�P��e$&U�*J{<Z�kTy���}�ְ��f� �8ھ~�m}�Xl��r����k�m�����?�{��63n�S��X��0W�堇?����SpOOg����b����@j��lbFa�����mau�>��d�>��lj�c�i����Z#m�������/F����B���G@�H���^-d�1&wPk=�w�t����,�_yӕ�M����4�٥X�Fħ������SmI��71���Zn��Fq&代s�N�����p��M+�W^����f;��o�Oվ��$r<�>�ٖ�` ]� �3�F���l�[+T��6���鉃M�t�me���_u�>/X�����j�$�w����K��h�K_ɖEO����]Iw������1��l�����:��̫����ے��&,�,��[���w "M��|>�[��wz{H|k������?��!�c��>"�y�Dp . 83�M�;)�,��.���}k)��~V����6�[&�0�������M��������3r�x�88���z��w ]-�n���32 �P��C|yJ��ᢄS��W_�I�ݨ���w�C����\��J�b�X��~�ܤ%Y5��9i�S�y?�״0�1f��A %���=� ����-��<�d ��{d�z �4�(ؼS��$�N3R�hm��q��k�[�h�~�����'cx��5Q-�8=�� V�x�U�D�v��,�1tt����ư��f���c� �"�Aeg��g����؛=���?�d�Q���y2 �(�W�}��a������e����۾�-��̍W�ӛ��W��k�� pQ���@p(fH�����B�#)� ��4\�H��+�IJ=}މ��� n�̉@�!�EH�,�("o��U�sUo�Vk&?�����V�)s@`'+��1U�G�$�����GKZ�ڕ����1�����2~���k����-�U���(D����/�?� ��H���&� V����n^6 |�C4yC������vƳaZ�����08����]!��T���������� ��+U͟jP�"�C-�_I�}1�Z�q�����7H2!8;TT���^��AERF���\ͺ -z��^GR&a|�K�4��U�1���/�A,a��Ѳ}}���TR�a�8ڵB��e����;6Yr)&��9��܂��'�4���sM�@o&7��'Ʃ��S��%X.��v�8����5ȳ, >"��~4�ϣS��R��7m�;��Xۆ�%S2!s��"��B'�j�Xn��es�r*q_l�=�/�*[��3&����z��=J��^Fx�j���C�@�ڠ�.Wi�(^v�p�R��m��8���Hf2��y^� a�A�d�?'@ @S�����6,`3��}��GS-%��V&6r�I�?[��/A��Z�� �����Ģ\�x�W�l��êO�s����4�W+I܄LН1�ےV ��Hً�Q&���4 0���y2Z�.��w ��2�]Q���f(�ᖄ�iv�� 8����nru�㲃�{����>��m]�g��zPc�f\{8�۩��FKN� `��A!X�{��Bѭr�Q9O��تX +`���� ��4n��mÕ�u�Y��>%�.�H��?�RX"Yfp�3��P��#l�A��94Y�ͅ ����f�|��|T�괱(3��i�U.2�;!E�"NV06A�|a�P���˕�veЋ�";�rY��%�C�DN�������Q�ꍉ��a`����aH��P��?e��v)�l�qM|����N�Nq0:T%����fl5�Øݼ���\���#,L�b�D*J����ecP,n�kM�!]9�Lx���S~�{H�z��S��˸:�g��xZ�ef�c���8g�-�7U&n:]ў�Gg� �BE����j����3]��B0j-�������l6=<�5u*�1��t|4����Y<��V�Eo��IRď�����j����^ j�Nb[��2Um)/�YM�Hu%�6\l�F7�.�g368��ߋ'_ �'�l�9�������}�ѼkZr �����=� g�v��M|�<,ԭ~d�R�� ���'�0} Q,��?G �Lvs�n�!�G\R#D���!6pK����-�x3 ����[j�M*SC��U��̇��h�Ba�]��Qm�������+~� Tb1_"�A�EW�����T�@�����dL��*L�����Ƀ<b��W�ǎX�_`2H]t�e��5�ݙT?����^*�]"�*��ż2��kG��p�G���P�<c�����&Al���6�8h~j�\\}��.#���)Flf!l�����&�@XT�(���c{�GOO��[�;�0��l�d{��@k��Ar}���r���㥫��T/�n�O)%�^)�]���TO�h�U�m��WkJ?.d�ǫ�o�nBh�ne��z����yۿ���r�;JL����_��������S4B�`�Aɉ��,U_��[�111`��@�m�I�WK�To�Ϲٔ���W�j8Љ�7���e����a��cgd��(�=��i�D������Xq�H�w#��=#k��L���TԊ���� <�˭�~p���ߝ�2)�>���1F�{z�l�$��[Q�tK:���u��:Z�J�@/���(�4��]�͓���Y��� +LD$�>6�s`l�;p�cK���'����� t�g:��j}^�C\$L�:�h���?�3�Gg �@*̓8U��ٍMER�]�l��߈���2a���pF�p�4�V�.sb��.�� XTcH�L2[̴6���U�.�c���s6��k1r����n�t�?�T5{��t�-�gje��Z+td��"i�����)1�א2�n�oa��~gWdb�J�k���� �5�����5VCF�&f�d��Hc�*u$DćQ�E�£?7s�<�[6�)�Hؼ�eY�$텎�0�D�+�ǖ6K��G�J [���凝_N����A-=T�}�U{�A�R*��s�2(&�AE�R�� |T�ջ-1�[Tz��* ��fҜl��<�d��1f��ؓ��0���� �[�^#*� �z��D¥�f"~ ������Y���d�5���<V�bc��ێ����e��Y��-3��1��6�uȭ��콨�[w�LS���R�9��$?���B�v���WE�`~Vt���L8誂X<������=n|��P� �����bz�]iV���d�T�V��u&J�<�t�yUi����x�v:F-�h2�P��Nnc�H�T4|�ߊ>ί�F�Ζ8��|3q3dh֖|@�����x�n��*����)��c@h�O1N����������A��c�J�Z�Rن����D����e���&�t�8���ՅD �o��B|��#F�� 2<�=&]��k��X&�� I��E�݇����lE�iMJ<�"��������w�-��s��#�Bj]�P��N�%B�m���l��������պ���%ʇ�&�Q��xE�+���꜐IF]*EK�o~-�^���n�a�eh�)>[f��:3����Q�By��9e>���_�Kw�ʐ1R{���E7vR����،US�S�1j����Jz� ��`U��o�����L�g��r�
Static task
static1
Behavioral task
behavioral1
Sample
Discord Nitro Generator.exe
Resource
win7-20240903-en
General
-
Target
255b8e8d638df2dcde755d28b01169a687dcfdc197498dc89c466dd6bb795b34
-
Size
2.0MB
-
MD5
1c12f1a0b555a2c29dcec839d7e49c8f
-
SHA1
774149448d535d3a18d0cfb7df0cd2c0ea48c4c1
-
SHA256
255b8e8d638df2dcde755d28b01169a687dcfdc197498dc89c466dd6bb795b34
-
SHA512
f1a088792cf914ef376b004bfa73f73aab7c5a0ab94d2edff83f401840662fa67d36f3320b8153a59c165f59263838fcc9eed25b58e3749637791d4e4f9f177a
-
SSDEEP
49152:CzHL3mUTLYkqdcO6M9H6QMSfCe82Z+JfgCtdxb+h:CzHLhIOO6M9aQNCe8AKfgcxb+h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/Discord Nitro Generator.exe
Files
-
255b8e8d638df2dcde755d28b01169a687dcfdc197498dc89c466dd6bb795b34.zip
Password: infected
-
Discord Nitro Generator.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 42KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE