� �4�ت6����Z+s�3��f��]n��V�c|g�h>v[�B��`�\Ԫ%��\���f%k~��z�N�a�@\��������AP:x�W�f/d]ɬ��7u�8��OR� �V��1�P^U����0� �9�$'B�$����������Ig�:�m��5�?�l(�Swf#"�4�YQ��7rP�!+Ȱm��,ZI�ac?�*V bwzS �.�l|�e͠P��n@�^!��� +����Х澐m�f&���疕>����K[��r�ؒ,P�y �֝-Jv������;c��c�"����#��F�N�$�����D�Z�M�W7".�?���M�����$rD��b��8t��)S���օ~K'��>�/�=�s�>Fku��smlPk���j[nn��Z�(�P��m �������iѤJ{G!���w#�%��k�4��b2}%�¦`�f�#�n�����R��r�)_�@�L��\�] �(�oJei.��^F����>��C��c\i����Z�er�N�tF���13Z��$&�;�&���53��*�ڎx[h�}��\�RRy v_�I����[��:�a��d��_�4���H�u���Gm���_ g��(5�Y�{�S��5�q�~+��\�p]�<�})�f�dg������q����l>��kg�7�m֦�arI�1�'�hT>d�5��G���x>���:�1ە���B��+ 0;�4�o��7�\~+�d�Oy!9i�����-pjw��c�aZ@�c`�z.�/Ro��D��k>⌞�,h��4jݏ�Z���z4�Y�D����$����F��w4�š4cPsk�"s�_S��AoVY�D����=$m@Ɗ����z��s�õw� v��VD��"����O��&lKA �J���ŢQގ+���c��@s�sa�@82F@�Z���cov��n0|_�@mh����gS�G�5��c}�Z�Et �����gp����|h�!�T�aml�;�2r?��{p�*d�5�g�:>a�N��À#�:J���v]��&ȁ��DE!�W���ywɦ�{�zw#z��^�G����K�.��)w۴t��ii�iUB�Y|���n��������I�����@���e�kE!h��8`���� F�%�Y���B�Tխ�V��%d�! �T�dOޣ���M9��ԛ/i`iS�?�sW�^Ր��e��9H��Ɖ�3!>���#ZYH�\���%�W�c�-/@9y��L9V�; �5��:�?�c4���*��g�pf����i� �>� ��q��j��0U^U��-��#N�B�} s����қ�}f�-vL�_I�ΰG�]X䘢�A�&+�2�\�����^�?�"���)����q9Tr�� �i��[����`'`��3�D����S&}#���n��4%���\��{��5�?P�~�CБ�}��G :��LSt��t^M(Y�;8y����m�t�K\�FO������Q�7;XquVi���z���1��+�Pr�FP(����,JdIj��`�k���:����%� W����)��O�>^g��Ch�J������jQK�v���yn�?��8)�:��?1O�b��Njul�n��Nۗ�\F�Uy���D���4��VB���S�-V�Ŧ=6ʮ���k�H��Ӱ����o���h���ˇ��ڗ2��ƛ���K�8���������v����u�M�,��s�N�V��ؤ*)��e��$��~ |Z�@R��ye��T�~�`j%��Cv-Mǒs���LU%.�����vr�2e��>���^��`NN�QNB�`W~ߥ�g��Z���d���S*�3��j@� ��!r��?�/��U�k�A�_�Q�3�Fş�IO�I��@�U�� �^����U�ȗx�m<� �n�r]��lp��8���a�� ���p~�/r&����ۙ�'�gi��f�d1�!p�J��x`B3��Y0�B�B���@p/��:ǥ�����a7��~3�p�>��u���O7�ah�n��Б��Ӳ�Jru%=�ޯ�R3=�t/��B�v�N'�z%е��Q}a7l�k_p��=�b�Ca?n�װ`r���U�d�������á땪��:]wY,/��l�W���H���Y�ۄNk^MV��M�m�E��:���G��.���d�&$-�"O"ʏ�yP�V��4Ƞo�Equ��ڜ�]��c����ClYQ��J�O˭�F����:x˟0���╸�w����ꌆ{�U�j���Dhr��E�Q�E.�AL�y��Ԥ�
Static task
static1
General
-
Target
Tumiyuvad.exe
-
Size
7.3MB
-
MD5
fe02b6e348ae3accf1775aa32045b8a9
-
SHA1
6eb0bef73475ed98f1de2143bacdb015d6530d7e
-
SHA256
646b05913cc7364f3bb989f05d35b781838fa493c850ae773d13c22d45952a4a
-
SHA512
dde33475a2b0adae2d16dff0204c7d2fa9e1427dabd8f7fbe3d5b8207929231663970ca1d8a5db4309019fd1bb5d770a3d82b1ef319b3f45b98b1d45f7270c2c
-
SSDEEP
196608:EYdt2lrk8ev8Fn6XS8rHpTrBG9EGufy2He2Ca1Y:DWlVeun65NxPBM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Tumiyuvad.exe
Files
-
Tumiyuvad.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 2.9MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.7MB - Virtual size: 11.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE