�:�~*�O�����(����2�#��TI��Rk����l���?�(��/i�^�ZƦa���WWq����<CK�[�*��p_��G���`��ຉ0G���m��۴iZ���4'�J#��.K��d�8�[�f�.#;n}/#���Xɉ0\=�Gb���,�]ɬsuI��AD�}���ƨ�xYͭ��{����zD�x�n0��)jx����T?��ҙ=�蓲�i�A���c�� 8np���w__)��Ͱ�~�*d�흳=�~�H;� S�ɵ���� Z��.q�+<��(k_ˀ-ϛYS�I�Mt^=�����*&��h��ABܛ3�[A�` b�i)�����y��-�9ٽ��0@]Q��C�Y9I��3�������Cy&�_�I+L��JTo�4�t��$mN��5 ���v����W@Ҵzz�M�LXG����V��,��z� Q}{,��d�����|�E���t��}��H�Vmdqf>բm� jɸD��2�uQF��Qٯ�����]�{ny�L�ZA�L�a�Ӂ��ϳ�E�Ky�o�SA_1��CILY���9���י��ih�y�BT<a �QȤ �B��j�� ����=t���_ CBJ[����I|h���]6�יz�/v�Jrp��]M�?P�Q��3��Yk|��T�ۑ���9���Չs��j瀑쐦0o��r�}�I�{i�.xL�M�Ex�G�6cN�����J#�Vs��k��0���}=μ$d�5��3��&�~�5=��Y� �053N����M����ĎB�E��<�?��`�1�X[��ɃJ�kg=�����������}9����h��3�>�7�4�/`I߈�U���7���.gi�6��6�ӽ�����=��.'#�AU�u��>��*ۺ�隊c���Mۥ�`?��Mۣ��D�d-�\X eK "���%@{������Э�B�믛��¼[h����Bd�>j��h��=Qb3D��y�[�֮V^m�̅��FjS�/O�K¼%�G6풇í�Ւ�~�w��~(Pf��q5-�[�6���� zAps�̚�E�(&p�"�q�������� �~�Ez�=Jt���bo�d�y�Ə���/�R�aL�!a��Z*-r�ń���.x��:E�Ҝ���n��Vt{t��V*"���=��%����8k6�b,����@� ���� �ᙈ�Γu���_�6����XT����A����/�2��^���˓Zס�ܿ������~<6��*j���O!妶H��t��̹MB���*y;���TUx݈�6E�a���b������]!@�"!'��kp����?��x�����y��d��ֲ�lK%�1�6Иhv�,���@������|r�����QX>�t����Q�\�o��ch�b�U�!��61�i�[ ��R������>A�CLD�;0�D��u8!�DY�ڑ:@;1-���}�*j���d��γ�̶f ��0�w��]��I����G/��E�y�=k�R�>�������}г���$�Ay�Dz�4���� m�������!��6ۡ1�]��|�F���2��Yb �pCG�����U"7���e)��B��ij��o��.�� ��������{�k@2h����laG�u4�wl�*R&�YsT�P�@ᠽO�@h���������1���GQ�_NS��SE��i�o���L#>a��t-���ph��.��)TVQ}�H����3 �ss�Ѯ,f̝�-�����l��'����{�Ɋ3�<�t��q����:����Jȕ���w"��� �9G��+�d��'~e�Se"Y�K[���6n �=��XfK}�!>>i�N]Z��Iz�ɞ�($e��U��Z"�> �A7Ԏ�'@p�zCqH�����j�L�� �£~�[���2[T�����~���H��dBn��{U�7#���x3�E��i��`���B�?ƈQ���Z�~h���zϝy���z�^���He� ��ݏ+E��݄IQvL�]QdDd��%K ���V���ʨ�O��r��=X'���������ū�?�P��ϱ�u�m��M�n�+B��ޒ�O�H-(I� s��{u䱨�����U����t�3����z�A*C4�ޘR���ʷ'�5�c*;M'�S����HI�U L6��?�������@QkY�G�G���h"��[G�9��,��g�}v�n�g%J��d1ؠ�mC��Z�J��թ�<�r~�{σo�<m��/'(?��z�)���{ �����~��tPw Rƥ�2C ���jqp�̤��wt8A���X]>�c�m�Dd���pv}4���T!�:��U6�)�n�%S/�{s��dwtS��DR8��H[R(_��e�z8��N̘�1��"���W�G�*!>��� ����8�jӔ鱨� �BN��(�a �e,� x�0���ڑ����۱�h�U�$\Q?iJ&yX�e��+^�.�?�y��0c��o�|daɊ� _�Oxqu���k*Hg[I��,�[ꖂBJ��sP�R� ]����7(� �M[�����ԁ�Teֳ玢 �͕u�V�b̀^57L����a!wε��#�Z0�y�n��<#��a�����Ӌ�\2j��()���'$�=g[�w������e~9���wϙc�O|S�Fݟ����H<���Nҥ{���6�`1/yQa�� cQ�b!� :��3��!9��[V�a٢y�ȴG 4Ét�h��xB[��=��үjC�y�\��'�փ��X��K2D����y��U���7~`�\X0�[���P�"�S��_G�5�2&�z2��|4�G���xh��# ųÎ����C����eH��{*�q�M��D��1����H�������\D\'^E�B�&8Z�������G��ƴ::5�d�=���b�)�o&��Ą�o8^������*�Nhh�<�:��K� ��>=v��.�<��3�!���,���<���%�c[]��k�O��jr�%|ɕY�z��[�{r��-)�Z�֡��y��)v���X�.�Ѱ�t�����lw��2�eX��
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10-20230220-en
General
-
Target
1.ex
-
Size
5.6MB
-
MD5
bb66c9188cf18c9b58b3b81c01c18e9e
-
SHA1
d0af1fd6a4652149ceb7edbbe20cb1e1e6f68935
-
SHA256
aca04886bcfec504bec82354e3870738953066127d45b487dbc7ddeb7183f55c
-
SHA512
95766ae53e1913b8a1b5d51a9118509376287f19c9c428128f102f9168c18f022ead610c7d6691d6a4812483a73b939d69ba19cb3d915ed5c68ef2ee740d2e92
-
SSDEEP
98304:tYEQO8Oj1gzPL77ghFG61zF8Q6LYcqzwvETQM2EsHGjIoXuuAE:mVeJgzeGmzSQ6hqUUaHG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1.ex
Files
-
1.ex.exe windows x64
61d556b03704affef9a4a3228c988f5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
mfc140u
ord533
kernel32
InitializeSListHead
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
netapi32
Netbios
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.v10 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.v11 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 647B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ