S�)<J����'�q"�&yb��ǭ�+�O>`����5O�� q��sN�ŗF�S7�����@��Ĝ�\Ԧj�|��7=���b!�C�����L7a��q�l���-%��H�]b���Ů�*(������ Ǔ�-ID��W�*4ܞ:=p�Dj���Ǥ���uߤ�5��&�^�D�����5�{���$#�y��rt���v�y��c…qf-&G1|��J�(#���e;s���MU-�6�Uwpp�)n:��o,>�ȤpYq���Bq�SE�G���7O�>�W�S�fe� �bU�M�$Ѽ��O�v�rf��y_���K������s ����,0�-���Z�J��Q·v������j�aen�<�c�gt�d�2�:pl����f|�����I-,���l�Ý�)���<�L��w��%g���6�u���\��4��m���͔/����F�"�������P� ����X#��b�y��ubpŊqT��e�r���i��O�<��K&\���-����\,�������\���{`'���}ʹ������y�KnӼe�` <��5���]�+[�%�y�a�g�oz���87W�<0��Ċ.���~h��x]�5��0��N6��m�`6K5�#��x�(�7C}_B���.�������(��_��(!�n^"��$?�Gj���l)�lQvz����_���Pl>%-��l96��������s��~je$�����ku0Ku �ˆ ��E�����~��-������=�ތ�:THaKtpU�M{y��|L�j�i�>�8�O�=8m���������z)&�=����Q�u��u��<8��;{�E/��JX?!����x5@��$��a>��*h�n����&��@������1PO��,�L�=fH/�1r�a�Z�:��G-����ܕ��k����/?�*�Ka�y�=���*D �,ɼ�� �=�D��E���m�Ր��/�Q㥂6"2��ܪ��/x�������n��A�酇BT�o�� ��5�gB����5NiF6VZ�6�i�2��}"����5_F&B ���s�7��~���۩<������=�'����a��?�~�Im�j�O�qߪA�+�[���[t�����~���������A����1����V}Q��f��P����(�*˩��ɑM�� 'm�K�Yi0�!��M ;t�C֗�i��r'���-�6�I����`.y�炬n�݄� �Pf�2���}q���朜��?beR����r�ĩ��,�Eg��iL�Ǻ��D�}t߃��e�O�� "<h��ɛ�u��Ȫ�g��~���������K��<�[�x{�7!!�H]�P���h�,mA�:���90���6��F,�M%PSs�������|�C�u�%�lL�P7�F���M���Qf[��|�&�!$�Q������"f<��;4B�~��z����=�E�P�b�T����5�K����So�6������?Y�,�5�ZD�O& ;�@]�wZ��_��C�Q��%e��!��L�`J�����P�˳H?�4(�3��y�j�W��]+nDŽ Gp-��7�ef*uPU�iH���!��8^���O�[�%W ������w~�i�(i9H�Hw ���� l����F�͏M"�,��$��5C������h���?.�Ζ<��U�٫�kѼ5+D{�K�6�&>PՎ�t�^�gtF�7�<k�O}���]j7|�e�{��О�F�G��K�e�ӱ�?2|��6�[]~H�ꕯP�������-+M�9ms��%`��G1yl�����zWF�~����T�I�$�t���I>������d��)\�^|�!y���@!�~aT���_"��}����۟e��a���b\ix��xm��#��/Q@<S�~a�F[ǹԝ_Q�yC�㖤d���L�œ7+��!����"�o̢j�j;a������o�4k��j����s�%� ̧/Q�wA��n�Jx#Q������n[�eR���0�z�T�!�;jJ��1��P�?���q��F�����/�-k?H�/��$��h�r��-U�h�����Xk�53>�B�I�f��J_T[�wZ��)�Uy���<�E�H^�8��SkxC� �R&���jMz]e"���V��5��A�5��V@߅�u��i�������Lo���4��:7�x� �Z#U#�;ېRH棈/�>c9&$v�x����)�3q������V#���F�m�$�Kc�K�=H?]��#-���_: ���̻�hu��&��0@�1��"���#D���K~X*6h�1s�"~��8�g�$�tv�ây��]q�L�����T��*��=�����;��G�����n�N��Z�?)T҂B�(��6��8#E�G�}`嫂� �G��7;�X �e4�xi�6�t\G�_���D/ѫ�ʚUPzJ�Kz�1v�e���9%I�7����0i"] �����t;4��EӒ�"(�{�+�h���5|�q�r�<=(�Q�V���[Fu�?��H(�m��azX�M��06�pK`OxO��H�L �us���� �a1W2U;�Iҽ�VR��9�]4nLj���S ��3�D֩8?�KyCZ+n�s=Kn+�v%�w\g�j/�#��T�ݙC����$��ه��̀� ���M�8�G8��>'�ͅ�Z{���3[�X!��u�$%�����rj���6� �����t�`�w�e=@ۓq��T�B�~���eXU���*�:��v��?��t������@N�Eї~�gҥy2�A0}�ld� {W���d[N����������pA�o:;v�? A��}uo��\l���HϤ,�|���H&��T���y���F���YA�V*��BzP��ݼ��?�?3ܯX���>��n��� 7�q�.���2A(yߛd�*�r���%jK��=A����L�1T@}x��`0�؆���%�[ǂb�E�`=YFg������s��`0��',�gN�o[�dk���Q�`��X\��U}�=�0,�WM���ݶ��"�2W(T�� ���\�gd����L�M��.�@�F?Q��tݽ�G
Static task
static1
Behavioral task
behavioral1
Sample
V186MPJt3C.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
V186MPJt3C.exe
Resource
win10v2004-20230703-en
General
-
Target
V186MPJt3C.exe
-
Size
6.3MB
-
MD5
f473aa963ae9662fea0270448dad3379
-
SHA1
a42013a275c365f0a5c066a2bed6b861b8888eb6
-
SHA256
3d5c6f004a3fcb6158d1e6398368003cb3c46df2b72d74af40ff0607f97a8b54
-
SHA512
5b01d79a360515e4bef0193bb0fb2d7dc85c485812a978becb3afd423ad317edd46430f6092cc875f056059107d535725c2aa203efb35ce0193886dc00ea7c4b
-
SSDEEP
196608:e2Ol6jzK24sfDsfEuykEG42SeFVJRruiBso+:eKj48D+EuynGfnjzui+o+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource V186MPJt3C.exe
Files
-
V186MPJt3C.exe.exe windows x64
2fdf090602e764ca8f9cdb2401a5c870
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
CreateProcessW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCapture
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegGetValueA
shell32
ShellExecuteW
ole32
CoInitializeEx
oleaut32
SysFreeString
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
urlmon
URLDownloadToFileW
ws2_32
recv
ntdll
RtlInitUnicodeString
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-math-l1-1-0
asinf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
���):� Size: - Virtual size: 626KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
��.*��� Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
<%c����l Size: - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ҿ&�ͷR Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
��D�_�m0 Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
�y��S�y Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
�� Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ