>�Y�h<l��h�Z�Dao �^϶5�{_y�N�W��������������5�=�<g�0�7����"�ts�L}�� �`����� �e�b�=B��\��AF��� �:Jx������1�N��3<Kp�3"{�����ӗ�� �z.L�a~G�=)Ǵ�{��X�6~����X�Oth���m oC&0h�T�|������=�vL��C����&�?!����pջ��SIw���k�b�@�� �"n��x%��4�$�(�얛5���hgWi���/��(��{�a,b<T�/�Q��C�! ���@ty�[�j&�$I:d0P>�5��N̹�x���n���o�;��8%�[��?ۣ�]{PҦAU�U�Gl?j�:z�r>���O659p$�0��--�>�t�>�Ѱu�HT��$Ir��~N`���W����U�11P�ܨQw&��=ʠ� 0ݨiԱ{E 5+��aă鉠a'��>>���D�ZqBO�~,E���:%-@��$��,�a=��;�����l&���^��?��������#��T���s�s�u� �0�vl�A��^���=!l�e���A�+��`ʄ�.���@�(�Cߍ�ɶIK�/֞���j�@�triK�z�pV/��s� |�m]����cѕ��r����cU[s�%L�[l�����CI.�kw` �4>��,&����k,y]�LG� ����]���Ւp싼�d�������ϣ���(J�yh�a��0qfM��v�=I�]��tu�}<�S��Ƥ>���Ƭ�AC/-{�Jf�T�R��zo���}k�7~Sh�w+��gh�]�Y�>�����_J�]h�Bj������{щ �8N?%�X����51�k�,��ɺ8��;+��Z?k�ݰ_��Nč��v�}5�q��c|髕1����a�U�:o�����iȵ1�6���PY���c�,�ߵ�e���qF�p (+3[��tM��;�% g��̉��Q+>�W�6B��'�g+�'���c��X~��Tg#NÞ�Ɲ��f�ȏ$��6�-��� �\@0�-��B�g�����>�3���XP�~��Ŏ���N��T0�v�?�|1�����0�\\1�;���½�[�{Ȩ�DE�#X�{�mgO�q��{��������ꘆ-��C\�5���hA"���d@LHjC�� �o�[��RR����m ~����l���C y��� �"�RU�u�&b,�ތ4죀(��s�����Qmu�(|ǃ:�5�~轲.;72e3�����i�����q���j�m�����aY��v�i@`�$��� ����E��������+��(-" )�sh٦�ۖfwKO��;��$q�gq��d�/1v�*�"��v5P� �����}��F�ES�ŀ�Ne��I�L�u�fB���"�Ѵ��|�鴽�O�Z-�f��*ă�+�*�қ�V��1�π���G�a��?+>�;@�˜9��c��x�('_��A���*�B��k���3`c��@�i��=����q{s�<�L�v�a.M��w���0��TM �g}���_�T������X]���V4�.x��{�W/+� 6 ���,�vA�{�6�%�����q~^������:I�Y�F%�Ee�`lTv��s��2�[���]�X���qS��ڹ�yᕇrOy�k;�P�@����i�}�_i�������û�E����� a,"o�(�g%V��T�֨���T���Uҕ�H�s��WQ V�{ηڼI����g�$�aZvt}5��d~��7��ͅL-3���lrUb�k��X��_41�R)���4@��.���rD��[�+�i�P��0� ړ�jX ��D8��R��QB}k�����E�2a#��s�"P��/Ή���ub�l7�K�<q�.j�-[��y��M��WyWmN�TՉ&7-DD�m`&��ʘ��r�N��]5.Dzw�c���T������GZ��Â�R]ܹaw�ۍ ųI�B���ZS��c0�>DR?��#�1�*�����0V9꼑�oz��\�+�0;KwM0�?I��~��K> ���t�Z!++a�$��܁���Y���?�Z�,���&�N��/,��mG<)�c+�6ǃ:��;;�h��?@Z��Տ+��;i��.hb�7�T`,|�â8�#j�P�����գ�^J�vj��B5�ڕt��A�?'�#�z���L�b����{�����L� �g�d-��C���;N�P��;Y������F��nV��e�0������:+ʄ��φJ� �;%�S�����Ca=�3|��H��ĕ&�L�dbxXN��d���E��Z댎}��:F����O�����Ŗ�v����Pk�Ġ�~!���Ɣ��z;�*5�(�#to�`c��Htr3�ڟ�.�R��|*Ͳ9�6N��x�Ήz�$�� 1�bU�~�b5C��?����g�9�c'�^%�x �a��zW���l�B[g��I��<>"*b����vy���tx�M�4�:B����{FQ�{�� E�ف�?{�8N@� gz���n�;B�`���AY��Df�� �ތ)���<�e�` ;e�#����/��NGdc �=>�s���Ct�=���)�r�-��� L�ѤG���h����ԯ�\7V�-�������T|�ʗ z�o]�C���c�tW�!>k����r�gu�M>-�V���� h˘�/P���#�L�o^N�{H��C�$�'��5![�Fl����E������Qs�9�g��0�..���^ ՞�g�ّڝ�*����\�9��-.�L������������l�7����|C檂���R � h G&�[�}|�n�tY$������H<V���lhG���6�2Q���q��t;���cY�.�b�u���,���8�}"���Ud��Ƿ|æ{��� փ�5]�s�{a��B���C&����$�܄,:�,m����x��Kh�L��Z1�` `(P҄���������_[1ъ'��R$ w��p�����DX���_��|��Ⲛ��NJ���y.�W��(��4h[;ө8�y�4�V���쓈y������`�]uS�Ih���Υ��
Static task
static1
Behavioral task
behavioral1
Sample
Keygen.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Keygen.exe
Resource
win10v2004-20230220-en
General
-
Target
Keygen.exe
-
Size
612KB
-
MD5
0db6609065896a253eecc82d6a87c260
-
SHA1
87c641b6fcdcedb27df78309acf2de2b0c70cf8e
-
SHA256
455417b25036be142a47fe32a381fcc4472bac5dfb08ae118fcb1363cc1217ce
-
SHA512
efce15f5ea24fecc3829bced3a90590e6d479caa4a074ad7cf47d3787a2ce8f70942b74f28a55b45c551a2b7e42c53516188d5e35a75681f84e5888f63e8a32d
-
SSDEEP
12288:W8jzFqwPeTqUlVQ/+rQ3QB+PE3Ka7bWDy3h4:9jzswPMvja+rQA5KUky
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Keygen.exe
Files
-
Keygen.exe.exe windows x86
0a480c9ed7c36fe20d261c2591f6bdbb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetHandleCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
advapi32
RegQueryValueExA
gdi32
CreatePen
comctl32
InitCommonControls
winmm
waveOutWrite
Exports
Exports
Sections
CODE Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 203KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BRD0 Size: - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BRD1 Size: 605KB - Virtual size: 605KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ