.���Em��F�-�C���p��G�'�N��Jh��!u\��$��`~!ܭ�s��s]=W�q�H��y���#H�H�+.g&�a�{B�屁���T���w:^1�?Sʱ"oz��,0�[5�}��H�0�!Z6X�+;e֍�7�Zq=Ry����ߚ��줲�-m���eyM�l��b~7�SZ�}�`�/�]N&��䩇_.�g^h$�m����-�t5�k�=�dR`��s���yDy�W�yM�G\\��x�s��/�4gP�FĦ?p��k=I�9��C͎��� ����&�q�zd PE�z^�a�Nh:���q���îɃ�O�{��zį�;����x=�˃:ՀF���͢�kT�9�G�f�b���g�㼝��Q�4�E��3����z���P�� o "��C�*���d�� �Z��S�90���ݳ�l���yao&s� �/:��1zK�$'��wB��-��+���UԔ�(�"[T����U6+�}wCW|�� S�7Х�kڱb��ީ`���3�7MO�^�ug�Ň�������9�2!��g�:A��>P��p8�b��a=��u�a �͇�I���w���Gٻ�u���u!u1��T��wh|uu�t����rO��+S'ϋ��S����R�P�V�����-1@���c��i�G�H��sEsu�|3�1`�-ī�Y���mr�w��r�-�(]:����R�b_�� ��͕�23��8DL���Ɨ��V~�X�1���۴�xPg,���2��)�k[���o��{����~V^�JFDW�y� zg�=�[���DGM�!ǥ�/~aنiy�Xiy����V)�C~�7�N��S�n���'� KT|��k5�*�Ѯ�0� �<�.��-�����.��9���Ik��J+w#�,�B�:�^��eDp��<�+vb�^V�� � �p�kO�� �BR��I���T�1�Ψ�;#X�|�0�(�.�Pl ���H5.��%/��Em ����P"-��u�t}���+���g�mS�����rg(r�A��ekK���6{1ȶiN�6V��G'��pIf�/����0wz�.�r��By1���*�Q�t�SX�q�`�R)bi)�ҡ�KT������w�y2���������!�}ư�ϓ)�/Q/űv}CY�o����� ^^�}�d6> �|Kv�6��c��qN����Ys� wҧM5n<+�N0�<K9�'ႅM0ZV�%}@���N�v�1��t2+��'M�+Z�mB�}�K���.��ǝ�0m+E)�ࣧa���_���%��q���Y��]�o�|1���յ�����g�Ja�����3���t�nh����+� ��8�|���#���N��s���M~bd��� �'��e�q�*����������h��>U��� �O"�-;���,a ᄏ�cX�[�mc&|�'3kD{�� ������ίGbv�Kχ;��!��J���������D� ���16$�# �L,��ry����1gV�����,W�kx-�J�ܗ���C�����/�/5����r�D�ʑ��%��Wi���;R�)\�x���j �W�ʻ$���Q��ª&t缔�Ɓe1�FC�H�(����0u��ESj�Ӛũ�Q'(�&���@aT�(Rw�����L,$?�+-�(b�^w�:Kg�`�)�3l!�i~K,1�W����aC<�SK��?���ncA�r�ia�u�K��\��vw�~LM� �Q��K�}��F�Dk��tW�e�<Ѯ����7�V=}�f*�a�Ʉ;cPGG�L��4��2j���4e)boq<Y=��q�}1V��F:� Q��zO�'͐������Ų��J��|�c���V~�eMΫ�):����罭���l3!7��2�m��rT!2ߚ�?�9 �,����"����R�[}%��2��Dڼ^���0HZ��+��3]��}�~��E��]C(H�����}��9K��^��Q�B��`K���)�����Ӽa0ΐ�z֨���n���c2)Q����v������ݜ����8�����s5(��s>�]{XNp0���a�����,b� f�����Olz�J�p���nu&1���R ����~���l�#~�1�!v�,-�1hI������Bv��Mp��ZY���SC�.���%��(JQ���{KBp�.�&��:�fGaDwHc;�s������]�>� �X|���e��a?�U �Ǽ��S!dd\�{���g�����8G�D`����������a��"�_[d���%ު��i:��S]H��,��w�g���.M.�ǒ��76�}��۳�f3״0t�A�u�ی�ں��������40xs�����sb\�v�6���E��'�%Zk���Yc�t?��Ž<U){e�Z�{O$�z��9���B%�[�Yes������7���_����{5�*n�(ޒTQ��#ʤ�v�3_�rIrm� �@f��>�ć����� :��p�`��sy�J�>r�E�ӵaD�K#��Z���G�mR�ܐ�f����V혉O���}��%�W�L�n��ʤ/'����T-�9�}�|��W�J��#�p��QAû8� ������-�͚@UɰD�EN��A��z��7���O��E�t$DC�����;� W���~��X25����Nǩ` ;�,��E YDx�w~�OP�:}6w��*�d��}d��Qf�pd�ؾ�� �K����'R��Cf,��o)�!6�1�!`O�(I� ��N���曳-"�:!�>�ޘ�6����7�Ӷj�@(´-`�-�NFL�i���ޑܣ�q�F!PN�������y��!��X�T��������W�t�%���h9`�=����$���j�?��3s�Y�8�� H͖����7��RA�C�艝_��=�O���u��4����� $��y����-w�o2\)HU-��DN�1XS�U � �TY��L3��`���EM�y�钅�.���ؿ$�@J1i�1� gع�%~��'~��_�Q#��K���8��-P�|�����-�jy�]`y�-H�!�^�v`Tf��Cˏ�q'!B��uP�
Static task
static1
Behavioral task
behavioral1
Sample
c768f8f0898caf0e32ef1eec3165f7702995d6def434f290616709cea2f43364.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c768f8f0898caf0e32ef1eec3165f7702995d6def434f290616709cea2f43364.exe
Resource
win10v2004-20230703-en
General
-
Target
11196416126.zip
-
Size
7.1MB
-
MD5
b81bf742144284872153c77a493ff797
-
SHA1
e199f8ad1db14b34f031b8f80dfc9123cb94c1e1
-
SHA256
ffa7230edf0ecdbbc22144e73130e67b03f34a3e3cbf9a374f4003711166cffb
-
SHA512
f2a037cde2e43ae0d64318b9058b363a5fcc846c345c2ce218d727bdb71551487d22330e5049808df59340aa3bf1d2f1619b34919391d9159eef3ac5a158b2a7
-
SSDEEP
196608:RAEX5ZDH6zY/huJzRdEK3fMPXMqKq+yk0TJB8Bg+zPQyd:RAInH6z8qgBKq39B82iPFd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c768f8f0898caf0e32ef1eec3165f7702995d6def434f290616709cea2f43364
Files
-
11196416126.zip.zip
Password: infected
-
c768f8f0898caf0e32ef1eec3165f7702995d6def434f290616709cea2f43364.exe windows x64
ea02d5cc19e71f269297cbb9da4a6c49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateToolhelp32Snapshot
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
SetTokenInformation
ole32
CoInitializeEx
oleaut32
SysAllocString
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 895KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.RCp Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
._*B Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m1d Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 521KB - Virtual size: 521KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ