�M�kۦ`8e1Zs��G2�gف������9[ܛ<�`��U� �K))` s�SH�g��5�va�Vk@� �d����B����P� H�vN|�uX6n�eR����\��6�Y!���Vf�h�F��z�B�zс�=��i�'�ӽEa�Mi�^8�n�%��L�8��ǪT��࠷l�֩��Rs���.7���3)Y/�9���r.���%�^�o��d���?���}�YB��mkK@�+��$<\��|6>�17��"��?�}(�L�a�k��[�Om Yw�P�0<�GFY���n������>�✤`^U�\E�2��K����$P��@�٨D�,7�G��7u����/W?؛�n�\�B�kMZ �06�c�9؛��N�ũ��G v���t�4�4'1�GWnU${ƭba��d}����`���������Y�]���:� ��n[ � �Mmp[K�H7��L��DZMxM�I`���GS����b��{q�<��E��O��1A`iWԬ� 7��oo���<K��F{�m��=d�'��|Qe|)t�ҕ}��T;�«e+T�3��e�V�UO�W)�s�n(�`�H��Z����s�88�A�L��.��1��8m�tplڸ���Ϳw&Q`�)+s[�w���K^p�4\q#3F�ڡ� XG3�`�8�{j�{�L���X����M~d>�q/z�h�(�����~���Z�ʍV6)�/���xX�N��l���:�.�����aіg!d��<3ډ�`�����H��`T�`<MD�{>��JF�>��&\x�@�� ]�1l�Z��QQ�����z&46~��խsx\�����r��h]�HiX�9��Z�[�� PV ǔ;&�(~�rQF��Q-}������P�"�d�k�s�*J0�;G8��r*�z��3<��M�uX�?�'8���ӧ�>1�Q�AP���+�p���No��'�)����b�w�N�B��O�ג>/��,�y,���q�5�������� o����'ʃ�ޫpAff>�W��:�b�ˌ��8�C�a��~������Fع��7����� )��B7�8�:)Z;�z�,�Q@�_ �P��ؗm9^�i3�'�!Kj�����_��\M�lp;�eojw��B��ن+9{����<<U���ioa2R������KNj��Ej�՞��L��,OX��`x�#I��k�%kO<���X��4���G� ~z��w���W7�a5(�5h�w .��y-��6Ľ�o�H����L���1aL�o6�FG$a� ��� *鿴1�Jb�*i.��9�U�z�����h�T��<X�Q>��ߎ�s�NBd�b E�]ʟ���6^IE&<��ӄy�뤼����+�Ubqb$���1��7Zd�6������Y}����#�O�i��_>x�� �'��F�|�o��I�f�b�O��#W�A.2�i��z�$j���߯l�ZEZb�h�/GgW��6:�Ϙ9 >�+:j}m-ݍ� ��+�!�Y)���_�E��p�,~"R�������E��*��0�IA.cL����`�z���I<rf�:�œ)L( ;��,"$��o^����R�b�fl��P�?�4|Vp��-oďS���_k� ���l8J���fO����GgHw�˸c/vk��r%��r:��O��H�=�y���rFDFd�7L,C�M�w��jz�� "���yj�O-����.���T�h�W�s�b(m��ϭ�]������T�>5�b����8a|�}�{�=�8���O���8Z:������z�j�}�5nf�X(����v�j��e��R��s,M\+Qz���������d7�K|�������)��G�ۤ��x���&�6������J��G�w�<��zU���n�����`��"�-T����S'w�p�w�|=Rk�*>r��jcI]K ��jIdN%:�ܐs�EEr҇��%y� C "~�B>�z�.�4W���u@�LtH��J�Ή�ݳ+>�A6d>B������b�x�v��r����D)�k�u�Ӯ�^y���nR�4��*�B�LPe�!���A�<%� YK�W}�6��]����k�~�<�h��w�YʨF�b,8��SaǔH��3.?����[5$Y��E��B����K��[�#���a|������fdn4s�ދu���Y\ �<)����'���2�W!v[����e�z�O���?ͬⵠ�_xm����D ʢ�I�^�u��G-x�W�=�'��jV�C�ijR��{@�̏�ia�b]�?=m2ڵ� * ۞+��u(/i����vbk�\P�i~&|C�ąu6R��')�������H� �'Ծ|[q>�� kS��۳�mt��� ҇�����u'-P<QS��nr���D/U��.ף��7P�cѪ'2"q��1�@����zb�'� �����ě.��BŎ��RR��<�䱲y�j��V�����a�yw =I�+�T�|4��Q��z���O&���?���~m+ ��!�)][�>�B�'7��[G�/l�D�)i��rC��8�$��H�.hU �������QFA�C?v�=���k���� �v����r�-����p�Χs�C��Z@����5��Z+K������a���}�{z�krh�?婑��])�O�ݗ������M ���%\��p���+q��'����\�ty�W�`�w���u��mV�S��H6���'|��Z���4�y�(�o��Ny��S�Rj�1IZ��������?y���urEQ�Ħ$���f�i�D�Q� ē?�{��(y��;�!�b<s/������h��ᶑ�v5"aɍ�Qߝ*��A�����~���r�Rz��&���ѱ��<��� ���A�(�%�`�D�A/����\ب16`q�x'��>}{�,�DFoP2��t99����N1]�����Jl+h�6� �'p�,�/jq�n'=Ma�����Nwl{i&Du9�"%���rQ��@~@ پfªa�"�^T���'�����%��T�QF�z*$��9���]�h"w' 9=�S����1O����G��� V�ݨ�T�I���Q��-4ml]ut1�B*��X��61��Y�*�)�14���[q\X�G� "������x�Y���V|L�).�9?}��&�^X
Static task
static1
Behavioral task
behavioral1
Sample
builder.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
builder.exe
Resource
win10v2004-20230703-en
General
-
Target
builder.exe
-
Size
16.9MB
-
MD5
16f75bebf90012a5dfe1fcc7fb96b69f
-
SHA1
34d14ebfecaee6d933ab4a3f756955104ebf2d14
-
SHA256
ee3b2bb6604bb428293d25e1e778e50b2adb0f227afbcabd4f5c7f7dbdd6d278
-
SHA512
8d405ddcef3ba54dc002b0951c9e47156fdcedca26a1c81b911adaf12e58ef7edefe0bdf0fe79bc61de32620bf6032ce59ff2b2fbaf4891cb2c638b95c29bb46
-
SSDEEP
393216:1a4dbGkjTUGD9tSr5j3G3IzDTayFRtImcoYFEZjFUMTOCZPS/5VdsKmD9f:1aUyewGDXSrtG4XeydI7oYoGRCtSxDnm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource builder.exe
Files
-
builder.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 295KB - Virtual size: 568KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 55KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 118KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 23KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 170KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 11.0MB - Virtual size: 20.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE