��Twj��W��j�e �B���� ͮ���������Y:Ӄ��yD�"�JzYub��������]����.(:��6���G��e�o";���7��L>���(�-r�"����>�. 7S#���d"��lr֯�^�c�1���ܷP@'}E��7kY3����40�v#��/)�A�1.�;\�'d�2���y#�]��{�-#6L��Y��G�r�� ]d���},��p�b��GW����bN����Y��2�U$g�S%�����5o��+�YX;i�������0�S4J�:����FY� ��a�A8&��@��IbZo&���"����/��$�Uk���6˲�d�c�&��<��>3'�t�<e4mq�����H�Mw®(� ���bD��vH�g۰�OE,<)��y��i�|ޛ�r�\���ٙ+U|-C�U)xv�y�������dg �(�*�}eHjk���]ɇ(���:�)q"�3+f3�\���8�<ש1�X-�dI R{2%��,H�T�����@i�-�3��a����w[�P��a�ƒ��h8�~F)ϭ�2dYt�eޒ�EY ���á� ����٣�� ������@Q���T,�~ 2���n�@������#�*0 �&��l��b���6�E���X&!�9b0p�h��ްTx�{���Y'K��Ͷ�4F.����<�aq��x��$��g��>8�9�����jM��`H��{��}�u]I�/�ߥ���x�U��\�e�52��%�Y�*7���hudZ�[r>��tm���9��� c� ���9�!9��IPOk�!��fK�`Nn��sgk:�U�P�~������'�EBk2�lMy��=.�H��:��NO��D��md�g>"\_e��&?!��E(�ZUoM��R=4t(�j ���{������&�r%����i1ă�`Lq]�h��@�Y�%(k�A}��˸Lo�>ܩ_��*��d癄i�`�BP5�?i�2Qʅ�Bը�r�_��V��+m���ݹ{@vD�K-E���̗��QL-CW7�w;3��\�5;Yvk�p������3w1/ˤ��qzG�d4%-���jʕ� ���x���{-����Wu�yά��KGC&E�M!��f ��mN��C� �TxxX��|k6��nc�����w���Δ�k��;\-}����cB�_�u����uzr6��o����C��d��ф?,��u(�u�=Sfm��l����+T��������I8��1�e��� ��]�?���ە�xY�q�ѻ�������~�����&�`�t���� `Y��b&������qd Ow�I��Yԉ���]�n����ހ��gF�-.�RG��OLu���Iב^M��<��,�\����V�-��Y�9��gvAG_�!&� ��L��@+�=����]�!6 &��73O����5�PĆ����gg�yt��,��TE��??ǥ�$��ߝ�6�0Eu6�o��-g̜:�o^��2'������Y>\���c��A����K.E�g'�n!�����>��pEݡg�Lj{JѨ1�ͤ��>�]>B�^1��*S+@.��,6�L��o4�>�<�I��!��^����pXS���N��!���,����CŲ[z^Zi@��h���x�Շ=��es��D���t�0�a�]�3���q8��Y?(E�%���,ZV���y������ ��7��w*oI6��>� ���/6f�}Kp.�8�;�~������������y����/"�^4+'�b��J_*� Q tt��d{,�@��f)�7�w៳���W�ww?g�έ<������J�Q��d��y#������?`�'��9��o!��q�^�r=0����97�2/�G�l�`��ݚ�U��_���+�^��P �Cd��؉�*� Ԛ* �0�|��������j��F1�)r����#c��J�6��'F n#:[xƦ�&�f�N��T���bj��l�M���I����������D怪����dv�F p�9p�N���2� ���-�A�3�����y ��X%`L⻠"��p����י�}N%�H�����_�%���k�x}�p��el�O}���`�L7���������B�%N��nsN��!u��* �X-:#�������`�H����jE��w���H�� ��l����r2����ۯ*�� q�oa��v8�`��� �kH}��3���x)��$ܘİ91pg��_ D2r�z�����bU�������Na�/.HMNȍN��z�^���<M���*?4Q��ڋFK�����ŎG��ޥ1V'i�����SW'�������{j^}5�~� "+�&Y� ���n{z�X7��uݩ(�E(���p��� YB�fyC�t(�RR*��YL���/�`E�~��N�=�3q�/ab ���2�%���u���.K�.x�T�@�^}u�lG����w⿇tX�����RBi!��6��o$7@�[*[?�XC`/d��N�@"o8���#�6����ْ�o��%��m˞b(K��v��(�a���m�7ǭ�� ���N�HE���$��K܅���Hs��R�J���oWv,?�b��*�=�J�c���ĸ��t3v���OѼ��a�(��D������Ǵ��v��2]��%4�3r�^e��4e�ZL.�$�I�8���x�*���2I�LK����?���� ����j;6�Pn�F�Aϟ��D�����좊�ž� �4F?�$�Y���k���K�94��F����+�K�+�^�k6�>h�)x��?瑀�w��q'5M�?�m>�Q8�F]Ú10&菄y&'�DUZ�;^��ua��+��%�O.�<$N��=��)o�~��>.a�'�q&�QE�'�!��Z[2���n,!���6��;=9Qm���=;JAi�YV��4N��Gw�36����@fз6 �}5$k��:��>#\���"w���4�W�B��*z(�9�����[9�.Cx�q�-�6;�N־# օ�ЖlN����H���ɀ?��2����di�'N�D�y�5'+�W�� ϡ����QY9��X3:����#��F�
Static task
static1
Behavioral task
behavioral1
Sample
9f131b4fcec7c0e30a9e529447833e41e3fe814d429b5544f3b662f5205f364c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9f131b4fcec7c0e30a9e529447833e41e3fe814d429b5544f3b662f5205f364c.exe
Resource
win10v2004-20230824-en
General
-
Target
9f131b4fcec7c0e30a9e529447833e41e3fe814d429b5544f3b662f5205f364c
-
Size
5.3MB
-
MD5
6194ffd6e8c888145a9ffc3bb69b0b55
-
SHA1
531e8103d924ec7f19d556e96f420a3f63d6a77b
-
SHA256
9f131b4fcec7c0e30a9e529447833e41e3fe814d429b5544f3b662f5205f364c
-
SHA512
abf73145492cc3ad0a422535dede9eb5d616beb9edc590de7ed7d1a3768068e0aeb2433f98085b06fd9d606024b4e7c91987009b58aa2b7f0561045c8839cade
-
SSDEEP
98304:Gdru8uev2g3IPDNSZIolNh/yJydF06XeDBVeCZUinzInJ5+bkrKx1B3NWiOxH:GFGIWb8ZIeNTdF06KBVeQUT+bO61BdWF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9f131b4fcec7c0e30a9e529447833e41e3fe814d429b5544f3b662f5205f364c
Files
-
9f131b4fcec7c0e30a9e529447833e41e3fe814d429b5544f3b662f5205f364c.exe windows x64
434752268a731e7c60fba8f3a8c99e30
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTextAttribute
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Throw_C_error@std@@YAXH@Z
ws2_32
gethostbyname
ntdll
RtlCaptureContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.interna Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.interna Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ