%���DCǷoA��J��Ht����`��ǽ �2b�eXT%�)Ɇ��/��?���lRڽ���!ɩ�����-{ҍ��<]?�Hu>�l%��;����S�����*�kui�� ��7gY�si�(g��[���?N��E7���^؉������X����\����n;f1æ-B٠ˢ�@���Eԇ�K�F��tH�9�pG��$1YM`�.���٩�kFX+��c�b^y/���V=� �b�5�E�I�~kk+�x ������@Z[ą�N5� �Oίb��t�FZ�>v��w�!gL��.���Y������q�B&cs,K�\nΣSA3Y+���熫�F�*u��S��V ��µ��������U{{��߁�YtrR��q hw|ڱ@j��������ك����Ţ+9ץb��_9B��"��j�, I��+�l�v�����5�t��!3:�`�w4e*�k�k�vC��bw��T�ST�T��`����E�ɉ���o���h��"�Rl������]�q?� ����r�#9l��Z�@qC!/z���&�M;4.��dd�^��W�K�� LP��8C�dQ���/b����/p����[��&s��r־��7��r5�R�k㭏�\'�����x(~��SX��S�$� c�T�AM�X�7l�R��,���j�s�Tk�\b�cVm��������AZk����FdH��r�����b1%n���4��,iC3�R4=�"K�t]��rT�(T*S�mE[ �cV Z87 ����~ы�D��2n�n7�OA����\��+�PP��0�`ܣ s��f��R�8��a]�A������C�n1ƄY������� �gM�ڕ��ֵ�s�r;~��������ˆm����EUd,�dqG7?@��f�-)�O�T�m ��M�^=h��ȡ�iۇ����s̔����h5���S3�چ�S�W-�cH��G^D-�o�|��H���al�%��w���r�U�����)�11�\��X ���D ^�U�p�P9ǘn2z�P9��#qsȔeD�)����!2#P����-a��ƝNf� �VR) � �;\V�h*��T=8�i����b��Mb�2���nO�6����=;+�ZG�٧�Bf��B��I� �@ks�-�+��M��Y�&Rk�a��3��(�ߦ�����K����k��]����se���G"��m�S�̕����jī�M�eT��a`OH������P9q ��������e,@�'���vI�������9,�����]W�6��Tp�t���Y)O�h�:�l�+���/V��w��>�쀢������8l� |sI �P2dn�t��}�1H����,�|�9:v@�?r����X����0���#�X�Ϧ���gA��[���Ϊ��l��o���O�\�z�r` ��[M@SOw� t�(-N����-С���8'��A:#�Rݏ�J�`���Z%��1���>��̌Z�1ml>�d��3ߣ��TVczh��>�2C�.�֙��[��5�b�.+"-��P���܂�i*������T}�l����mwDy7�nL��3�[-X���F�fg� Ʋ�����V��i1W 1Ȑjr����o�������XU�N�4(� p[���X�>lX��H��%�w��]�0 � erF��_��yz�0u���Bx���#1Bt��j.)ʤ8M�� I6#����s���? �":�A�_^��Ɔ����j� �>�,#$7 ����U_/L�2�|C>�yX���1� ���&�V��^f��e��k��KB]Q���|c���`P��ȸN���V壥���Sk�o���p�j]<���R�����;��/Nt2x;/�z��e�0����a��,Dm�σ��:���*���R&�>�``��B�5j��qfy�|���܈����V�c����ր������*Eg�x�B-���\�X��� t'C�:��@�ph�UA"��ev��sLԺ�t��rV��Dy���e��19٣�r���a�ۥ�4W�a�C�_1�8wD���D�4V�s�M�.�,��!#���^+� ��>� ��S5�N�>����=l1�]�\����3j?� ��l�10��w/�'J����*W�������⡿B3y���TF�К4�e{y�Jf�;����MAgiD�|L_��Ì$��=���_c�[�C�-�pѩ��-#��d�;MIP(� �����<��!`��"�1�ڄ<'W�}6lr�i+i��3 �-qЎN��/33�q00�Y;��4ڇe����P���<��3��PNV1'��&cz0��i����韮��5�{�77�ŻQT9�N�8�D�r�kDQ��p�i�Z�Ў� %�]{�w?i�0��1Z�̷7L��W T'T���Z��b���=�2�T���`z����#zFpw|e�"옐�[�ol�⤇��i�ׁ %�I���,֤aJʍ���leU�;d`8���H,J�D;�<!R�w�T��� +�ŻzQ�ET?�$�� �ᓾ䖓���>2��/��7�J�s/�.�o��.H�s�A�O�����w�:t��75()hL��Z0#=�M�6A����ͤ�6e�.�1���;��Ck��%���TR�WYm���߃n��X I�b�w���ZC*��%a�D��R���=6U6�$�kU��>[�#'�*AgF�;Q�*�����o`�]489����1��V����'g�Q��8�wE�rʫ������x�F��%���+{��Az!��y��x<�Υv����R���Q�7s��+-�c��N~V?�TmoC��NU�Jk�2���U�����%&�9�Zm�ܦ�L�#@ar��aI�dV�v�m�C���1�Mp� �<�F�i��ɡ��^wk��M�퍲)�oш������G�}^p����A.0��zʥ�W��)T(X��N�|�ڊ� b�3k(u�4מ*O����/��f'y���c����Y˯�bl�`�i����T�h����}�9�y�Fά3�X -dF����*������
Static task
static1
Behavioral task
behavioral1
Sample
e469943dbed26691a393546d46cece07.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e469943dbed26691a393546d46cece07.exe
Resource
win10v2004-20230220-en
General
-
Target
e469943dbed26691a393546d46cece07.bin
-
Size
6.1MB
-
MD5
e469943dbed26691a393546d46cece07
-
SHA1
c7cca2060d9ec269410c4fc2483ec2adcc6450e5
-
SHA256
ad0a38bba912671edc2173de23f3d3f795a79c53d5b5e2455754750ce307e7f7
-
SHA512
3e27a3d195ead5c5e76d12737ff3b1ab3c317d06572dea5767864c913539d0f527581da48c433a557f60ea804edfb25fffc09e1daedef97ed49ce7e2430edf5f
-
SSDEEP
98304:lakQCCMJvZSPmCylCw2iMRrmZYwuyLMr/EVRlvNKF6LVnStT:lakfdvduivTnNsIn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e469943dbed26691a393546d46cece07.bin
Files
-
e469943dbed26691a393546d46cece07.bin.exe windows x64
abde4fb97e74b2834557e0690741cb43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
CryptDestroyHash
shell32
ShellExecuteA
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChain
ws2_32
setsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
Sections
.text Size: - Virtual size: 530KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qUY Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.H:" Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.?ri Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ