F��IrF���$GF~#���.f��3+8���ޝ�ZAo���0��]o�&�/ɫ�M�u�F��c`Y#a}�kD��M� q0.g:$YQ�%�|!p����r���� z�쿂#~���$6��I�+��&��#ǀ���ʡ9�� x���g�G2�X ��C"}|�*�;Z�^�m�u�4 :�>� ٲ;���}��^�� ��� �>��;�����M��]����q�8x���R�Y�,�5�����Q��/Y[���Q���J�Pɤ�.����-��o��7?�8]<�r���ũV�yɀ�;���7��F'1��s�y�'�0EO8� 0����-�����Gͷ�R�E4�6�Y���N��>l�<�����=�-�,��w����g���x�eo��d/ �{��h�{�7���K�+�@k���W�C���$�MIR�3�)Z;S�����ۥ��^�Y�@���+"\�9"�s��0z.*K�δ��Q̸؝�nh��Ǟ�6�Br��5fqV��5A���h��w壱��FpIǾFe;ژ>�W��ppl90#3����U���y�m*����t���#J�W /1z�F����,�����κ;"Vaf���T�Q}������a�t甞�;�O�.c��,�yj���F��=N�Ba=N��g�崈܄-i �介j7��7�%�T��V}}��ʡ�o5���H���g8q��H�9ʄrn�nLC�ɀ�kô��="���L>�)$Ed�_�l��B�Y�Q�n��h���5F�զPQj�����u���?�i���i�B�f)�Z�sK���������Xu9Ў��\��QDZ�p3�5:�^=U�?Z��� Ĭ`�m��,_�X��g� 2����FO�-8)�T5��1m����2��c{?�} ��Zy�z�R��ai�d/���������d��*��\�ʠ��"`X������.�K71 ��TW�îF�˛w�jAlt��4���,\j&� �+F�0��8���ۢٿ����J�P'}���Δ�h9�hx &����^�ǺQ[M�Ն3�Q�.��K����x�9g�T�ɺ�KA��1�4�?u�PfN/���g+a���m'�2[������N,�1h�Ы5�Ynt��ʇڥ����q(�@/x��oX��eZU�0���@3sI jXH.�����YCL�&���#���R(�V;����gg��9�^o��hq_:2(,�<ß�����ٽ)䮞R���ivO �G���,�~8D��p���y���a�4/l�D�}�0�9/Vw@D¶� z���+q�RI�77��?�H�1f9x��q�|p�/�D��~&����F�M%�I�LD�9eA�?Wv�f�^|}KV[��na�<�q���ӊV���}�Yo;�Zك��{ٺ�� `��m��}�mLg1����ڥE�K}\��ϼ����&+�dx��������s�|����������wR�P-1�C���H�,��-�=�=��ր�sNNQVU�Ԯ�`ST״��:8��t.ؾP?o�'��<�2U`��A˫�S���[Å�?��ݴen��%�W�4pd2˧>�s��w(%d��[@�ɱ��v�g����9p��Y~h����.~���O ѿk�p�5��0,��A���n�>dW�id=�_$դ.�Ԁ���D̃�ڑ"M�^���W&i]l�4��=F���hC��i����� ����\�V�ܭ��p&s�K[�D�������OFd���x�uR�0��nUPS��u� T ���l���6QtaDLaFSo�$S��G��+�wd5"�O�P_s�8eZ7���p��ff��T=��tr���~�gN焞�\�`% ��Wi�fGg�Ls)S�s�Rt�`U��Y⯴��mc `��A�d[7���n~��Xgg �s����B�RQ����b�����)��z��.`z��x�t;x7�::.a� ҏ/���CA��GE�х�=��^>֮����f��%�Q��p�}iy p /� N!���~uĩg|TN��_��ANiE����tx� HXy��]{�#$��bSW�,ŮY�[��r���d+�;�<�~}I �� $�m���p�6\t<q5X����b&�I�`�5ѧ��{��/hN>I��q�K�r�.2w)wٜd���������V���o<Ƃ~ƙPb�;��U�%iD[y��'��?��i ��J�"/3F����T�<̐�'���%�;�;�'��)� 6M�E���"3vA%�e2�|��$�A����s�b��@��4���$ �@�5VR�D�����`;�DlEs��4i����o3ĸ@�u?�:8"yj�<��P�-y4H�`<�(u�j'�$\�s^�����dS�- �N}A��~�,��A�Nk�7&7*_J�.k�L��� ��0�a����(YL�<.��X��-�ъ�Y�V�\ �YvGR�����U��Ŀ����y�&�X���m}P���,VKxy �&3q�i�Q�����w�bN �G�LӾ^�+���B��P��sae�3Mmn����Ql�I)��������!ڲ�� G:c��U�O"&��-�U�,[S:/�{'�@���QZirS���UQ��<�Y)�k��� ��,�p@�N#�ex ������꧞v,4J<���Zs��.�D�w��|�Z���Z���A�=��J��ѹ]�5f��X�=�+V�Zٺ,O��)�0���5��킪k���U����vFS|�����c1���D�) ���W�'�7��\�R�A�V�x����Rke����$����a��FbپdPM>pR���Q�Gf0j�� ��ρ}�iߗ���a|aj� R\h�c��D�X�lԴ��`�o��~7�Z�m������݇� d< T��|C˺�S-��Bl�R��%��*��W�<��F�����>��q�S�m��4�j5�"��ǯv�!�{+3>�inn+B��� ��6w9�@�o��ʕ��y����q�QS�����{��ժ����� ҩ���R��T�h� xѿ�W��=�� vPx_@�
Static task
static1
Behavioral task
behavioral1
Sample
k96YAYqGfF96_1.exe
Resource
win10v2004-20230703-en
General
-
Target
k96YAYqGfF96_1.exe
-
Size
6.8MB
-
MD5
579f2d9b8ef1eeabe42bffd0e19b6557
-
SHA1
715d82b0cf9f5b7168e22988480dca1c02eec41c
-
SHA256
80432b67beac76f98dea7618139b0d389a28c2efacdf015cb94611e26624ccac
-
SHA512
76da4b4be82f8516772bff04fd4e40b6567694efc1b0e77c257dd331c6a87f09e7897c0a5bcceccceb8ce31046f4d9b5d11f65f455274f1a5870ec337e921e28
-
SSDEEP
98304:FLw02tlRXHr468OevK3eRL5k4APfhHLn1cw11FqLXBUmhadb88+AM1pb2hw6hCZV:FL72bVTNeC3eR/AxrnfinaeAkChFhCg8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource k96YAYqGfF96_1.exe
Files
-
k96YAYqGfF96_1.exe.exe windows x64
c2d81ace6fcd3e361648c8955745611d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExW
shell32
ShellExecuteW
ole32
CoUninitialize
oleaut32
SysFreeString
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
imm32
ImmSetCandidateWindow
urlmon
URLDownloadToFileW
ws2_32
connect
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlLookupFunctionEntry
shlwapi
PathCombineW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
asinf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
�3��O:� Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
��~���s0 Size: - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�o��|h�g Size: - Virtual size: 399KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
+6��[� Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�'�y&�E Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
N]k�� ҉ Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
���nXy�� Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ