�4 ���RT��D�E��d�Y�"m�|���/ȣT�P��Hַ�k��ҙM � �N*Mc�B��%��K��^���7`/��!�S��7Pp EL2����ԂA 7�*K�L���nL�Ǘmm����I�$8���� �#"�7�lrw$"�î���;H�����f�Shh�����Z��Q�e� �7��� :Ʃm���sI>+��Kx��o�ۥ���E�:��$ ��V��>R��{A���T���NJ��DwBΥ��Ko}�z�&3�,���T�z�m���V�~ �S�|z|�a��@oF�G┊�JB`Ǩ�k���� �_��|��<�n�����U����2"�c����W/���A��eA��^�|uMM|@7������u����vq6��G5�$q_¹,Ux�A6���{ #�����R���XϿ���lvEk�/b��J��߸�lz�ihw�sC�m^�~���Nwe�H�#����;�iΨ�ve(R�=F\1�TI}��\���3�#��������9� �U@��u'������8�F�����V)��:�u��c3�h�ɖ\�XN۶l8�>6��_,�q��ƧTYz����4�F-ٴ=څ2�=��1���n�e��T l!u/���$��}C��^��/oI:E���)!�]�x�I4�O��j C�����!,X���Y�;�A��?����s\����s�k��Q"[W���v9 �����۬��hx�|1���BzMf�/[����aF%����&(;Vd���Ԋ���� A��zv-݀���zԿ���LP���W,�:���S�`v�|��hg��@&k�<h~leC��u[�=g�L�p�Ǵj 0��߿&}і��'3�؉��;l��[���U��ڶk�N�a�w��T<D�]��'�eR��icw= I�M�ч�m�G�C���p�����O�-82G� a�ip&~:jUi�N�m�fw�����.��i|S#r���BxT(��dj�t�+o�4;����!l�ˁYsT28�p��\+,����Y�b�0�Ё�c w�X�ѧ��fy�Ÿ�pn�%��x��ʄF�'��>�Ir$J"��f.��57'�J��R5�n�j��v�LV�0�k�����7}7��`�m���0qZ{�5gh � �i?�Uڕ4��^����� N����H�w�A��4$I�K8m�֦�-�o�o�E�����}���>3�-p�����0&�oAP�[���e���M��36[�9��Bd�rCAZh�DBsn�6�H��D_`��:{bQ��w�f�����Ȕ�!�/���6�9�3��x�0���d�ct���� &�.b�$�iަ?��j'��7��؟�={��My7����kp��+d$�ς�� ���聸n��4T���ٸL��m�"d1��ڨ��0���߂sϼ�wL�:FAO%P�?���NG)��,�Hf���~�M�>���U�!qacKhrUmQ����{��u7�����h���8�O[�Pu���������2�V��ͥV�L������]-&�c$��*Nz�ٸ��X�䔒�t궆g\�MK�L�Ց��N"���T$s������j � �7��BE{���K6��ȷsN��)��)w��LیX:^�-����=��Ꚕ�����?хi�,'����L��B�S�ȋ�h�TH,?}xSѤ�,�5C���:]%����'=9�o�M#��)[� �����SMwb�w��P��+�\ |� � �[@�MR�c�!BLٙm�RP�u�vև`%��Ux�g[�I���{��[~m�v5Ǣ)���Kb�a}J����E����*5��,7����眱Zp^��mC��i���\ؚ�*2?@O�SlS�n��*;}�4!��I�� ���9��O�i�`��+��}�b�.�dY�5Q��.��r�;��˓6��,� �PkTr:9N����3�� %�X<3�w�\+��V�$?׳S$m�MfU�߈�q��sd����z|X'Czv�Hvm����DL&W�;��<(Ol� ��C��╒���nDy6� #��"JW�+3+�����j�T��9[��fFd�!���(*/�T�����>��K63�*<�=�.�1�@�ΫB�.(�Ѐ�lc��|�pC��cQ��3��4��0a*��]��|�B�K�{IC���d������i�9�Ѭe�G��`Ș g|�J%�/|t�UZl>0�:���+g$Urd����������a|�O��ЛWG��71�OQ^Dڞ�'����J�����R|�:6��z�|=���*NPJ"����ȑ� ��^ш�30¼k�^��k�+�xT�,2�������&�o���ˍ��|�|�Fհ �/~i�bSg�o^�a��ي_T�i�����V�T�}��z$�C�kx ��֜��X��GF��*��n��ޛu㟩tBRԉ�c:M�Q�$�B��he������>,8 �6e�O��gm c�����)��"�+F$b���$(w�!�OmʋtW�uS,�9ĸ�� ġ�����|���F#bp�/a=�E]���Ω,�h����y�E��4$�g���]z�3����jk��R6�O>pن�^0;��:��sQ�$�H 4Xh����1�[ܒ��[��h���1/�����zʔ�ˊEe��Y)�W�奦@8�BQ0k�5&e��2����b֎7�c�a�'/�,6}G�.86��B�R��C}I��>�wAc`E�業�}�f?����M9QZk�K�<p�%�*�BB (�j�9>tS]ֱ�0�K�ܩ@���Ċ���&.�J)XC�n��L!*��m���rhz5@�7}��w���E��!��eR���x5��M�-�D�y��&dvQb��% J(�'W����N�"����گ�?��ZퟔPg�)�� ]ޖ�!!�g:^��?�K4��_�uj����!J%d����z#O�\vqM�������'�^��3��8�����sq(>��k�Ԑ��c����g�#� 7�D���Y�DU��s��l�����PߩvͰ<ү����rx�uifIZ7�>�K`��e�%
Static task
static1
Behavioral task
behavioral1
Sample
ca0053d39da351551077957801cec0ca.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ca0053d39da351551077957801cec0ca.exe
Resource
win10v2004-20230220-en
General
-
Target
ca0053d39da351551077957801cec0ca.bin
-
Size
19.4MB
-
MD5
ca0053d39da351551077957801cec0ca
-
SHA1
cb56c91db8dd290785272148d561f2ef49ad9a78
-
SHA256
9953314f79bffb5e2f6af609250687e372e175cafcc66cab70b1689110231ab4
-
SHA512
effc8316937e41546c0acb786f6615d5845be8ebd1b098c5a1770026968e5a6eb9f07d001453bc9431768f06fbde6ff538b92aee9c1026da6bdf8e3c89e87afa
-
SSDEEP
393216:pnwUCGCpyIe21PeXYORfkOXrgOJ4gOcl0ICyhY3NClBla:1wUCZWyuYChbbJJO9l3KP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ca0053d39da351551077957801cec0ca.bin
Files
-
ca0053d39da351551077957801cec0ca.bin.exe windows x64
89ca3e0786f6c9efb698064c4309aaeb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAStartup
wldap32
ord22
crypt32
CertCreateCertificateChainEngine
advapi32
CryptGenRandom
kernel32
InterlockedPushEntrySList
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
comdlg32
GetOpenFileNameA
shell32
ShellExecuteExA
imm32
ImmGetContext
d3d9
Direct3DCreate9
ntdll
RtlCaptureContext
userenv
UnloadUserProfile
bcrypt
BCryptGenRandom
urlmon
URLDownloadToFileA
rpcrt4
UuidCreate
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 918KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Titan0 Size: - Virtual size: 15.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Titan1 Size: 19.4MB - Virtual size: 19.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ