�%1;����XS'�C?����?�P�! �������i�HYw�>`�~:9g�����蓧���eg3�r��Ƣϝ �O�W�����~Л�����Q����r��I��4٘��+���4��ݜ��ZJo�� oQ�eTR�Np���z�K�6G(�ARa�T��R�tu�0���)�:�c��M_����Ǒ6�q�/��6����Ѓ�g�p��>���I qy*��#|�o�y�GRg(?%���k�$}�I�G��/��i��$6ħ�����0`��2��V�[�uШ��� ŎE�'`���Zkh��><2|v���H���C�%��Xg��x���@�K䕧�B��T��sކ��k��~% �1�ؚ`x岰o'ϥ����&�rf(J9x��#ң�eN�ٷ�<����piIt�rUK�9�d��B����2�Y38�6�r��Jޮ��0�n0~3\�\�a)=�T�O���ݕ�V<N1#��� ���CL�/��NI�4�f�������-�!�U����0�>�����~���q#j��!�/�{�v�����_|��6�}����dx�?hNZh��=�)9��k���"����>;�2�&�dž��j�3O���R���`/i#v�B��7��v�x �/Z��`�졫��JЦ�D�Y�#�*�B�qP�p�،�e;#����>�w@����W4ܳ�_��e�h�����O��6dB���u�D�"�C����`���h1}w5W�BPP|-����KR>l��A�f���#�D>g��!��s=��ݴ�=1��}Mq��5ܳ�w�wm�atK9��@��+x/����X,�j����a�]1�����v���o�a�zq[�V���Oe���l��؎��R+�N��{@��fH����߇�9)�l++�(��cW���35ؾ��O��^�GX����MP����WZ�B�������n<UɅ@e�#���l������a���}m�O�A�M}����]����,��t��|֘ӄ�Y��J'���k�t�0�w~rï`���6Z�lݮ�3ýiY:� ~¢�E��������p\@�U���?��{�,�� H��vQ�:\p�D��Ηx|,��A�4#Sq,5>�M9������U���� r?�54}�WX�(nQ�F��.��w�Xnǚ����*�-�[���6���:�[�GZxaH����#$�6A���u��s���y=Z�G�����q�ծ��!<}�$U?���.մX���'X�r�S���H�^I]�����߅&��6h� c�im��d��%xMƥ]J΅��K������>$8b���U8Ik��{�����%��w߃o�B��W%��Ǵ����~�F#�ͺ���ꍡ�����X4Fyӆ�"!�~�u�!���\rKS���1w�<1�����W C����(�\A��`��ԈjX{�f�ԃ_�[�Z�������lk�DCҒ9�F��B=�'�A_\�c0��j&�����pܾ�fC_2%��ܓ�G ��$�=����9����5�k)�� ��W&"�K��� ���y �}ž�Kv�?�7x�"ۻ^��r�R%��2��r>�����*��B��+̞~1b�vJ�� ��i�� jXR��x߲� :ڞ��9BM�._'y�0��vL ��d,ْp�NXCP2���"ٜe5tU�Ac01�gP/����~VL�y����-��4&`�}����F`6 0$/'q�ޡ��2�0~�"=�acY2#�~�CX8�S��O���f��r[�ş}n?̯����j�h�[ˊ�ٶ�H}�^�y��8�@O���;�/��I`l��S��i�J.�� u��Hf��d�[��y���g�gڅ(k�m6�VZ 9vb�n�U��Z)��}-Z�W�(]8rta^��|w0��/��$��w��*���������@1��f�f�{���a_�mm���.a+���:��j8�f쏮c��ej�} !��/��\�k�di�� �-���L�����,5�bMQ�]u�3����n@�:���^q7n详N�f=Ύ�xx�emd@b��=kYfD;�Z����Og��v�x&�jv�^�>�{�n#�)��酻�iU;�m#-ѝ��dC�g��v�������qB@R���`t�B/��x���BP~�+��<��G�A��2_�c����/��͵ܦ9]#�������F4g=�V�R����nGhg�7�v>+�?��G��1�\�;o������oi�D]1�l�Q�Jvo�.>NIJ�Fi��B��(+�q��6H9��.��>4ޛ:r��%�Y;���jx��|;�X�{��m0��;�H��oӻ)�����r���{����������|�͈�s![Ӱ�/�n�.�v�G��4�6�� ����0���_'�\����W@�� �g��U�6�KP�)S7�+�{���?�3������T�� 0��sq�4��܁��H���,������ө��;o����.����bp�}[S��z���5R7 %���x��6�y�i.�L�>Z�f$��J�?�cS�6#��Z�+��s(bΒ6�J4�4��1w˻H��9ڭ�ӬOsnd$����cM�0���I)�Jc�д�'~&ѿ�U���@��;�d%���1��̚@LnE��v��+��s�q�}�����+6��3��������@\~�?�^�� Q��yP� �2�X\wya^�i���2'���K͉}tNG8����Y��[���AK��l��s�k���I��*Օ�$���6Ĩ��M�/# f��Au��L:J�Zxl�dRۧ:՜���!�2��� b��k]���� d�wi�=��PmST���S��[��vٖuseܑh�|���#� K6����-n㷨3^�WϠ�3��J�:'�?B���u1�}�Biǝ��<J�p_!a��n=s_�<�sYk2lW�g�8�ׂ�2�e��M|r���s B������p��8�KN�#a�svt"� <�z�[=U;�����#�F� T�x�2�9Q�IYj���]����Ж4;��q��
Static task
static1
Behavioral task
behavioral1
Sample
14f04f5932bc851acf217a147afb018a.exe
Resource
win7-20230220-en
General
-
Target
14f04f5932bc851acf217a147afb018a.exe
-
Size
7.1MB
-
MD5
14f04f5932bc851acf217a147afb018a
-
SHA1
d62ba39f9d2acbdddc5e9fe690c5051a9ab4c483
-
SHA256
6a3067c98e097d24ddde33ad98df7422d66327127fbdfff649e1263cdb1bf645
-
SHA512
12b985a090165e54e273db8743ea8f31290d95a2fe8013b2a3b24ca87b456a9a22ce471a52dd4675655dedcf7eb94245e8bc235a0c6cec460b3996c00d6d5918
-
SSDEEP
196608:q6MiO9h9xz2nHTcM5IUA/dU3B4bWpN1xIR:qcOrjziHTpSdUybINXI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14f04f5932bc851acf217a147afb018a.exe
Files
-
14f04f5932bc851acf217a147afb018a.exe.exe windows x64
a1990b4be806eba5f3af52b26ba4ad05
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
GetAddrInfoW
WSAGetLastError
setsockopt
WSARecvFrom
WSASend
WSARecv
WSAIoctl
WSADuplicateSocketW
FreeAddrInfoW
htons
gethostname
htonl
listen
bind
getsockname
WSASetLastError
WSACleanup
__WSAFDIsSet
closesocket
select
shutdown
WSASocketW
inet_pton
getaddrinfo
WSAStartup
getpeername
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
psapi
GetProcessMemoryInfo
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertCloseStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertDuplicateCertificateContext
kernel32
GetStdHandle
SetConsoleMode
GetConsoleMode
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
SetThreadExecutionState
GetTickCount
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
CloseHandle
FreeConsole
GetConsoleWindow
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetFileType
WriteFile
FormatMessageW
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
CreateFileA
DuplicateHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
VerSetConditionMask
GetEnvironmentStringsW
SetConsoleTitleA
WriteConsoleW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
QueryPerformanceFrequency
InitializeCriticalSection
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExW
VerifyVersionInfoA
FileTimeToSystemTime
CreateDirectoryW
FlushFileBuffers
GetDiskFreeSpaceW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFinalPathNameByHandleW
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetFilePointerEx
SetFileTime
RtlUnwind
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
SetConsoleCtrlHandler
GetLongPathNameW
GetShortPathNameW
CreateIoCompletionPort
ReadDirectoryChangesW
SetHandleInformation
CancelIo
SetFileCompletionNotificationModes
LoadLibraryExW
FormatMessageA
SetErrorMode
GetQueuedCompletionStatus
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
CancelIoEx
CancelSynchronousIo
SwitchToThread
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
DebugBreak
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
ResumeThread
GetNativeSystemInfo
CreateSemaphoreA
GetModuleHandleA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
GetComputerNameA
CreateTimerQueue
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
GetLocaleInfoW
CompareStringW
CreateEventW
GetCPInfo
DecodePointer
EncodePointer
SignalObjectAndWait
SetEnvironmentVariableW
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetThreadTimes
FreeLibraryAndExitThread
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlUnwindEx
SetStdHandle
GetCommandLineA
GetCommandLineW
ExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetFileAttributesExW
SetFileAttributesW
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
FreeEnvironmentStringsW
MapViewOfFile
GetExitCodeThread
WaitForSingleObjectEx
RtlPcToFileHeader
RaiseException
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
MapVirtualKeyW
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
ShowWindow
GetLastInputInfo
FindWindowW
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetSpecialFolderPathA
SHGetFolderPathW
advapi32
SystemFunction036
GetUserNameW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptImportKey
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_SHA3_25 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ