kj�� Ѧ?^kJ�k�a>M���{������=mA��"�4'���O������m��I+�H�� �d��hTi���e@����?6�xxELh��Ǹ��m�����d���'�����I�&ǎ+iv#\�8�b֎��*"�� ��{Տ�BG�;�X}�NwB�8��:?��- 4��EM��.�0�P( �ɳ��3��w���V �oe�߅�0���)��(bP[}�����i�D/ �xkI�f:�4�ZyW�:G)�+�*.iM�ʞ���f�8�����P��!����ik�� ���6�8 �����Gxz��>O������Ϛ�T-�P��f�\�۠����3�����y��<V�����<���{���x��)p���<�ؼ쮀��� �t:B��gvm=�و��2����i|��ӎV�1*�4?<��BQսAd�\��I �I��t�.$���Z��U�RA�V`��r[K(���앍Z�>��svB�G;���:�r$?��: ��Ɍ�Y}�c!�6��zwW�EDK^J2�Զ'�A9���$l�[iu�C���C�����'=BҏkUW���q=�%���yk[&���0�����k��+ ��.d��z}�]:"̿}�m�#s(��9���8nq���2[�mu���"�������/�u�O��ݦ���8����R�=��=鸕�M*�`�w�ri�6��uä�%^��*���V��jM�kX�=�� ���V(�K���Y���9�4�%T�G�t�NQ��L�I4j�I`���]=>�=\�t����������A@dK��D�{J�3O;C�>0���}�J������A������}�u�v˷2�3�a��t�&B�: )���E �ߪ��]:?��~돸�;1K�<�����j⦓�[���������m��:��b�kܠv�������o���_�?v�:^��L���Ic��m�Z�y!�����ٹ�b._���~�?������v*a��l��ߚcؘ h�*8�����dm9�WZEP�:Y��?=Ż#ݞ�,��K�0t����BzM���vQ��K)�վ6�i[9@G�ʆTx�a~#uZ���֭r��}� � �ן �_�Z�`K�Ԡ�v�y�Bl�i�ӛ�*�@����I��m�l6�d�QZNb1�r&,1X�71����Cg�w e};MU��2�WU�(nz�+���ʧ`Z��"�mKh��#�u���;��2�x%m�kJ�0���I�w=�@��@�Ӫ�M[�`�<)��CWt\I%�B�#[mI�H렭#^HB���p���O[:roٽ '��!D:��RQ� �ڳe��/�/x���7V��5g䃐�Ov<���s��H�����M���kw��e�6�P��1RK�ە��c��'��2�7��D^�%k�7j`�3���)�gz����ؚ�x�~h��> �TC~l��wB5���Wh6SQR}>4���k��o���^�%�$�LBO�l��i-H���^�a�ѩ������,D�s��pc�b�mE����!�O�TQ#����Ҟ�|u���rfw���(��J1DLm���<,�o�0JX �z?��.M2m�c�2B��0������˹�m2�P�)=tfO���Vv:ՒDX/�����@?OS��X�c��]9�g<�2�1Č��}! �y3�M�2�`K�b[d.�9$zNЌx��&��4�;o sMsP� 1|M�.��}@|����^�Ǩ_R1zaw�5g����F��`8� )o�5$����x�kw%������C�m_(���I��D�%�x��#+L��� }N7�*�����~��.�(c�2-RҰ�xL����p4�P4e/�P�_~4�d:W�ҼGpx�6|��w�)�|��n����5�M� ����""HĢh4<���k�R�Q0�"X�(Y�O�)�m����]� �R� �[Z��$R_�>m�r����{m&!l���q��W�)�"��ҼU3f�)��7��ǥM��S�^�;Z�����u����^;n�բ0�ݼ�ڈ��o�=d�D�� [�5����̅�?(���A؟���3����=����eU��y��^����"��;��h�2Y�}[�/.(=�������Q��@����;�t�Y3�q����o��)ә��ґ2X?��O%2�,�:���̀�X�G���n���h3��.~lQ�v9!�a�|�FN~^e�Z��d��4�A��BTh]���<XxΧXmz��d�˗El�99[$��ǐ�L��6����}Ե4��M���9��D���al�� ~H��� � $�~S��FAL�9��H2����� |�@Lk�0�3�C�Pyhq��U�15'Iib�r̸�AC&Q.�^�mi4�±�� 7G�T=���G#qH s(�ܳ[�������V0�4J��,Tc���-/<)����x��.z[�? ����9w�D���#��s�OW�{7��`Ēq��Xy����k�r(��GѺ7vXg.yq�\ɀ�1t�����XZ��F�<�'�@ �8��g���9�N���_��g��c4��uX�[wl�(�J�o:�M@���>���YG�7��ϔI��o ���^cṽ�U:E�5�f� �"g������2���r>�������D��[n������l;'}zR��Έ�����A��qyoPU;����}�5Yz��D������RfP����F*�!U<g��DZO�� �,8�,rt��r{����m�dG��J��y]�ؑ��<#N{0=E���� ��Ue[N�� �%�"k��Oz}v��T� ����b��"�������D[��l�;����Z�1<ϴ��@dM �l.����Ц��fthQ�/$T��9�]���*�� T&�I\�ci3�� �c�R�����Q�����c��6���ǰA��6�]g�c�Is���t\�h���%c-Ir~x���w�CHRiY)O��k�7suil�Y�_�W��$���X���zxX9����$I�,�i�"�VB�e�w�f�����*�����9���O P���xF�%nH�!����05Q}K�ԪDsQ�J����m���@l s'Y"љ�U
Static task
static1
Behavioral task
behavioral1
Sample
39f14cd5999264d9fb82867c81c002860794f2c4039dfaf34b9486cdf787e67f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
39f14cd5999264d9fb82867c81c002860794f2c4039dfaf34b9486cdf787e67f.exe
Resource
win10v2004-20230220-en
General
-
Target
1e3f2807ba3de538288d7df74fc7930a.bin
-
Size
6.5MB
-
MD5
eb99ab535b559af7a69ee76210074e5e
-
SHA1
dd358350946b810a6d5a327fb03073623184ad9c
-
SHA256
d084b9bc279c660f4294afbf74d7a1a9f1d2c495a46a0f863c32a73f1934c7a5
-
SHA512
5320115e30102dafc7a5e92f99f4b9ed8821ef8ce93a8025396a644ed119215bd450ade00aeaf83ac66d19e7ec714347e23097656aac5d4ea73cebcb70485d43
-
SSDEEP
196608:L9tKu3gbCNcUQPyAn0OPghQfMLpWMB1CgMD0FwXeRf:L9tBgbXrPyA0OohUkpExD0FwXef
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/39f14cd5999264d9fb82867c81c002860794f2c4039dfaf34b9486cdf787e67f.exe
Files
-
1e3f2807ba3de538288d7df74fc7930a.bin.zip
Password: infected
-
39f14cd5999264d9fb82867c81c002860794f2c4039dfaf34b9486cdf787e67f.exe.exe windows x86
Password: infected
3154a8c3e9de2e4b5b6aa20e912520a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
VirtualAlloc
Sleep
LocalAlloc
lstrcatA
GetProcAddress
LoadLibraryA
VirtualProtect
GetCurrentProcess
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
FindNextFileW
FindFirstFileW
GetProcessHeap
VirtualAllocExNuma
GetLogicalProcessorInformationEx
ExitProcess
SetEndOfFile
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
LoadLibraryW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
HeapAlloc
GetLastError
HeapFree
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetACP
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetStringTypeW
GetLocaleInfoW
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
GetDeviceCaps
CreateDCA
ole32
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
oleaut32
SysFreeString
VariantClear
VariantInit
SysAllocString
Exports
Exports
Sections
.text Size: - Virtual size: 249KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ght Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.f(r Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.:ny Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 306KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ