��!����zK��\���HQ���por�w����s�@b� �ߟr�W[ZxE���I�/zZ��f�sy%x������s��u��BO��Fp��J���rN�O?S�;/�|����O9E�ɹ�������?:L��k��ܛ4�K�x������CJ�A���F|��.�qO�o.e�+��%:Ξ�]X2`~�}�i[2Mf�3\80�:�����Od���PguN{����4]2-���o�b�������]'3��Y��q�Y��{�Ͻ�f1�������@�����g\�sA#ql���}l�K���������K����}^��r~�X��^C19�oT9���y��k3(c�e�������������Z�v���&�-���4݀2��v�Q��4ё���gAL����V{�N֍�9��N6b�������SY�Đ<�ցmT�h9|M)�zz�e�}�xud�p���M���DВߨ���il���I�������/5|�E�i|F?�̓o�W��f��] �䬧 �ضo����1O�%��o �,��]g��n�A��xB~��a~�E x�W�p�����w��Ď+�}c����U�Hig\6�X��e���r��V�jBP�h>�X\�ַ�I�+�̉��e=��h�\�+��p9!�2�E�m��1\�7�ݥL����X�E�ٻ��c�+5��R8X8���2 �b�a����Ԙ.N�(�!V��$�i.��")TK���luE�Go$���Y��� #�BH��a5���ێB��`U�F�/oOԉ�=?�iV���Hf[��\��n�-�X'�n3��эk���EVk��H�iSl�2}0�9�sa���,H�8*���.����_j2Ikm!:��#f��IY���S�M�!{��i6������M�j��Z���h�c=��!�@��L��/�_ Gb/s_T˃�YR7�K�Ú���Է���瞚(���f/�*%��,�hߕ'�U%���)[>���x(�Pe������P?�z��5*֙��w�5�UV��(;�E��=��I��mcd1�U�������a/L&�Q��_�z������J3�����Xh^��!�ܴ�ũ�������H��" �ct�e�������1����ڃ��ߓ�``�E�>�Q��S����̅�5 �I��O�(��2�|t�C��� ܊�<��W���P��s��Hkx[�O����T�x;Q@��ƛ��X��m�c4�o^q�q~���}"��v���� �5��w����� �<,Q��֩x��hќ��L�5w?��r��%�N���+d� ��[Ip3܀��AN� ��FPTA1� ��"�s�O\ӎw>���.���W�Th����q*�2���v�| й훢���s|���}�v���{���7��h�����Β�h�t��w�;���0�*;�:�~��U4�8�`�ӘCC2����(k�9��k6 �f�6�����۱��6����*�D�T�����J�(��DN��:W�?�Pb���bS^7�2����ET������;C�������X���5��I��'�M�6���B���lB���d�k�b��tT��,�(��� �yo�E*������~z;0����SD59}wؐ%�ٜ�'�q2V�]�'��5P����(�N^v�8EÎ^:���Rt��/�\�`��N��C�&``����V����A���W��)��1�{됶%��F��YPm��x\�?��3�|�đ��Jd_D:%��%% O�o�o%k�)�<��N�d��V"�5IR�|!����ܿ��ȟ�G�������2�����.�dڵ��L./M�� ��S3��k'Lo�|������o � �t�P�����hQ#:R{�����by�C?M��i�I�i� P�҅|D'l���ŋ����E�ij�)T��K�l�ȩ;��ŝ�%B0v ���^��:���7�����RE�c��-�)�me�Z�k~֓gz�N�4�t� ~6����d���JI� r�$�ޖ!9)S���\Qu�ԡ�C5�0�� Z���������k�1�f�r���C<���`��+�Qzv�$��X��u����� �R;�Cy<�HdD�������3 �'�&��CI(0�E�m��<P�y��ӂc�X�HtY/�xM}�S�,��4W�[���R��s��V��8%n�'o�с(�v9�l|W�$,=#�Tub�)�� �;tS|Zxf>4����@*��M.����`Y��ށ�U>� w�r��c�L��өȒJnA������NxT��2�@j��Q�7������,vk��5�8����cȏ�V�y�<@b2*+E+�T�#�^��s-���d��z���WY�ߧ;���bE��a��bo�#}���jh�5ܹ��:gJј�u���Y�.�Y_t����� ���#����7�q��a�z<�sbb�".�)�FƄ�d �O�TkQ(��/��t��T(l�4���"��'��Vz�h'A;X���G��(�U 5 �-ȡ�3Gz��+r9g��#k��5Q��|a����(q4�B�ǢS�߯O��2P�E���5�����Q���;��Jlq���b�Ό�T!��OyK+��=MW�e�O�DԜ��'���A<�k��C]n�5�d9�;����XCv@�?�x�!���Z4T���&� ܗ��P���s��ŝy�9<B��������s�.p&z�/x�>[����P�ػ�[�q�ſ���&�E+��T�|,o�%?s���}sZ�bm�+����>ǃ�Ӑ��WN�Fͳ�ۣ�UC�90��{4�s���V��;�2�\��z��Hiu*FB��^��Gw�I���LV��n֗kd� ������E��^��b�`-bgº B�Rr�쿪Ԉ��1��,�g�R�2�������&���5��t]�3��N�L�`Eg��+������C��%vw��j?Z���?�u,H�(XlP-�Y3'W<�wp��%�4��u��,����5^���7@��v� x����1l�R�l���]�1��dlL��șa3?�ZA���I
Static task
static1
Behavioral task
behavioral1
Sample
qubbABAi.exe
Resource
win10-20240404-en
General
-
Target
qubbABAi.exe
-
Size
7.3MB
-
MD5
b60b98d815a1a5a1f64b3f2f4a552a8c
-
SHA1
e598c23cdbfbb12142ee8389ca53da90a1e0f6c2
-
SHA256
1038a052cbed6833374e7b31fac6c1c1d22d23f823ff0611ea05216e031cce6b
-
SHA512
2e94607f9324075a9bdc6cb61efdc37ee703a3513cc36dc81bc492d8589dbea5f16c384e65ab5a96fdbadb091c94c7345f1a1e2acce384d3345c4b36fb65060c
-
SSDEEP
98304:ulviMszcCC4EN8jxauiJwMfKx0wwlLv9b9s7Ag2PhKWzY7vRyuP3HbuAqsAokz1X:s/sz1C4DjARsAlz9pPZlYbQWLGsAbE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qubbABAi.exe
Files
-
qubbABAi.exe.exe windows:6 windows x86 arch:x86
bc0dacce3015b5d0739eab02610e53a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
ws2_32
htons
wldap32
ord143
normaliz
IdnToAscii
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UpdateWindow
CharUpperBuffW
gdi32
RemoveFontMemResourceEx
advapi32
RegOpenKeyA
libcrypto-3
ERR_print_errors_fp
libssl-3
SSL_connect
wininet
InternetReadFile
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
crypt32
CertGetCertificateChain
Exports
Exports
Sections
.text Size: - Virtual size: 794KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 257KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.&cZ Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.D+` Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.q1/ Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ