zLؐ*|��H�Dĕ������� �Ć�1��%���=g"�I&{Xb�{���*����M �#9��N��`����#��k��WW..~F��=��{�{u�0��!���E|��$y��~�&����^�.L������uvI3�`Ϊ�/Ns�Cn����k� ����<�R���WY��9x�Mz��"�(�&� Ss��PǑ�L�.�MA���U�g%+V�[Ws�1�T^5�Q�7��/雷�!�����$|m�QgWP%x�,��yB�\�5P�`n���'tw��> ��z���Z�=�Hx�S��l����s�@C��A8m?Cw�I��d.�ra�i����-�@Z�A�0�O��A�e���8f{{��d����~;�����eb��'��̭j��H5D&����>vl������������ӰH]\߂1��H�`]B��J���53唯�Jw��~���}_j��6����KL�c��+t�- ɚ�f�j�@*��T���{H��Y�嶑�e(�닂����g��EϷ��v���V�@x+��G ��*��J���m�'W73D~ ���_lNq����?v.~����I:5�\oF ���7����B13�=���s�i��4���7��Tt3�����>D�,���L������s���V��pK�'_�73i� ��"�Q���T��E����,3�U:�`�Q��+�0x�n�O��Þ>�!Q�v��e�1����c������q0nU��JJ7�?�h9�v�X��95����f��]�i<�{�l���}_C����b�fy��W��2��ה�,d^L����v[)q$�����S��GȻ���Yr��.ڟ�x03��鑍��p�T�a]Ԭ��S������؎QM�ͷ�8��&�-Vʤ]�gI�s��}psJ��n��m��9��8ɼ)����l��)X�C���ʖ��/K�j�j�5H��3�� v�I\����k�aVAۻ��^*�k�}t|�?���� �yX+i�l�*gD�5�F.�I#J�Y�J��`U�s�ي������+<�� � [����`�q��Ap�;۠Uz��o]'p>U�3tolD��h ��{�_���?�����#U����\�2���H�eP\�il^���"���ϻ�����(;U��2���C��pa�KR�rFte�����g���� �2�>���nblg $�ɞ�F��d���(��[�Qro�JU�j���t#�������g�����]d5���|5W* 9�_{�� q��u^�M����@u.��p�}�W|MP�T�͞�b��N&oFqqz��ђd��#�>�/o��b�A�F~�7]7��z��|)������L���FHMG1��[���mt� �*gm�0�*h�p�If��aw!�3P�z�z٦ۯ�1W��U��v�dF��y-���5:��\��O�(+̌2�Դ�674M]�7g����@~��dW�"J�*p�,N�K�<��(�]�}��F�����п��7\���o���C^'��)�ޔ��Ց2�MA�8�V�ח��@�l�����nC����~��ƫ����\OZ���_=A_�;5q���YNh?�i{G���Ti�����#��Tډ_�2��ɏ_ʉQ�JY=��i9k\��͔�Z��ƅ�y�K�>rR��$����&�R�����I�js^�7��pO�I�R �Uٗ/�-��|����G�w^�>XBE���� U�B�7�E�3����j�VOs#P�?)�Oq�m����KI>�Q���DI������������[���@Ձ{� dt���L/TR�_7VW�Hf�[�ޓ Hغ3M�ʗ?�ƜȀႨl�NjW�*�_����ٿ�]��h p�&���:Vv`���ް�H�8\=��E�}�1\]��{ӯ��^R���ӛT����UgiT ���-��@7R�3�mSϋ������W���gҁKc�4tP�z���P�A��"УW��J�۠�,���V-�7��>��^C�������l��d}��C�1�s�l�H�-� �|�倈 E�5+�t"X��a]@�?¹��y?�c�������Uzd��<]���]h?P���U@��A�c$�k�B;�ma�G/��sF��,�clم]Z��Iw�!k�l͓��Q��:z�4B�����/Ί�cs�I죋����zy��r4 Dn������3W�A4t�`W���c}��Ε�{��;���s�Q&M�Dv�u�֦1cZ��J7 .q-������������\"CxdUuDo���C`��G uP��~�:�oko�`?+N^]����;�[���4&F"s_��!���J�|�CQ ̊5�[�;_��1��9� ���xr���+����l ���s]}��7����Ř�,fحG5��Ͱ̆��}��%l�n�C���4ԛ�i�C��u��?G�m}�R��>�J(V�� 6�Q�'�Y}�����}l�ݽ�x� �%��3˪��00����� zd�L�C��':���9�!z1T��I#~�r.-.:��Sih��%~�e����FQo�1�Q���E��T��6k����p��.���xa��3Z�VJ��_���_�9�F{,&W=�7\K�O[���I���� T`#}ʊ�Q�b��k��~�/6.�ȪD=V�<@���g�$�qaAo��{y �2&��#�'��n�1��(�q�c����;04����6��(]b�� Ǽp'<7�4����ǖ�ݏ�C=��d���Q���VR$���$��+�yln��Y ?��^(��ꠣ〙���$��y��,�t����`����� �uxmVɁ�ʜ��#��w2m���V�m�v5����2���P����-@)�I ���Ƈ���W�@홷����i��A����)WX!��-���;�=�[Ӏ�{����ij)q��+����-,�^d��'�$�m��J<U��wx���O+NR�8�;ƔWo��Vr�R�S뙛T�>�mg>�����s��'�plf��VQ(�1u���*� @�2�^���|�%5f��"����+����vhDj��@X�pn�0(�!7�S�.!t[QmL<�c�C<�7QM�����&���$D{��ҎQ9]��³qH�ĭ5ɷ�dLݽd�O�y��y"]�|R�C�`e�^ZR��svC�����T�Id�li���o�Jl�N���ZF���EU�Aao�����{��[�r�l�FS��$��9vk��džN6-K�(a����������-��?3�� ����ύ]�K���J�v��H�-�P@����̀��!��+.�#~����`�C+9*_������\��k��\T�BǗ�28�H���gR��KiL?��䉺sՐC <�O����\�(]�������@�$� �:��&v�آeMc��<�\��rY�*�i�w��!T1�5���v<�������9��ux�I���F㌏|�ޙ����7���#�"Ը ���0xr�v%i���/�!�\<u&���>!�ѝ� ?�.w{tT%�1�%����[���!��;k�����__;%�ݣg��G�ə"{��&ɬr�����et���,��^Hy��ԁ������䡋H�K��ȲV��e_t�5�6�$,>���)��㹜���r�'����%0�=�徏�
Static task
static1
Behavioral task
behavioral1
Sample
FundAccountingSys.Win.exe
Resource
win10-20230220-en
General
-
Target
FundAccountingSys.Win.exe
-
Size
2.4MB
-
MD5
060126a3ac51b55ff5f369a575ef4072
-
SHA1
56601592ebcfaf1d8f893baad502a38037bf23e5
-
SHA256
1279d2ad8dce49b7250aff32c8cdc3e261a55195bfef3daae04b0237abf45e5f
-
SHA512
ce954760ae15f810d95431120728168c5c390abe00ec09ac1a7c8a2679e8e68043ef613967b13279c40f861845a0d2a8d36539310af4642318d965181211ca62
-
SSDEEP
49152:nBaQW1ogL2CRlSZ6mPRM824x6SPRctDqtmbi6wCII:BLJy2CPE6IRM2x6SZM80
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FundAccountingSys.Win.exe
Files
-
FundAccountingSys.Win.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 125KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 362KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 207KB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE