���T�q(�J�j�l�뺨�u-��ֵ��H@��'���G�o��%��n��7�F��BME�P�Y��4�^#���������7�mYfO�����tl�@��k��fu��D-�d4I��C�G]V�� �<e=E ��"$F]����y˰�V��o�,�sNc���蟦�ظM�ҋ:1[/�Ժ}�,���+�o:�z��^�8D�p� ��l#����K�_뽥�}��{)��^jˇ�B���Vy�$�2���c����[�����^���:i�y�^6K�{XIϴ�(�Ҕ �իŘ #F������VK8�C�X�O:���O0�[S���������Np�\�|�W��1�#��ڢݯ9�o�#��%jFb�(�dQ�MbHg�t��ה�� m�B�`����'��88�8���?�D&���ՍCj:����4+S���neŭE���Db�1����&��� 4��[���}���������QwJ�����OY��8�erO��m0�G�ri���4�~h�ٕY���i��jJ���V���Qw;Ψ�Ih��v}n��H��t�&0�\�4>]���Y�����h�j�� �O�y�K����Ǵ�U�'6����G���5����V�Y;���&�X �7֬r�O��M2�-?<�JU�Lm|��+�ˠx�N�����ʶ��p��Q�{���z�8(���Y���v�h=�F�O�u�9�&�� "��=��z�ͼ� ����=.vJ�!��t ��6���)���O�Z��;p�t^��>�=�(�}^�!��n ��~�tɎܹ����nLK��������f�NA���=/Oi��0��w$M�][�8������ĆHz��d@h�g*��I3#������aT� ����;����|���U[I�3�"s�����c�o�P3z4%g��8bT�&qs�jg+����D�d�o�3RVXQ?�d�6P�j���E�:��@+'�4D´쑗}�ՑY��d�wF������ƶ��&(���9�Φ�{я~:�*�\ m��;�5�;���ǚj��̊*�a�y�k�0Ͻy<Q{��^0fa�z��Tt 2ay��������������~~�?� l+$�4�S��'m(u[��\Bcz@�lr�����翐����7�?b�J�?��ݓ�� ���Z9Ȣ���v#�RC�w�|�y�e�-���A�I��ҘIVnl�_�%tz������Y!@��Y��"{-����#$�#e�$�P�PBjOВ8�T��]i����a$PG�u�3R3��K�1�O`��+7�N���-#�~�_�<o�� .�z�蘇��/BJ�k���U���g|~���A1Z3�_�����MǦ9\� �h�<��Dz��xVC�`�l�~&���'C�g�_��6pW�2�mk���r�{��"�{n2��^��2 �kB}�ѣ�HM�;��[�K��� �/ }s>�ůc`!�ըo��b�=��(U�64�������*�v(�Ml�[�F 2��kF����j��)DZg]����C.��~��1�C���˪E�h�r-V��_���^/��L��#h���%���k �Ԍ�5K!y b���h0�����p,fq����s�{A-�g{���Aq�-�x�P�Ľ�����<���Al�����K�~�^~��s���H�YЋ_ۭ����9�D��XP�h��2JAPj� #�F$��l���<Jg�8\�P�@��\ʭW�ꬋ�����Z�%���'���u�=(�T�8�ӭi�Q��d�p;�A�p�� *U��zu|��X_:$E�ה�x��* �D���!�&�GS��n�ġv~@��i���B���������r�73�a�̏%�c���_�_�A"�⫀)�����'kN��(�����/��ӎSJc�:�x� � �Z���ǝ���� ��rE�5z��%t�@k#���z�^3p��V���r��H�ڶGaFڽk~���*nޠj ����+$bBF*U�2w�� $���I�9dɁ�N]�Á�d ����Np����ޯ!�7#���<a��9����x��A����t��hN#�4 ��&�Z����#�9��89� ���#��F]��1YtՈb��렁��qړU ;/$FPA�EU���F`sr��� r\v���E��Mò]��� W����Q���hHa+�7܅m�s�ӠfW�����r+����\(���<�"U<�D^GS�������,�k�ވ���,��m�`>���s�ݙ�$���XVs6:Ŭ��t����:N�zp �B�Ur��:M�&�Q�A��k�X-��Ǧ��5\fJNC�w�V�����g��vt%��Zi�R�MsnVlv�`���?�.[�M��nw�A�5m��أ��1��騞��pa>�I�~n P�?��~x�F�x|R�Fz;���0��T�'H�]���`���~R�Ia;�ũ'�na�po��(�y|��Ԭ�s�&v�B�w��~s������kW�A��o8�eK�'L����"J�">��q��ӱ˃$ ��`���1Z<���� \Ye�����|[}�m�b�|�Z?�y��#���.�s)�.���� &D*�� �u�X�9m��$�em��(�.A6Do��1`$���6��_�68@%:M`q\��XnÃ�I�0�7�2k�$�p`��ႈoه���Ue�V�'�� З���u�V�^�)�C/LdX����e�1C����q���{����4�1��l@�,5����'�k_�B�l%�n��6J�h,�Zۭ�R�Fr*���������^+V�x���R����r&}�#�1��4#� �pc<�4� q�U�?p��U��([�P�C��p�t��<�ջ�t�\�b�x��y��� !QℲk:��4[+�V���.��Һ|�SE]VQ��z�c���ޒ�Q��w�E��)�3��}@,nq>�6DτB��Q��A��DJ����BZ~�H�*M�n�&�'Vٮ����ҸE_=���C�H��}�Ľ9D��Hq���l�����s�$�1F���3���=���� Sr��qL��p4i o��5F�m�`{6�Ԑp��Y?2&
Static task
static1
Behavioral task
behavioral1
Sample
BadwareUnban.exe
Resource
win10v2004-20230703-en
General
-
Target
BadwareUnban.exe
-
Size
7.3MB
-
MD5
13711f7923466b3c6e831d8b3b4eda5f
-
SHA1
25b8eeebdb6f94de6b5da0f3c27e614c7418fb98
-
SHA256
187fa5426343debd5a837b3d0a6c0c63212af942d7fd9b8108278f11ab723b45
-
SHA512
8e3fb7261eb54e459c97d5037ed48df50ee897733e48838df6072c2daadb7af257361d32137a905b0a18546d9923e2813a7b069d243c6d9b83f3b7fdd9b0c75f
-
SSDEEP
98304:FLlGdXlZvLx5xlFib7ttdoUNAKCCW9auiO2Xz6wJjg7pyU9RVLuLI0Jv2knTa3T6:/GdXKtniK9W9aiizW937Vw1ejdyfv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BadwareUnban.exe
Files
-
BadwareUnban.exe.exe windows x64
7be8e9a27f8780f3afb75dfa3ef05542
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSASetLastError
wldap32
ord211
crypt32
CertFreeCertificateContext
advapi32
CryptEnumProvidersW
kernel32
GetFileInformationByHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
CharUpperBuffW
shell32
ShellExecuteA
rpcrt4
UuidCreate
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 784KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.3o] Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.*RS Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c0c Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ