�R���� {�?���<��p����<�r/��&(�b͢mA������U�r){<6�֘*[�����%�E"�/-��埮�7�'���k�xG5x�����0�ax�}�p/ T2��1��ڀ�Y+��NHE�6tM@���T�M��/�4\=$Q�4�����v4��]~ ى\A��������Z��ָ�S���ͽe3�+��2Xz�<���$iT���o0F��Pd��CN�<t��2�ſ4n�7��?_�����+�$�p˸[K��ѮU��k'�L��e��hi鳳�X2�I��8�X@�IX)���r�Z�=q�e���ʏ��!�� G�K���h���0F���P����d��4%yWx��ejgq��F��7 ��@��>�5iD�Z{GB?�7�8"|}�*�g%,ɿ����L]t���m������ ���.@��@l�˰j�a}ig>HZ�$�[6�p��V\b/Ë }�ٔ�S��A���ٻ�K�<bf������]��5�F�L�(m �hM滲�����<12�҉����� ���USv�O)\ ���>����6ۼ��8:��O�҅!�BVq~��i/4�������b���e����*����e�����c�K|��U,��7�A��Ř��Qv_�r��]�O�$qH�����~ӛ��W7B">F�����m+��MS����W�gtT��W�h��������p�z"T}co���`���\N�W�4���.�( ��q��d��;���4�j���xb�>b������#_���� z{��8��@��W(��&�j1�c�f��5�̎��B���(�� �e��Y$RB%�����U���Z� r��P�{�k��@ "��$͟j�m6���t �3ώW���¥���gZ�~�fչh�����6b>>1>V�ۗ's�.@�����y����2�Z�b�DD0��<m[��o���_hA��Gehd�c*�Wd�v(L8�QyF>c���c���N�998� �\��4��y;�����(~���e㏺}�A:���}���*��-7Rs��@�����P�� 0`���!%'��9ۜSqy�B0��y>! �KI ��Pt��!9Uy��swZ�g�,Fg҅����?����Qp&M��ݿ�=�<�\m3�ȶ�Q�<����Zr�^NQ�����K,~�Ld�KBk���H�������4|��0C2S�P�����y{l�����(�o?4>�Έ}���e�H�V��*�4R�@{�P��pY�EJ�u�+Z����0%�5�p3��R�%�%�=��;� 4y���� �m��V�2+<���tc�%�(����ǔ���+�Qi�Z*��QX \վm�^^��p�Qɨ�rz#�zs<�h�3��V'�j9�0�vV$W9�� \o�������RB@��+3u� S<��<�L=\������9�7�!Ճ^����$��mj�k��ҏhus��bM�g��$�������s%=D����|�y�����{����0��Ȉn��$4C��s�?Bv��V�m7�ф����� �̾FH�0���� 6�1����Q�K�my��պ~�S(v�r�(���xA�(�S�ƴe0��N�BX��hϴo&�����K'k�|�#��0�vr��Q�E80�R�B���sV�3�W�c�Nȿ'Ғ�G!���0ߍ�p'0[_p!�Rރ�u�B(N�"A���F��|o"w�����w"�w�ʃ}���� {.���Q�\?hb�;�ǽ�3�I���6�vO�F#.�{����B���(���]t��x�0#���@>�}� Fv*��Щ9.�p�Y�Z�8���q�G���,�yt���?�|��;Ʋ��eA��h��R(3����jo�pX���I�B�1v:�/,*�ճ����q[%%u�'��s�1��V��-<��w�����LR E�X��������qG�l:YMi*!t���%�E����1�h� �L�MɄ��~�_55����_M���,q�!���n�x�6:��z�سG�S����c}Ð��66���IoU��gQ�F\�d�E��Nk�<�R�x���V%�J�~���< ��7�w����� d����f�n3����ۛD�[�`4j�\�:t-���G@�g6�2���XS7g�@ ���� �m�펜h�r����A�l���O�T9pV�A�3#�!#�ݨ��/�������f�9��D�6~��o���Ne�1�i�/n;������Y��b���{����Y�e� ���Z�+�nh�Y�^[,W�o��$Ƚ���k C��C�����p�ѧ� Û���}�Rq*bw��Qk�j�}���{�ғKMg�gJ(��Z~���Y���Ie����&�կ�9Ys���ھ��Q�>R^�$fs�Z=Tq�dC�Ym�(���+�����V��&�z��z��p0�b�.�h��{��b29��W�E^���Y���X>��W�ܭ�t����H��{"�2�� h3ԥ�o \�:���D?�W �����#/f��ZA��WS��շ������d$�JI���m~ƘA�� ��6 Д��"�2 �B��o<��L��ġ���k]X�B��a�6���Z8I�:�]��Яdi�nl%�dޛ����"��#l��d���CY��Y��O'�$k��T�U����4'O�SgenԆC�;�k�4\��R�x~�0r�wR�Uǫ ��n�-��-:�:����g�t� Hc����\��n�j��"�tt�K�s��g0>�`o���r�\���!���S�s[��� ί�v~��M�� yީ3z�<�b�_t�U�;S`����L=茊��x���b���������(AP���!�������� m�Y�hh��R��*�|���v�3+�c}e�*VUGq=�Q��IY�C�`�65�s�%���y$���y������ְ�{NMҶ��=5���]�Yd�Q����BD#�ps�|3���[�x ���@tE9_�������9����x��/c$� �G�3�`��^�a����R
Static task
static1
Behavioral task
behavioral1
Sample
2d6359003cf90ee6aeabb1197cc03b7ca7a6cfeb197a1940ce2e1abb8051f8de.exe
Resource
win10v2004-20230703-en
General
-
Target
2d6359003cf90ee6aeabb1197cc03b7ca7a6cfeb197a1940ce2e1abb8051f8de
-
Size
5.1MB
-
MD5
4d2445a43591d041cabbbf3dfca6dfbd
-
SHA1
c847ec1db5946612e5b61e56cdc37d869666d359
-
SHA256
2d6359003cf90ee6aeabb1197cc03b7ca7a6cfeb197a1940ce2e1abb8051f8de
-
SHA512
fcd4f45af058d6f7ef69c60b28c2d880e6b557b44eba4c9b1da98115edb03d8c94e31dbe75387afacc0f776fddabd55fcd76ad58c6d04ca173fc4f025eb9a660
-
SSDEEP
98304:dceSjZDfU13QJ7PKGOSPTCncrr7IluZYALl8cXypK6YZ:UU13MhXTjrr7Iw75Gm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d6359003cf90ee6aeabb1197cc03b7ca7a6cfeb197a1940ce2e1abb8051f8de
Files
-
2d6359003cf90ee6aeabb1197cc03b7ca7a6cfeb197a1940ce2e1abb8051f8de.exe windows x86
179d4249606354216d00397210be5d46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadContext
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ