jE�˷��v�r�U��P �ŷ穧Ke���ݻ�-mVS{��G�)�'/*�>�} 5 {�Y����H���y�C�r���A���T�����p��#���M��"��Мe���^����,k*y�)��ä�O>T�����O�'eEMm��6��%�e���q����[� ҟ Wx?f]����2������xD��%�lG.���8�s̰Ȕs����+�I����~H���C�V�u#���U�J��y1^���b��a��ގ ���J�h.#����F��\�� %��#���ׄ'�L���NJUM�;_�9w�GZ%��wD�0���t�1S��;D�&?��\�X���I�8p�NуNx��M��1������� 3\mS.Ut��S-ſ��P&+�S,��c�T���q���ȷ^G��g��]�@�o��0�0H�~n�0�����$�դ@m�?$U Hi�&%�H'�<l��*�Ą����`�T�ھ��2k>}�%���լ(/;×������b'x4H�PG2b��Qܿ��+��X:�aEϓ����)���V~w~hq��R�қ7J˯G֢h�!6f�L�@�G�j�y����6_�� ��#��+W���'���^'�`w5�����k�h�� X�I����!� }����)��&������of�^���_v]��`�v]p�+t��Z5^�u/AC�� L?~��V81ze)��ujF�P�v�;A�`~� �$К�{�+���[*_F-}MS��`q9�7�=���B9PBsK�� ��GVAi�~Q}��������>Ʀ=f?gד�!zD�剴)������v�M����#�L5���&a��zU��<�8���s�� �J�� J]��11���'\�}&�wĎ�?d!ymu�8�G��JV?�����`�� ���Ï�rF�'���U�hC�y�h���!���|�|��O. �ŵȧ}Q���˦M$�bu�o~&r��j�&h�{��2 �1�LHFY�����.�lb ��pU��7m߷˭�6��(���+���u����k���$7����;x���v�����n��x��<��ٗ��bBu�#p�6�����)Yyu:YT��aas�h���5l��ʂ����C�b*�V�^��� s���Q��u\�=#ަP!]�U��e,a��B6�����WL�2vrL��o�,>���ルsXK��,^�ő�~\��]Z��V�9� %}�<�S����VGuU�m�ra8�S��Y��E�1$�6��������U�ٸ���Č�����3&����2=(��W96�sV �-K���e�8~� �/'vF�ѵbS2娱 ��>oy��֪�Y{ZW�#���{V��VO;��ꪕ���ݶ�u�=�L�uo7�>��f��r `�5�g͚��^ڧ*����Q�r����I�z����#<�^�Z �M:.K�𥳐_>���Jg�I�0W+9�Y�3�*���:@+���C^�}tVYg���w�a׆ ڙ\E��,7+MC�g#�߃�PW��0UMW�7��~�H(�G�0iy_��Dy�S;��t!� ���m�h��2��H�_O�[x�0�ؓ!I�RL�^�i�M����l���uJL��ymj� �?Ђ y���gӳa��.�Ӑ�m��-G��Io�D�ԄZ��wD��j%�f���yd�� M�k�;�� C}���[�ߑ%�.����<�6 h B`��~��ۯK�2p�ëd҆�18|���p=��y@{�cE���;�-q���4[��.�O>�!^fzq�&��0��A�Mq����ܢ|.W�G<�p����Aں���-�`p���a��`�����e9�'Z�Tk����1����E(�,�e� �6)ou5KO�79j}C�2�2�cD��� �a�$�$�9�ny��L�GU(�5� G�=�$��q6F.�M�����RTh�B���r����p��f�ͻ���ȾRaG��RW%� �-{�P�"}ʟ�x��\P.��uLŨU��\ǹIb1Hl��Qn�gj����n��NWcZ�#)��{�au���;GX<D;L%@ƈP���Ws����t]�G����B�DY]K�r'UUk��3x���!�oݳV�W��w�RdQ{�Hz������ml7�� �Jw��%�O�g,����!)i��ou�~-��S�+k|�;.�F�t�s-��A�y�CLr;ǃ�<&јkR�H`��l�]І�cBP{{�2{� � �N�:Sz���:��R�%�1v���M�N ?�)�Xf2��֝y=d�5<n�.��w��v�[�ǣh���ͥl�r� ��$F�6|� ���OP#*U%�g�N:�\[sb�/�8��2�&�H[����{��圊�|l��~�n�I�I߲9�t���n�5{��ᇇŜ��fD��; ��"���P�.�oTs�8J*����E��d����� Pd�P�SQ�J�� ��������r��U�S�O���� � ��,��!��1 ��;���Y��j2����*�/�8�e���G��O�2 �T�T&�H�w���J��JZ#:���p:V-�e����n}V�+%����l�E�����}�kdTCe��>�ڌ�n��v��5svӵ�쐾�^I�EF�4���*��5�����=�=c:�^2o2H�m=Pf��]lkq��9.���6s'�{�i��"�G_Y2���y�#14q���7"���ͳ�r7�G9� <Iׂ ��I�V8�� �ELr(��EN9�t$A����t��I�_1f���u��W������#-{��5�k�X��&h��/�)�f���W.�|N��?�ߟ����=�?$>Lg&��j�.v����k�^�`l ����2�� V%�`�Z�t.p���[�\��Bce��&1{�%��n��0��+L��&e�M�j��4AO�9����?�6m�As����Į"V屈�O�7g��nf-HA�4C:����2�}͋vO!ݫ�a�|� ��N5����%���ϸ��,�f��RZg�9�Q���
Static task
static1
Behavioral task
behavioral1
Sample
3a95dd727d1667f8d5bbd14ee880fec01eccbd898cd8e8e26b42b2ecb7f0d8de.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3a95dd727d1667f8d5bbd14ee880fec01eccbd898cd8e8e26b42b2ecb7f0d8de.exe
Resource
win10v2004-20230915-en
General
-
Target
3a95dd727d1667f8d5bbd14ee880fec01eccbd898cd8e8e26b42b2ecb7f0d8de
-
Size
2.0MB
-
MD5
7e82c5eb42fc086fce23c1daea7bdcdd
-
SHA1
0be9f16cc71979a5e1f3f0f07cfb68dd9bde85cc
-
SHA256
3a95dd727d1667f8d5bbd14ee880fec01eccbd898cd8e8e26b42b2ecb7f0d8de
-
SHA512
3270ae0bec3ab489b9a0e537330acc57c8535c5099b0eeedaf1338ad04fa2e2977e62d1522adb2cb7d121cdac69578f6d81949a23a79373703ec72df37d7f45f
-
SSDEEP
24576:eLc5uL698PbIHwiI5U4ktvE6mBcrcP5cCcO59g+iEDbBVxlY5urr8DQ9lbxmNePB:pYL6UKw3WIV7b59g7E3Uqr4+lF1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a95dd727d1667f8d5bbd14ee880fec01eccbd898cd8e8e26b42b2ecb7f0d8de
Files
-
3a95dd727d1667f8d5bbd14ee880fec01eccbd898cd8e8e26b42b2ecb7f0d8de.exe windows x86
cd1ee025570816d66e1b644c4b305f4c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
GetProcessHeap
LoadLibraryW
Sleep
ReadFile
CreateFileW
SetThreadPriority
GetHandleInformation
GetProcAddress
VirtualAlloc
IsDebuggerPresent
CloseHandle
GetModuleHandleW
CreateThread
InterlockedDecrement
LoadLibraryA
GetModuleHandleA
VirtualProtect
lstrlenW
GetPrivateProfileIntW
VirtualProtectEx
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
SetUnhandledExceptionFilter
OutputDebugStringW
WaitForSingleObject
SetHandleInformation
HeapFree
GetCurrentProcess
HeapAlloc
CreateMutexW
GetFileSize
SuspendThread
ExitProcess
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
FreeLibrary
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
LoadLibraryA
GetLocaleInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyWindow
EndPaint
LoadStringW
MessageBoxA
KillTimer
SetTimer
BeginPaint
GetDC
RegisterClassExW
PeekMessageW
ShowWindow
CreateWindowExW
LoadCursorW
UnregisterClassW
GetSystemMetrics
UpdateWindow
DispatchMessageW
DefWindowProcW
MessageBoxW
CharUpperBuffW
wsprintfW
gdi32
DeleteObject
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateSolidBrush
CreateDIBitmap
psapi
GetModuleFileNameExW
imagehlp
CheckSumMappedFile
comctl32
InitCommonControlsEx
Exports
Exports
Sections
Size: 220KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 620KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VProtect Size: 616KB - Virtual size: 616KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VProtect Size: 16KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VProtect Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.vmp1 Size: 476KB - Virtual size: 475KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE