D*�~q[G&�>`W/-�F��k�x���j��gJ���T�8���q]M3��Pd`WD�b�v��!V&#+�̟�zQ��q�=�a���GAb����T �B�h)�e���xy�mV<ٳfFŠ�՟<�;�q]@���C��oR��A6��8�9䋣��f��L��1��G�2R���OA�գ�u��1�1�� 9[���l���=�q�}i�����:�����X.�RE�Oqd�<�k��I4k��i"I�-�㺞+��m�mю��-L/���c2� ~�DLi���Ϗ��!C�,pF��c[��z�������4�o�M!�6Z�V7���t���V0һ�m����:҇lc���[�����7'�j��3'X!�2*yA�ߋv>-��oN� �R�c�-�(lMp���rN��~���P���0Ы&�m52��gJ���p�VMV29�g�����0v)Aδx�a� (��^�ӛrDg,*�%?�-9����vl���`�<�mܾ3V7�Ʌ<'��k�8&���{n��ׁ���CQ?��M]h�b~���!��_�d�k)x�m+r�X�����3+=0֭T%L�&����@�4*~�y��s[?4Yd{p���U� �v����4�Y<#A#uSID�F%c���WZ��<+����a�Q@B��k���U���s�DTr�2,�����ߕ����ɨ��������W�#�LfV����:�}��^uxv�뎩cU�����ʳ�����'������u�0ӈ|\z��Ե����y����R��[��1|���k����q��E�a0.>T�1=f갽��\�oV�:����ȇ=�Io�� w�9�x�я����M�����o�����\`F��ؓ�b���������d�C" ��y�,s@#��c�O��HI����mC�=��1���O7�}��/�Ahk�zp8�܆�]2�� ��gb�)�-e8JG��ۿ�؟����s�T����,qqaZ�ǑXEu}��]|f#%�!?N�p�=Xxs���+�CHHt����wTwQ��D��|ećR����+���Pw��Lͼd!���}�����dm`�rX_Y����⾟�of&��M[2v,�[��Xq�ʋ&P�p%�v�r���<U��8�$�[-B��>d���p���,�ZxJq��Yc��`�+`��g��C���5�q�S�R5�А:F��}n$\�sw]ѫ~�QD�>���ah5,Q��ym��z��jh_�Z���h���{���������D�5�g0��/�DƲ02��D\�~=%/v���6T ��0�9�oB�%�k\�[X9E�Fq�� �{X2�#� "���)>�y���G�o�P4��������<�4-� q�Mzyc�l��j��e���,���Nu Ih�:�r��t�%� y�/h!���|�m1`3��8[��S�K$�R%�z�|��ak��*�L �����F�%ݗ���w���v���<��N����z=l�p4�}�'�톇C����}V�t��&ń8��{Ga@���+-N�2��� ��N4b6�7�mǔ��m�R�� �&����T�bZ�e�t�N�I��>��6P�GzSl��Mr� �Ԕ��a�Z7���58�{��PTA��<g�4ٝ���^���8I�����L|\�֘� Cg��x�B�4]���n�'+Џ-Q�� [=,�/�ɘ�{{S�!Gs X�|$T�5'9JxX��&�փ��6�=m��(U�E�1DΓ=4��,���c���p$n��}� d�q��n���?�j�<�;\�dW���A�M�OR��8��6���}{H���/Fo1�qbnz��y�D���gZ�������⃩�?��^�b:q3ڶ����/��Q��`E������ ���O'>�f��K�E�ȁ����ya�p)L�Y�5��|O_���Լ[�$���U�B V�.���-9�����I����.h"� ��3�C65 "���f�V���B��8]f���|��V���b����Fo�sָAg�~/��qZY�Ȑ��WKt����d�����\���_�{�����@�����j�c��P:�7!��4ʣ 8 Y�I�rY.۹��h�w;H���JPs-���75��֒��iM���THY�(�o%7,��Kv�@���YnO����(��=m?8�����X*9IH?��Os��\h��d!��s�뵳�(/p�_p��v��x\��L�6�c�tJ(��jPGER>�nlMYt%�k2��I��w�dI�m}�3�«��C5&�F~��jF�C�-�,0��c[հ'�3�Uy���$zi�G��?�b5�acmsB��kQw`�����D ����Oq�u�^��]�`![�L�ė2B�U;��+%��� ړ��������%˫WW�� Y(�5�d;�����$����yT�*s��s�T�D�":Ĝ�R4�����!$W�s�C��M�Z�����&1h#�s�0~��HYH�����rI��Z�_W_��q�o�Q0CхplS>_YrAA���Uf �������c�Mt��6A���'���:� G��eܮ�)�JZ������v>i+�_ ��7�y��7��s̈Y���*���/���V*��$m�3�KV�.�֟j�Ca�o�7����di��?�R�씮�q�&�>�e��q,� & Fَ���XrIS����y��P�G��k�4�0�P��r���B�Li ����Y�l���uM`� �<z��kB�H�kh�F|Kb�o����U���c�S^m!��Y�i_GaM�ĿPĮ6<H0j�<%>t�CD�J9ބ�V��㏮�D��Μd���k��)n�9N���Q�x��D�LB�d�@Ľ����� ��FEGVegb��d F��_�RݏT���E���%�֢y%'�u�͕y��V���b�Ȫ�f��µ�!���>�.h�y�Qv��M 6z�;�P���^a�8c�������9S;㎏t�x�*�>�E����}��`�RP���������1�������"�}}�o:_�U6�7m��+���`��
Static task
static1
Behavioral task
behavioral1
Sample
6e1fe90efaaf72b7271f29a33eb3914d473fa83117f643a531fffc2645141684.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6e1fe90efaaf72b7271f29a33eb3914d473fa83117f643a531fffc2645141684.exe
Resource
win10v2004-20230703-en
General
-
Target
6e1fe90efaaf72b7271f29a33eb3914d473fa83117f643a531fffc2645141684
-
Size
15.3MB
-
MD5
711aedc4ca99c706422c60c2f3bf6ad7
-
SHA1
3994d07aa39353b70500bdabc2876be49a00f502
-
SHA256
6e1fe90efaaf72b7271f29a33eb3914d473fa83117f643a531fffc2645141684
-
SHA512
0f3d9123c02409bdf7771884d6c7359fea12c80e9f98f9987429bfa6f829f47b75273eda31fa224b7d40ff287f9b0920337a138b0535770e029dadc815546924
-
SSDEEP
393216:s27XyPFVsIFU+HAKFQreVYAbsKILheY/U:/7Xyzsi8KZyAyh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e1fe90efaaf72b7271f29a33eb3914d473fa83117f643a531fffc2645141684
Files
-
6e1fe90efaaf72b7271f29a33eb3914d473fa83117f643a531fffc2645141684.exe windows x64
68fce37e243137afdeb89f8f57451541
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
gethostname
crypt32
CertFindCertificateInStore
wldap32
ord200
normaliz
IdnToAscii
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GetFileInformationByHandleEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScreenToClient
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
ole32
CoCreateInstance
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
imm32
ImmSetCompositionWindow
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-stdio-l1-1-0
fputs
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
cosf
Exports
Exports
Sections
ITXQQCYZ Size: 793KB - Virtual size: 793KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ITXQQCYZ Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ITXQQCYZ Size: 7KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ITXQQCYZ Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ITXQQCYZ Size: 11.5MB - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ITXQQCYZ Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ITXQQCYZ Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ITXQQCYZ Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ