]�ԟ����}�K�b� 3gMv�"c�g#͟G��f<�@�����で�8�,`�O�����3�)�}��h��t^�Z�7(p�+�mS�Wq�OVKV�A�i��?a�h`��\̣!��k��&����Gf�z��ʫ�<�9�Ә �XP@��f��rM@�}W�$��C��UF\���u�=���{G��ެWC�^��Z����_��4����*�]��&|:U�:S� ���1�h�c#�`{X+P�2-��?-H��;^dx?��+��m=�<{�l�+���8�~Ē}���3�s��N ��h��k)��0� %A!��z�n����L�'��0+�FrĞѢ>�!�,�Xd��>oa}�l/BH��?Y69o�m��E��G����'�'��0clvr[Q�1��EF��X����^��a������ǣrY������Ģ��� �W4�E� ���M�f QWz��>rzw#��B�ۉu���oU�%ݴj+>�#x�� ���BF ~������g1�`���*�E#GAA�O���s)�h�LJ�cr��XG����j������)$�J�����O�'��6��N(A%��9���/]�Z\�w[?��z��T�6S�@3��;�EL�dƺs�� I�X�5���� ����D�䢿��/�O8�>�tD�_��\� �w�[s�2� �6�ȧ�1��;:�څ�^�Í�R.�^���2�Xv�Ƌ�`���,����[�t����MAO%�6j����Ļ�qm�������N���T�MXp�qBX���OY%��ͣ]���U�][��_\���7������g%����p�d�����u��{��$檞�=���U�s�<���ms��fF�[D���61僬9a���z�wc�!��U� �<��Zh�v8��-��V���G�&��l'���lޗ�-�b�-}���I!'ֆ�)L����N���((6��J�a�a��Z�\�Nq#�I�4��M�6'�z(�|%���e ��y��RFh�m^ǃ�f=W��_4r��B���|\A�@d���w*���(Y�{j��D�!��Mz|I^���Oz��qB4���ӵ}b�Mf¼W���>��}g�X�E�مc��J��(!:5�:�9���1�FG�s����YL����E��� s)A>_� �=�U��@>դQ�`!�$!�P�͍؈s�K�3�ϡ�Hw*1���w�aWFA_*�U,Z�$�}i ^�He��7�Sq>�@�_�����t�Hbأ~�M&��Q��;��ˇ"5�o�;��A��(�H;�!⊶a�h�IwT-��ݙ �,��i�������}�%���ۥp �?�^Iv�v��E�-�MB��w�ݭ��v�eQ�ˇH3��D�v��l���Es�����KN��c���<��ښ�I8�lJ�����]B�PID�=���r�a%�S֎ �ϸ�o2@1���$�'��l`���Dma���K6A�zo>&���q��:�G�ƱB<��2����8�q!��+�g��R}�O%j1�k@����u��Ef���q�B�(�y*�o�]�s���X+�":P>�mfpowK�PX�k�S*iߘ��sL�&�g�y�F�:��y�j� 3H�u��ӽ���Y��v�|�lq�����Ѐ���u�&���!Q��d .��Ԧ����XL���n���nspz)\�����|&���G"R���j��C�G�e�шp'+�-G����LzL�T$���Uo��ĉ�*cu��:����T�1ŋÉfS ��M�߳��սkGP�?�>��(�I��&����xH��x� ���;$�%(;��2�f5�M��QЏ���%�z�Uo����|�x�\�d��rdB)�� ���V@�F�}lb��t�9�Bպ��Q����(H2a���5�I`���D�'q���Xh����У:tN�,�#V��^k�x�?�Լ����U�w��� ����9�,�te�V/0F�-�$�����j%��U��������cV$)�I�h ]��(�z��f�x�������6�Q�����l�3+�Q��_���%h� �k3��Yu��헛Y*6}���~���"4�~�|_�.��#p�5�nL���ƫ�y��J؉�ܻ��[�������Ӛ�T����P��%]#��aB��6�W���ȹ�%��2����˓#�L������xbd�(�ʈ�v�����C�@���?�}c�8�;;��JT����!��#4���������1r�Cܰ���#hag_�ͼ�E��0jmd�-�B!Ñz=[t`�܅B ��p���4�K���v@"8�� 8!��U!D�h��EA��,|��U#m+�:n�7��J@O���c��~�1n*�Yt8�G�n��O�X����+lmx�7��vV��n;^��<`���N�� �*�����trGwB�+���#�F��i��T��F=Cq�P�me�81��fd;ժ����|p�;ʒ��v/�]"瀐�ۋ0�_�I�zk��m-�I�;��� w&tR���ΈO�Oڼ�d�� ;1Y���� [k8�`�y�$˦~tI������Fy�7��T��G|��dÿT��$Aȇ.`RN�Oײ˿�Zzh���e�.�r�I+"f����a`O]W�l�����A�:y̝}�kui+��g�� S�3�<�^g���"h�*�&^��?�:�R^� 8'��9��4DX�R�XMHo9<S�uR1�hB����ɟ���F{ḵܭԝ&��eOfQ�VIqz$��ן�'Mv�j����yfwg���9D-��2<Ǔ�uc|A[���*�{7�4��������.>|�ͺS����ko���X ȹ�;a��ё��w����6�/���]k2��/�\>��;��5x�t:S$^�I�����C��{^M�ۯ�v�<��-�,����@�A��@Y|����>����Q �^�F��`Wz��y%�����|V���U_�R�kD�����E^d��9���]_���uêt�.�oi���G��_)���/Gq��Um��������j
Static task
static1
Behavioral task
behavioral1
Sample
e87131c27c40feab.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e87131c27c40feab.exe
Resource
win10v2004-20230831-en
General
-
Target
e87131c27c40feab.exe
-
Size
5.8MB
-
MD5
b5a10728ba66c8dc379c78ff8e67f377
-
SHA1
50e71c691ad66d90fe618cf32d83e109c4bebf1b
-
SHA256
677eef3a671798b2c946415ed44d97287a6838b58419e17f6fa61fdeb948ef70
-
SHA512
dc1391a6ca3fc26db4c2318dbb60a0b6b9c42387875bd7c568412e7430d5afd66a44f6a1606d7a44e5d643001bccbed6a38a2211ce70f9388fe471927913da1c
-
SSDEEP
98304:5chemjoy3tc5oTYpwdmcKc6f8em4IudcoDDkEu04FhzOq2sjdrGR2R:5cheCoMG5aiMmcKXfxmloDDkdBzOq2s5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e87131c27c40feab.exe
Files
-
e87131c27c40feab.exe.exe windows x64
7748ce1a2b7499e07d0ef9064555d429
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegOpenKeyA
ntdll
RtlInitUnicodeString
urlmon
URLDownloadToFileA
wininet
InternetCloseHandle
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.?=! Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.k|s Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.KaY Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ