��0����0a��ZB2������`{X|�\��}~.����^VL�;�e9 ���\i-+�n�m���Q����J������}�����v`.xC]�rx����v)NlL�#�5��Eߢ�ToZ��Y'E� �oPP����W<��oڜ)E@bz<��-� �YJ��K�%����y��̘���ŰHM9h�NF��h�7�d~<�W ������Ԥժ�Wp,�2D@��<m��d��z�aq�s���pN�}��"����]��k;aw X�5[aup9��,�O�Q�;�����i5��o��P�b�:�$[�U�]������F=ꢅ+_�b2Kj�䧬�bϔ���U�É-��c��u����8��1`}��!�XctV�3�� ���5�� aH��C���2(���ҲEvoV�X�*���w�x������H�B���a�x6�t�ćyD@3w+���lzЙ-uf�(x1p�����1ݺ%(Hҍ�AVa#4���c�dE��68�%?��6�{7�?&um�Wug&�������CE��b}��d�+�˟������r����pA�W �uu�S3$@��Wj�<ց�����{}c'�f�(ʼn*r7B��L@R����;p%f�����+���7�T�&da���@� t� #=#�zR��a�KՆ9���v��F%����]�}sn5���-oj /�F�&j����<Ͳ$w�l����g.3(֠ ��ڹK.���Ƈ]�����E�edԹ&"|Ӄf������q�z�؟����h8h�e�h��faF�A,�����jWJ̨�$�i����2R�i�#�Hb�������I��L�U���&��j��R��#��)��F[��H�6E�(�/���[�rv�ek#�k �I��TB�s;�т0$��G����8�uӆi ������p �oB<��Q��8�i��Bs�I�π_B��'^����"�,���1~)0�8.|���"���9f���Gͻ.��^�G>��#g 1;`�E)lHu:`�$2֠X�1�c�{��+JS�DZ| =���)n~��&WA�ܵ��!�l�M��ǖs4"�8�t��.Q���� ��t!���D0[]�߲I�Nk뀢�X�š+�9���I����������ᦉ��e�{��AÞ�z�)��7��������:��É2��@Y��͗��}f[���Ġ8� ��)$��� yF(s(ʽ-?y��6��'T$�̞:�8� 1#x"ZS�ͅ���ȗq�M8�rݯ(.�datP&��tK��jT�u��+h�����cj��+� �:m0&���K}���-0�,*��F�l���V�Vvi-�h�� ��o?�g��.�n�W�eǭ)x-<{T�����{y��*�@�����YY+(u���p�Xx�c߰ ��/��l�L�'��wZ�(;O?q$�W[}��Wq6�8���b^E�1a�)c,�� 4��y|[�عA���hD���C9\2Ji�=����1�k;3�m]��)�^�=�*7 $�d���b�80%P/������g����P�)Hyq�.<'����*+f)E���EP��!���g�� ��A����Rw���� �%�w��������������|�#Y"-��8 6�}K�C��5�qvƦ�wj�|[kF�����O�`���ֆi+��~ Y]����!ѣ���� �+#�����&�䡚&�bx#??av(���m����sOS�`�}̚J��j#�""��~+M��)�`�*����6&+F�7��Z���/V�h~�@�p@m�4�$�Ma�(C���n�P��R�#B�b8�E��l N�[{-��{�?�(%�R%1����%��KisN��\s�1tȿ�:�L��J�;NAX������Sr��Ov��E�����9t��*�;��?j��/�7�E8}4�Nb������1��,H��*�m��YȲ�6�Qu+\��y������� �H��)�����u���*�px����H�h;C_nۿ�hZW�#zᰛ��u����PM����B˰��_l�9S���~�T�c��� ��YB�j�������^*�Z�� /~҆9��bvDz�=�z�!�E������a;��N/G�Y<��O�5G��r��Q0� 4����. FP��ҙ����vl=4�@�i�fwg����t��m��gDWQk_�G�3h���ؽ Զ�Vf��v�8/cV��h��)��cK�a�R��=�|Z;6��']_e~X�c�_��<�%�*Fz��|�P/>��N!H� �D�En�uP�T����~�T#4�pT��"Z�}.�ʆ����<�kh���8��G�#��<��[��M���'P������ ���[�v���.[<�(�u\a�Dm/��C6_�l��q��l�w��u��?A�X 0�̯���3��m�-*�pa�5-i=����$��[+jk���o�E��")X��a�d)@)R�b�_����Cj)� "Qc��.' ̷��ΎR:�T�ς�Z��1.��!��44�(�� 9�w�蘤Ø�xw����Q��H�i�d���6���p��ՖVD(��n�a�0a��z�wO�����ʎ��au���p���bΡ����I��u�֡�L�!��*7G:^�/}N�W��K�Hb���}����?'W�'�ȿ�f�t����l����퓸����1�U� w�������B�+߭&u ��V�B�܈zT;L5)�RH���§����B�cL�@L>�W�1h���GD_�<z���P2�N�����y������_�Π5�C��V�4�kGm��o�=�������~�K�� �"A[��ii���6"��}��+� �·�-�����cRz�tčΜ �J]�<�n�(Q w�f�蟺��<f�$��<0ŷ�� �=i�ݍX\�b����_�I!,�`��!�i���:T��It�gy��^Q�*�e#x\ �����}�`%��l��F>���5̼��elo�u�������{�������*Ԏ����zx�;iwm;^4�����Q���Dѣ� ���O=�«�-
Static task
static1
Behavioral task
behavioral1
Sample
50e802b1e0754032.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
50e802b1e0754032.exe
Resource
win10v2004-20230703-en
General
-
Target
50e802b1e0754032.exe
-
Size
54.3MB
-
MD5
4cc5699ea1f4a32ab62f6e0e1b8d5515
-
SHA1
6748e4c86a82096f11db0a6e82bbce89c814cafd
-
SHA256
e9c1e30e56f0572941ff8e04a54ebfc1c89ed2b662775977831a96ffe8564d1b
-
SHA512
d89a821ad86969dc13fbc716cc52f3d64dd757557d7cf5a6803211308105bc31c5d1afcbff08d00b805c06d5dcfe5639075164f1dc927d107b3cf2f9c502bf81
-
SSDEEP
1572864:O0BuJuJgj0dEWE+h1mJd98zyv0j5VEPdsZCPow8ma8y3Y:O0BuJuJgj0uc15evbPdsZQn/y3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50e802b1e0754032.exe
Files
-
50e802b1e0754032.exe.exe windows x64
2b6797bb80dfa34349e970665f1921ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptEncrypt
msvcp140
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertCloseStore
ws2_32
htonl
shlwapi
StrStrW
wtsapi32
WTSSendMessageA
ntdll
RtlVirtualUnwind
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 876KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 213KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 50.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 54.3MB - Virtual size: 54.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ