�Š����- �E;�k"�m�k~ʐD6�F�s�� �M 'ۋ�0�×��4\� F{�F���攁WE&b����~]�l��*]#�����u�cCW����XC�a���j"7�Q2C�!�wrN%�ӆ���P&Kl�`ec/�M䮉��u�&O�^VLPR��D�\'<��L�l[cD˘V�]����>?G�ͣ� �P ��S^Z�T!���;��C��i&�C��w�hQv� �W�M���}->CZ���r0�5k#��Ȟ���ׁ+��� �;��1/�ʼn�k˚�H����diI�3�FJg+�w4Nlv���\5q���6Aw���X�Z�[�6^_��� E)ԡ���p\rce��T���H`�`HM�x� ���Ήv*�JnX��������Gt�P��E Ex腇�*W����� �j�;���^N�@ ��!u^/���6�MGB6���m����U��p-��ȠH�*�������������!a^�������`S (�N+ �����ƛh���[�`���=�Gp�>�4Xfh¦�8������KC�+�;P�[��ĺ��C_�F�$��������fXB��O��9�TZj��B�g��-Qyn03�e�(�X2�|H@7#����a9l��Eʐ�*��үD�����.�d�"3M3R@v*�*�}h�f�n��`{�H��_t������}�训����4�YND�1������GԪ���>�Q%ϕ�N8FU������X�����p��`2���8i��r�P�g>���ʳ��EB�c3��RH�V �x��/;����?���?��8�N׆S�o�DHh>�ϋ�;-o����^��cPN���p���QF�\�E���������� ;��}�%1:�9QWi�z!�?�-&^[���C�LK'��1�<]<���`��7v�Y���c*��j��mT�l��N��u%�R��ơ&gR|-��f���t�g��Yi��03�����s�A�D��5?��~��no�O9&�n�z`��^�2wiO��@f��� 0��_�۞��AOlz.H����8����Ӫ�wX���A�I��E��k;嗶2�2�l��c̶T;��̣���O!��-���C9�P���zu��QӐ=V���c��4x�m\ҝ1T�&(Hj�E�MR'ԍ��;���P�iP�����v�н������AB�O5�pVPSI��u����)�3= �������^��y�@Pa�tsI�7e���N/?�h\�n S���"��ʭA�-��rb��N�x�?���"Ն?e��aʘ8�g:p�Hx7�T� ��CPxzd�hXġD/)ͨ��sW���J~�E�l�r�Drk !��T�e��������<p��Tc6�����bU�4�������qՒ�G}�~ �H� �+A�z�-2�4���E :�=fw�X/��Q�X��!{�����.E<>d��qǹ~�(đ%�uv@o�"3�"ħY52����]�ʯf��mGl��/��,��%��m����G?��ք/�6���e*_�����`�g<�mA��HΚ�d��Od�7#\���\��#cִ+�AHgV���?f����C�Mv:��&��ft�k��._)�ϸ<J��5��_�I3DJQ��j�Ca�%���9�&G���m�z��K� c[�Az��{��gش!��7iGS�gA&�{�;�<��M��ͳi곓$�j����)����ȝ��K ~�8T#W��)���c��Y��Q�$l��_��4��� /��@�BF3Fw�o� ��^��#���:WÌ�����cQ��߬�*��x;[��p�8Ϝ�o���}���G����#nr�*)�'�W�{�q����̩(�N��髊�#Cο����%D��z������1��~�����Tz��"�)�d +�f��a:�������Q��Сn �J��|��}E)�|�=��5��T �86����A�"�*����8���b��T�{D^�� ��n��� ��-�͔Ө���<g6�^�� g�c@Ŗ"�#W(��]l�7T�cp*r�ټ��he.{"�gHg,.���:J������s�v��,�X�ι�J�k��ީ���&��Z�"h�@M[����lX��'�+����7��Q����P�i?Ω��fO�e����!�� s]tlM����Q�Ǒ�4����ڻ �����q5�j�>�>ڍ�R�0c� .$5�����T�L��.9U&���0����\\�\�Uۑ"��ʸb=�4}�v�A����˯�q�e��� Ӝ���O1�����+���.�p2�e^hd�|�(����������~ Dg�$]2����'��QJ�;�[P ��K8Y�-t��o5�x盡�Jr�MM�0]�؟�����?q�����ʠs����m!y8����Moo�,m�4��Ji�����M��~��sy�w���h��A�GB_D'O�ABt�F!��Ԙ��Z{��0a?��(�'�P5�,OJj`'��e��hSM|���-���7`=F?j�y�M�)�80���>��$�x~��Pj�G�5����8:z� ϻe�6�FZ��/��~n��)���]R)LH��l�佊�@k��Ӓ���Ӹ��/H��C�*1�9���s�7�l�h�2�ɦ}A�9-�(�e�e;gb�3��vGz&����n��{��O�|7r,-����j�Q �6Y�XaG~����;�q�Pp�G�a�3o�cP��/+�n�pV�}r�;�Ph��S<�14�<��u�0�'��Cʹ6����C'�W�ۍ�b�Y������M����lI^�/����O1�����{��eҶ��V������8ո��Ȏ�n�=�k^A��#�S�l��ZU�F�O��̒���Z74�2�S[[1�&��< ҵ�������s�۾��g�ΊT�a<�4�D�F�絏���"���@@�Y#��H2_t�+|$�v�ד��|1Y�)?\�G��YgfT\�5Kj!@8{<49�L��)�8�൩��՞X�g���,��$��g� �T���ȳ:�t �Ad�芵h�
Static task
static1
General
-
Target
0RMQNB2 (1).exe
-
Size
14.6MB
-
MD5
1ca780d2a4fcc70391c11504ab84bda6
-
SHA1
b0f314f90aaaaf9ee83be5fee30671c36139fdd0
-
SHA256
a9cefc91741756bdea1e1dfd5303f5e6a9bac50daac126b4cfeba38940205bf4
-
SHA512
b2731e4517590c3a8828ad4b65595968c6bae1cc9e708f0c63d258d28ea532ed08ccc67f200ddf8674a61bdf11c000f3729ef0d88137c3485b4f50796b08cb6b
-
SSDEEP
196608:wrAYIO116mDQy/GsX88z87Su8m4U7jVTYPZkhU5cjTtPT100wK6L+G58pB/:aAYIOOgQy/GsM8z8+up4EUR0UmPut8B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0RMQNB2 (1).exe
Files
-
0RMQNB2 (1).exe.exe windows:6 windows x64 arch:x64
d910780e43eb6473c6ca334d8a16a8af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 805KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 939KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug_g Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 741KB
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 14.6MB - Virtual size: 14.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ