-;�����V�8L1�|�k�MC��Rp�Ba��B%�����~<��@eG����>�b�+�1�Y�Ņ�՚)&?� ��BD��^��Z���4y� �1�҅��N��h��kS(s��DK��-�{���6�P�q�+��U�Iڿ�WY��K���������"rH~�(=]�\�➓��� ����KO�@�<;����Um����J�Å�Y��`�W�M��S���v�4U�şag~dR��8ʭeY�j(l��q� =Yf�n(��� ��V��d��w�����\��:�D1weg�y*6P�}��9U�҄���g-ԏ��k, L�AN3�Sd��rPiH'r�c�Mj��%N 7 �%�� {o��;�[�ER��_='�h������ډS� �i��/�9�H���o�K���^�MI:^��XG"�Q7�����sں|ܤQ?Wx�n�>�7$�p�dz����.H�� 4/v�2�DdP��e�gƂ�H#�"�` �LM�N���]�|K|�l]�R8�`��U+��h/���C�UD��,�@=,����q�=74�]���8*�-N�u� �U������&@1�����W'�<��U�� ��f�^����� ��ƀ��f:&x�r��tT�L���/�t�G ��ib������K�����Ţ�S���ȕ���ȩ,���\"Fr���8�ᗄ6ū^�ˋ� /:�ڢ�rߠ�.�Yoc�|�'FcnܧA���Q.�״N��oX��ٗC��.��5[f�Y�?�A3��:lT��F&���z��H���03O��"�M?��ٝ������y�T>7Ԫ�^#&sl��?�����˾>��η캣���ۮ���L��ۑve�;I~̭�?��w��c��6�%�`�������6qd�����p���B'~�P���Jr�:y^�� �:-F�����Ey�F �\�N]���y7�Sq0Y�nLk�����WbF��?���U�lt�t:�-f��Kn�ctr��y����L\5�����{�<�3�Ph�]��p�j�8ع��i���$ -A�!�*��=�Y|�$���c%{�x8��2 뭋�a�j)Q���{+%a�j\�<]����W���tnh�4��R)ͥ�z��u�1G|/���-90JK6ه'���V��%T���EA�����0�{�h�Vc2ի�K����#��#S��>�U���N�4��lLN��g����FB;��A�nz���C�gzJeHO�����Ĝ|[Z.��l����!:Y쒧��_�E����PS�8@�3eC����.#����X�O�,�5���رA�~"*��^��јvp�� Q������+�@ z�m�#s��c,^�*�!PRٮ��o���4e�֓.c@ѝћ@�*���Q�=�V������{Z0�c�&��j}�����Wzm�䲦2"MB�<���cX��(ή�Cn�ݞ�8R�5�m{�K%A�?=J��)`�l�b_c��X��R^`vo��`����9��[ā���)�j$����5I��Df���W�����;1I`M3�[����S�S��~F \�����d�X��F�wX���ٯ[��A��.^��P�<�/�z�2l�% �3H�0)�s�~��A���x �a1�3��bL�v�5��f�����)}�n88I�O�Xt�<]g�� MH�^�E�w;C?�du�ʾ�k*h�W�|~��������Hm�o�w_����\��dJ��ҕ�>P �*�����p�4�_��fӖH4�5�� >�c�Z,���M�]�����;-���������z�4- �] +ݾ���T��'��C0�� '�23>�����T�c]=���JR�<Zbr�X�E2�Euϛ��ckNf ��� h(�-���P���vI��溽OH��ii`�,>�Γ^I!(�����L�w˓���*����{yjg�]R�U/�&���ةel+b�'̅���D�d��w�Ei.��H!�J<E�R��f���F;&9�c��6�8_��K���Qxʣ���ݵ�wT����n��K�E)�E6^X �#�ɀP��h����}M_�;��7���Hi%,����1Zei.���H��>��Ϫ�oK�%����"��K��e����MD�un�d������aZt`HM|n�5'q� {wnA�:-�o3�x8|EqI�9Ƿ?��?)3-��*ijun�ս��Q�����+(W���ID��]+���9ɧ � Y #:hG�ޮ��f���������ԃB�@/�)-sc�rcu=�Ozc����Xwn<����~��T��6M��n�\���!�U0'�-!��0�Muϳ#���IPg]VZ�W����0�$E"��2�u�w�n��ﵾ�d>����8��F�=?lWOK=E��*�S;��spHM��2�~���{*~`WDN��ӫ�jd3W�����.~D<h5J�ʼm$�2�D5uo0���o]����mA�@���mx�%]��fv�� &��ۀ}���ߖ@���yp~쾃��\���v�f����n�1G�SE��p'�1�*��9<c��r"��;1� $�O�6o�˽sB���40�;e����N)$hi� e�o��<C� a�Q�u��V�D������S���C�<a�2�Zxng2&8��hͦM"e���l�Um0����<��H�{������c@>���~?�����]��%yW�| 9s)ɣ ַ��=2�e��q�0�K��D�2�x�J�c�7��KF���R��C�V���z����B ���A,B��m��9�������u� ���v"��FJ�t��:9N��Tb;�JH�ɆzG%���P�.t�6���Í��:���Ou���:���*�rH�:�͵�Z�������'���y�D��<"�Xtwz�z�|#ڌ� џ5�4A����-^C�xI�IX��clv����p�[������N/n�($|D!�̖!�9���텁�&O��c���73�\Ԅ��"�OK4�V�T2���G�22?X����������,h��)3p�@�J�d����dg(�&��"�
Static task
static1
Behavioral task
behavioral1
Sample
615aa9091ffb2fa54e1c928e77d48a6eecfeb38274a980f760cb505bfe91f158.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
615aa9091ffb2fa54e1c928e77d48a6eecfeb38274a980f760cb505bfe91f158.exe
Resource
win10v2004-20230703-en
General
-
Target
615aa9091ffb2fa54e1c928e77d48a6eecfeb38274a980f760cb505bfe91f158
-
Size
6.0MB
-
MD5
ccb26fa45dc03db2fd16b436c460e76d
-
SHA1
8cd23ecf2c0452cd556c2590adf11c1540e85bfa
-
SHA256
615aa9091ffb2fa54e1c928e77d48a6eecfeb38274a980f760cb505bfe91f158
-
SHA512
b9b3b03327ef5e0f399224da675c22d7c843cf1b5764a00b1fe0468a9557a7b507deb953ffafec85ff16524633d4f00b3ef02b9fa22c0e0c8c5b8d78924a8152
-
SSDEEP
196608:2Z9uOTxNo+BDAfGEweMsnOEwgP1VUUvhXHbI:e99xlB8GElMsn3wgPFvhE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 615aa9091ffb2fa54e1c928e77d48a6eecfeb38274a980f760cb505bfe91f158
Files
-
615aa9091ffb2fa54e1c928e77d48a6eecfeb38274a980f760cb505bfe91f158.exe windows x64
7de2c67279993812fb7935b5c425c5b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddAtomA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
___lc_codepage_func
ntdll
NtQueryInformationProcess
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ksoxev64
DllCanUnloadNow
spacedump.sys
DumpPreInitialize
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zaas Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ