��S8��ط��j�ʔ��B�����T&p\_�B��������;���29�Q�5PpS,�۴C��@9��~� �;��`1ak@� ���t���ab�4��a�t���ך�.���U$X���`S��>� �p�m����Id�ܠ���ȥ����L|N�"����|��N��V�N��UᚵE.3��/H�K�#kT���!U5���$�����68���(=�t<��@���Sv�����WQ������,���l]�*�~:����1��h��ȕY·Ւ,��1va�~��#(�+��<��~2��7�z]$�R���6٠]�$�3�w���$�.�G����s��N8 ;�nzu!�vt;�����Z�3δ��P;C0��0�Fo�o����# �V�Ж{�Y�꛷�;�DLSr�_�8��^iI�F7�0����֭fp=��_Tץx���1Y`��J�އ;�+�C�B�*�ȉCt�3�T�;b{\�W�5mLʩ��I�Z'���Q���P���}��d�M��$���k������M1�65b+�+�k [�E���xNltJ/*;��b6����v/�)��YY+�hQy;O,�<���t���UU�A>;���3�V�m���*��Z� �2�ջ�En�9���;f;qTa�G�� �&�,O��uIpqx/3Ĭ�2d�i����Ê������a;r�p����f�g/�d~/����*�[���w���}a� ^!��^P�xj~r��F��@r�+4���3���$@y�!��5��3��3è��J��`7���� �#�hC�҅�ヨ2N-��+9tN��L�h��l&�1s=B[�h�Z�<`�Z�M�1�C�L$F*g\��*]l5�����%�嚩�ױ_��aog-���Ί/��o����PG���s�(�9|[N}��)������]I�zى�Z��̝��+7֑�@\1��M��5n�I�*���� ���᳃Rz��@�:B]SOhF�L���Y�v4<$�a@?E���Ks�Z���u�V�Џ1���V�d���S����_y������s���^�B�G��Ǣd���]dX�v,S)�8�aEF�~�� �b�� � P����٨O����j����)%���]C[�_Ҥ�w��'??�s���;E���#{ �vw!�)�iP#��˿���E�@'Tm�A߰����� ���D��Zp�4��$/��(����d~q�����/B'��u�\�I O"�!���W�9�B�JS����{�m���!��������F�[��f�n)r�����I�Zp�9^',F�é��ب $���2DRh��Ȩ��O��D���8��GJM���2/dBl��ow}�j�Z�σ���k�J�ooA%fӋuu^j���W{�1~�OJA�*� s���"^Z���o�v��'�d[ � { �R�]������*�tozuLX~v6�cy�W CX\ ��>[66F݉ ��!���;�İ#��15��U�Gr�߂ojUI�[�/M|����J&�r�W-� ���WsP��"v�jf�4��"8��â����u' ���n#h *Z�����g'�A�U}ƒ/1�p�Y4Zn�0X�-��N`Dp6Ä�� ����%��<�<�W�q�����J㫈�B,����8�W�' ��l�Ӂ��͊���r�eݑf1� ���I�Iy @�)]��*�,��4^������O$��� V߸ӿ���n���݅��u�-�����85�MCM�����!B gL�����r�&��)�o6���`�+��i����V�|�})IP�Z��k��j�5���q"�}���t9b��7�|S'�,ӫ�FX���n�M��ۚvc(n(��~�5�vQ��M�Z�M���%.V��������F�[.�Zݹ�dz�J$��9<{��[�S�����e)G�_�Gq�6���elP �k �<F`d0)1XG90f��G9�d^GꁲA�����5�f6i V �@���6�v��[Rb4���be�pFI�]>C� ��z�k��,���� � ���V�F<9M���#���=$L���Fh�jNC�8�<�)5sv��{�6��<�X3�~}���9�����4�aG/w��g���~({�ĈA�46R�K���EN�ζ;˛ۨ ��z��P�7���-�ȫ��(��?�L�<��0�I��,$�q��Y��J2���Y�P`�O� ��D�t#�H$�r�?����ޤ�艷�m��R.�**f��h~\r,$8}�tu�<pt ��>8+��r���U<����yWc�W�\'9"�O&=N���q�G�m�26�����`�Hc�`\q�W�������y�P1M�F:G�7)��0�%���(�{R5Q��`�#���&^߬���f��,Oa�$܃��l4Sx�l�/�?¹�?g�^'�"�\�Wt��!.$�O�5��=�����o��Ǎ���� �㒍dž{�$���A"t1܈4�z;{}�SS��x1y����-������� �O������]� ���{��iCM��L��Î�y��9^���`Ta˥"�%[j;KD�Um�����^sz�$��1`��*��g-��ئ͆��z��w9h�of��흅͛z���c��1�]�O+o)qm*����g�st�?W�ĉ@y�����\{}`�e�tGy���8���h/��������|r��3Gk"T�*q# =}�B$����4=���î���a�N���u��WB�6֦C���Nx��f�k�͑yN����|�|�uC��P�q!���.���� �=,�CW�9�Xx�*#��;wޛt�T�c�M�U��˿�G���������V^2���{�@5o��L$x{�~_rY�;��RN*VU?���5\����Vӡ(z�ߏb���z�O'i �RO�A��h��2�a7�иkfs�⽕YY�oH�Lu��\7#�Y!1*R8��Z*]jn�O����t����i��0[@���d��rI��RJ�����R�p���������� ���CQ��7�Z`5��+��h���ݣ5�Xg��(�̸�'��︼'�N
Static task
static1
Behavioral task
behavioral1
Sample
invis.hack.alkad.exe
Resource
win10v2004-20230703-en
General
-
Target
invis.hack.alkad.exe
-
Size
8.7MB
-
MD5
34db4afe1a899b9d3669b3c7fdd9d9e2
-
SHA1
bd0abd361a0a14e4431b02b3fa4157c34e767c49
-
SHA256
bdd6e63674dd28e53576fedf56274ca4fe4e667f8ef3235edd51bb5cf7a793f6
-
SHA512
7cb11a884f7b2f711d083b8924b0d937c22b34ced1159360b4fb3e15e4d252c3b28339211e729c7d4e7a57f3f0358349928319f5d3f4c0f490305a4c68c875da
-
SSDEEP
196608:RPM3B1ArF4JI5l2pGqX3mMYJO1NDvXiwiqywbbyy10d2dr:RPMR1fI0VndrSwnxHy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource invis.hack.alkad.exe
Files
-
invis.hack.alkad.exe.exe windows x64
4c32aa3603b7963d9f377903fdc0f470
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapDestroy
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
oleaut32
VariantClear
imm32
ImmReleaseContext
xinput1_3
ord2
msvcp140
_Query_perf_frequency
d3d9
Direct3DCreate9
psapi
GetModuleInformation
wininet
InternetCloseHandle
ws2_32
closesocket
ntdll
ZwUnmapViewOfSection
normaliz
IdnToAscii
wldap32
ord50
crypt32
CertFreeCertificateChain
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
a6X Size: 752KB - Virtual size: 752KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
sSo Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wu[ Size: 75KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
m!c Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
8zz Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
YHJ Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kO@ Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
^1s Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
@GM Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ