,��m��}GT��,���y�Ce'�]��bF�l�)��S���ױ�� ���^���,)��m��ߖ�c���ik�9���E$M3䑐����2РQ�2���(�����3CdX ���8P� 7��Q���v��(}�`9��MB���nI�����AM���\��E:��B2)�c��w�(�ղW�K,����pp4C�j�e�՚<�A��<q����ܘ��5�=� �ZR6��3�1=�^x"�r2���a����B(�_��JrV��F�fC�s�L��@"2�D��V;�r�#ӽ?�kԗY�� �:��:�����!q��v���9@(dqnL�R|�:������}�ӊI��FsW�BKt4^6��0-[�d"�\zzBۙi�i'���6���Q]������{$$�uĵw���������!��Fv���G���E�_�������w�� d']�Mz_������ƛپ�����7\�|%��OO�,�n�1�fd�H���|���e66����H��C�{�ǟ1�����J)���^'�h���\�V�W������.��d<4Fk�p����(a���� �R��{7X��!����gz���R��*�9fv�H�ߢ�^7��{-�G$[B4�7)����ټ����mơ��g5+s����J�b�O�����u��V/��D�kJ(B��ֽ��b�mʡx��W9�$���"p��Lɱa�Ѕ���t��-�81��b�A����/�`��A�%ʱ�*�0Lh{$�~�*P�I�c��9,����h|�G�n-�@��*^���g;�*l���F^tI��w������/l�d�����}��t�+�����`���D�)�M�N���&4%�D:��E���t���{��f���Q�b�)u��B���0�?���^�q *t_���_�v5ȗ�>BWp��d�ȥ�8>SeHx#rba�K �قbQOVѪ���Ge��Α�$�Vɳ�n��*��l�/�{/�&8���O����j3B �N.�`��ooY�9鞳ĩV��8+i�D��g2�櫅��\_�|����l��_�ڌ���bv���K�pl��&ڐYM!���&��}g�[�����^hⴲq�szJ�e�v���c�V��1A�ou&���,�}hk�/|�4&w"f|B*��'.~Z�͜m&��T'�WH�j��)�v���n(x��v�\�������汰��]9�q��}-�T�龹qP�Xqr��q�+�Q�ߛ�ʡmJ���j�0D�Nz,��_;��^,�'"�����q�1p���Vw"��"v��X; ����5��ͼ�uv@�Z1v�-4���=�&���>YM�#�&Q�u���[�Ô�yG,�Ģ˅cyq;f�U�Cv���2������6Pb��G�A�j����0$���孄b��S#�m]S{(~$w��8�3�0���^u�������4�\������"z�L�߭�{Q�)H9F�x˹2_��O�O��n�?�U�뎦�J�K��'��p�>��0�81�jwFGA�䪳�B8IoESyf�5R@��(�D���P����.�P�A=����ۀ�j���$ѭ��9�(J/�;�_��5�[4P���Q��&%�$lH�T�Dk�D��E_%�k=;W"' ��I�[�?��r!�w֭1��(�j8�����. �4٨j���e{�\N�Az���y���y�[�!k�ZZ��(;����F˗��� .\���/���MPs�����c�I�k~�S��2��%��ﱂ&��u�e����$��CF�[������G��a�@�m����N���� ��f��g�O�a�.Xz?�,��A�0 ���D~V�֘�$�5"��������QP�㐜�� ��P�)�p����� O�<�nu��\wq�z'g��?N�p0�4,�ga�s�x���#�Ğ.��y�♼w�-�hW�JaKp������8�#ir��l�e)db�W�~+���~���;��e������v���6�g������63�۬�X������y�B$��<����������qo���gkz�LnWI��I�Q�5SR0��\d�[矱6�_~���e��ǫ!k*��%1E|�g}1Yo���0�6�`i� ���F�/���:\��m9�*�I�ݏ\�L�6��}�Rm�V$�B�ˏ->%i��N�X�7���A���#��Q?�;V"�+jy��uM�,�rS-D��� �j+��W;�|P.��I�I>^��6\�Ս��,�7�q٩QF�T���/i�G�_�� ;����]�Jڄ�����d���U�m d�kc��v���Y_�"�h�Z_����ȍ�o��pы]��z�5$��b�Ti�7B_�iI���_�1��S�p�G=-����d���֥]\c! �hṓ& �f\~�E�-m�kh^�n"~����_gԪND�=!(n햍��8W�O+ �� ڮ��ML�*�2�������+9#��vMX�ش7?>;-^�r0�Q(齖W�0V������/��`Ð��k�%ؐ&� e^P��O:a�X�ӽ�N�u���m獋^ _"nFSȵ�����O픎6!��5�� �~���94R�)�P�O�4?����k9�v| E�7}4��4"��i����1�s�Ly�٤'�}:./��/XN8��>Hè���*�XYDe�v�[G�������坻��P��h�!�=,πR���m�K�dVo���I��-��ׇ%B�Ԝ���DK�v��k8ʣ0-k5S�w�$E���bW��Q0��Ew�Z��y��eO��1��2����nW"J���vt���7 �m�������5�.�x�p��ޚ�ž��I��W���cA�Az�,�u�� �}����y������>���#��o%:��-�:����Q�;@! �!�A�!H���̞�!,CDS�̊XzC1B'yv��"ك�x;��݊�y�YM�.p2�x#�wh͜��C<�-�Kb�t)X�Y1&>.&�:� �,|O��7����Jh8NXoz�W�Ϗm"XA��� q�t�p a�`᪺��m��#��|��
Static task
static1
Behavioral task
behavioral1
Sample
a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a.exe
Resource
win10v2004-20230703-en
General
-
Target
a.exe
-
Size
6.9MB
-
MD5
88599710a86e7c7185e263634f64d49a
-
SHA1
2996687a5346d950bf9f3dd5eb9b5cf324e8d4c9
-
SHA256
597270a1bf7fb60830795addd96b7857589802fd4bec829728250717f913728e
-
SHA512
ad0d9ef0142e55e1c4b560e7c75647bff0f48be2a389347660f8a8eea4a5e00fe3c31a6b925d88a2bb633a9810ca935959a8dabf8fea255a94a496b9fe00b675
-
SSDEEP
98304:71EIcqRa0oIiYtiPL9K07fwhqlsxrR/o185h0dYOm3f/EanIiDqtebOCa0YHIv/l:71CAa0osaLjfw2y/wztwa0YHy/m17q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a.exe
Files
-
a.exe.exe windows x64
96e19e0207e26e27c116252fcf2e6186
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
CharUpperBuffW
advapi32
CryptDestroyHash
shell32
ShellExecuteA
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
ws2_32
WSAIoctl
wininet
InternetReadFile
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
Sections
.text Size: - Virtual size: 545KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.m%i Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.}[( Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Yk@ Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ