81088
Mislabeled PE hides an encrypted resource and executes a shell stageAuthenticode chain CN: New IT Limited
SHA-25607bca7969592fee91820cb5cda84dbd8bf665fb234d06286e6e079796b138074
Evidence
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000000010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯13 more rows
0x18fd060454800607564742072657475726e69`EH.`udt returni
0x18fe06e67270060636f707920636f6e737472ng'.`copy constr
0x18ff07563746f7220636c6f73757265270000uctor closure'..
0x1900060656820766563746f72207662617365`eh vector vbase
0x1901020636f6e7374727563746f7220697465 constructor ite
0x190207261746f722700006065682076656374rator'..`eh vect
0x190306f722064657374727563746f72206974or destructor it
0x19040657261746f7227006065682076656374erator'.`eh vect
0x190506f7220636f6e7374727563746f722069or constructor i
0x1906074657261746f72270000000060766972terator'....`vir
0x190707475616c20646973706c6163656d656etual displacemen
0x1908074206d617027000060766563746f7220t map'..`vector
0x19090766261736520636f6e7374727563746fvbase constructo
0x190a072206974657261746f72270060766563r iterator'.`vec
⋯3 more rows
0x190e06974657261746f722700000060736361iterator'...`sca
0x190f06c61722064656c6574696e6720646573lar deleting des
0x1910074727563746f72270000000060646566tructor'....`def
0x1911061756c7420636f6e7374727563746f72ault constructor
0x1912020636c6f737572652700000060766563 closure'...`vec
0x19130746f722064656c6574696e6720646573tor deleting des
0x1914074727563746f72270000000060766261tructor'....`vba
0x1915073652064657374727563746f72270000se destructor'..
0x1916060737472696e672700000000606c6f63`string'....`loc
0x19170616c2073746174696320677561726427al static guard'
0x191800000000060747970656f662700000000....`typeof'....
0x19190607663616c6c27006076627461626c65`vcall'.`vbtable
0x191a0270000006076667461626c6527000000'...`vftable'...
0x191b05e3d00007c3d0000263d00003c3c3d00^=..|=..&=..<<=.
0x191c03e3e3d00253d00002f3d00002d3d0000>>=.%=../=..-=..
0x191d02b3d00002a3d00007c7c000026260000+=..*=..||..&&..
0x191e07c0000005e0000007e00000028290000|...^...~...()..
0x191f02c0000003e3d00003c3d000025000000,...>=..<=..%...
0x192002d3e2a00260000002b0000002d000000->*.&...+...-...
0x192102d2d00002b2b00002d3e00006f706572--..++..->..oper
0x1922061746f72000000005b5d0000213d0000ator....[]..!=..
0x192303d3d0000210000003c3c00003e3e0000==..!...<<..>>..
0x192402064656c65746500206e657700000000 delete. new....
0x192505f5f756e616c69676e6564005f5f7265__unaligned.__re
0x1926073747269637400005f5f707472363400strict..__ptr64.
0x192705f5f636c7263616c6c0000005f5f6661__clrcall...__fa
⋯5 more rows
⋯3 more rows
0x1a308853a4000893a4000f43a40002f000000.:@..:@..:@./...
0x1a318720075006e006100730000005c005c00r.u.n.a.s...\.\.
0x1a3283f005c00000000005f00480079007000?.\....._.H.y.p.
⋯7 more rows
⋯3 more rows
0x1e1f000000000000000000000000000000000................
0x1e20000000000000000000400000001000600................
0x1e21018040080480000800200000068000080....H.......h...
0x1e220030000009000008005000000c8000080................
0x1e2300e000000000100801000000018010080................
⋯7 more rows
⋯3 more rows
0x8d3f03092ae7929c6e25b3d5790b348d1a2000..y)..[=W..H...
0x8d400236d25a185a7f06a6581ca9cfc3e1811#m%....je....>..
0x8d4106fd9083849d46185af251af64008cbc1o..8I.a..%..@...
0x8d420236d25a90ca7beae8103b7608c285922#m%........`.(Y"
0x8d4309cf2c99a8a18a7c0eefcc4bf1ad366d8..............f.
0x8d4407285b71d3650b42f710b8788ddd60a01r...6P./q.......
0x8d4500e92a679f27be4d0bf77127744d3c679...y.{...w.wD..y
0x8d460e1a1e9e60463fb27280b261f604d9854.....c.'(.&.`M.T
0x8d470a418e371a218afd834ff71b24858aa69...q....4.q.HX.i
0x8d480d6ee58decadb2b680074c9e88eb6779a..X...+h.t....w.
0x8d490091124f3be92ead09e7791b37b98ca72..$......w..{..r
0x8d4a0236d25a18da7f06b6181ca9ca85d5f11#m%....ka....]_.
0x8d4b06fd90a33a393ea5bf27f5632a8592324o..3...[..V2.Y#$
0x8d4c0236d252a43fa3f603f9843d970d61219#m%*C.?`?.C.p...
0x8d4d0d74c1ff833bbebd0bffcd4bbc3103f27.L..3.........?'
0x8d4e06f61ae7fc0267df7f6c5c217c155d440oa...&}......U.@
0x8d4f04090b35929d6e25bf75392fe44d3762c@..Y)..[.S..D.v,
0x8d500ab2701a18da7bda66d0842788d5d5f9a.'......m.Bx.]_.
0x8d510091160b3bac16195b7fcd99b19d376d8..`...a.......v.
0x8d52070e6602298247ae3f611d29d8c5da0c3p.`".$z......]..
0x8d530dfddf3faef9b6351a37691b3c30d2ba7......cQ.v....+.
0x8d5409871242ac8af43c3f6c5c217c155d480.q$*..C......U..
0x8d5507c18e3712b03ced1bf771af6409fa33c|..q+....w..@..<
0x8d560236d255aabe837d8bd69419c8c5db450#m%Z..7..iA..].P
0x8d570d754ebfa3373ebd0bffec443cb25d324.T..3s.....C.%.$
0x8d5805e42a65738ae49fafefd3a9ff85fb430^B.W8.I...:.._.0
0x8d5909b5c1b73a293ea3ba7f4eca3482c31af.\.s...;....H,1.
0x8d5a06765e2aa28ae37eb7f80ca9c0718a7fage..(.7.........
0x8d5b01492ae79235272d1bf77c0381d50a866...y#Rr..w.8.P.f
0x8d5c03a3dae67c024a6c37c80cace0718579a:=.g.$..|.....W.
0x8d5d0d489e371a2c26185b7fc1323485823af...q..a....#HX#.
0x8d5e06a59dafb4b6b2760288841d984d61709jY..Kk'`(.A.....
0x8d5f0d593cb70a293619547fc74ee8b94efe8...p..a.G.t.....
0x8d600eea1e9e60463fb27280b261f6041d454.....c.'(.&.`A.T
0x8d61054926b91a393ea59f29312ceac5a5738T.k....Y.....ZW8
0x8d620a110c129bcaddcc3f6d5c25b0e415e11...).......[.A^.
0x8d6305c38e371a2a02a39b27591b3c31d2be3\8.q..*9.u....+.
0x8d640a271242ac88b37eb7db30a75755c5f11.q$*..7.}..uu\_.
0x8d650d754ebfaf79b61919f5cd3af711d2f2b.T....a..\..q./+
0x8d660acb3242ac8247ae3f6d5c217cd417453..$*.$z......AtS