�6�� �a��S��@P_kvr��ѪL;8�zX�=*nj��sު���ƕA+��k^�dS�آF�]hWW��K�&f��D[�����@�J� u����-c�㢝@,|}a��yE� X`1Y����_��C�ë��#�2W�cFG\Ԏ��<X�ĭGn����M7�Kv�X��Ο�ڶ�5�d\�=���X�����<�59 �l-�%�x����������zXw�N:���+%�&���]��� �|��0�`h��b�Z�\����"Sn��SK!�2+�m�p�͙C���M����;&�,~8�eF��WR�b�B��ׯ� +���*~h������S�!?@|�����ї�M���P !��)�������� J[f�)5|d+yYҶw�=��5�u`�Z���k�vd��FN����]�&�4w[��%v`��*���7`�%@�эW����{2�fƩQ��i����I�?1�ǝ�័ˍ���9���N���DvA��#"���u�/5*yz{�S�mi�����j�N�VX��f&r�{���$L�橤L��i�J��=M��G���g>u�<�&����P�Pv�=����b����=m���7?�q֠n|���/��jW�wܦ-�YX�h�~�g�S���_�=fX�rIT��m�R��Q�c��H���0�V����@E�s��džm7��QE+|�^La2TT��M9㺎�s�p��hU�}{��&����Ǧ&�E�7����ϓN����ԗ�xƇv�����M�&S&#�D��k�����] Y+_��������'~lO?�h]��xxM&��n&�a�1J��4%��E["?���������\�A�t�y��'��T���f�:.�W*������l���fn��@�U|����;���8P�C�Ҭ������KF �خ'l|�<A����|N��r@ �ʀ�H��i�R�p/�]���+s"����3%��������NR����)}�26@u[�se�}�_�M����k�``��vXP�n�>go ��9#�(~��A�� ���X$Oa��O#m}!���ۓr}mu7C!mfasi�M���48��JN���ȗ�PO��J���3�7_�ys���ʣ��H��o�Q�"77�4��X*�%p�EI*�N��*l���ؘB=�%�����{�R^P�U9tj>�� "վ!_���Nsқb�x=�>&#�HR��Rx�>"��,��`������W_H삐>���ŷu��O�Ӷn$�X4�S�L��J%�<|�� ����} ��̘�ڣ��\5lS2s�/��C�O� �� ���$B��L��n�����K���-�勈ƪ����Eb�v5�fݵ���z���o_;�A��X��Ha���$٪TmOB��$�n:��-Q���.Hq���8U����sD�"�v�~�8�vǣ� %��A�>'�@��f/K������/�U�b��r�̀jOW���Wj�>z<��jS����%{W�d̃��� 7��QsO��ר\���FmTм@�]������u�5H3�r�۲<�B�CY%is.�������A_±fLWq�#W,zI���'�p@���T��C�J�+Tf�}�*�8-��9ʂ��>p��nee�2�4{zX�a�}P<��h�<3���rZ�����d�ر��������Y'ȸ����+��=�,�d�����V@�bZ�r��"���p�]��% 6��7r{X 'n��NR��ܰ��k���u����� �Ff��?��,=z.�iL���}F�d�|��i�l �`�ʎ-��_�.�P��B`�6|8�[�!��#h�����-���X1��d�}i����%�[�Bg�W�{�jn�D�����p+�V��ޞ�JJ䚣"����&D��Y��~�ռ��'��%.˸U-�ͱ��:��=�4��w��9���c��[����*����fѺƵ�51%�ٰ��Ҍ��Ohg�\]6�� �'�u�J����o����r]�i�/�.��"hto/s�ƴ�ܺ�ǵ':��M�f�����\Փ:��=6�����8��>\5�'�P���� w� � r�ހ�W���(�]�*��sZ~i� �0͒�S���O�w8n~(������R$��<���������sOu�����G������G��8h��S�������W��V�"}�,�O��fEL�JG�4�c/a9�Q(�"G˨DZ*6��� �ֱ~�?e��v��,M7��8��ւ&���4:��a �z�� -V��%�1[����o��# /ɝr�Q���;�I ��.�B����_Z��O_.��"����^i���-��,��s�y���.�v�-W\Hɖ������}X��P����s���P.�?����u�Dhhg3=�M�"_U_�'y�-}�d�V��}������4F���?̪I /zQ����DA�D}��[_���xMNKy��#$�_#��bh<q�W��ӊ� ��T��0g�/'�m⛌wp6�`j`y�6��"ȟ���wÕ�D,]U�w���_B�-8� w.T@���NI�7��~ ӎ��A,Hdm� �4����Z���o.j���&�hXLq������v/^p&)>5*��V���X�}�8<�q�rkE�q���=��O1��&Z���eDT�.������M�\ǒ�O�"s(���'I�M��d��Pw��\&��j�)$n4���X���+�8�V+���۞'�Xd�a���˜-�gmOo&�(G���A���S�.Z����!�����>=��yO�Z����=K��_�Ӎ~��%�� o.��s| S����4���8������4SnE���K�W�~����r2��'�e���zY�1�����@[��L��<�j)d�C�̧�^œ4�~����'�g��g"Z}hP{�e�����vT��� K�S醒yV:X;�#[�x�^���R�t����:M��oc�������䚌ф'}8�Gi��cs�YekЦ�1�9B�a�A8�1�Ú���y#�U펂�ck�~�֭��c�Tb29T����ڝ�Z�&����WG&_W^���@�t����6gJE�
Static task
static1
Behavioral task
behavioral1
Sample
Desktop.zip
Resource
win10v2004-20230915-en
General
-
Target
Desktop.zip
-
Size
32.6MB
-
MD5
731bcc35dbce160485d17e401b20fed9
-
SHA1
0c337a66a5b0a0156b96926555539a0757d11f25
-
SHA256
a7d7e878a1787c8d39ce54b4d57540d541483c1a5f57c534e5ddde24ba599af5
-
SHA512
99429a32476933cd878327d07d5eaf24fddce4701f9f4915af615ada3f0f4dea24ae69916aa9d7119a2aa9d8fe72b7565342ae6c68df243ea732d217c3f9181d
-
SSDEEP
786432:Ap2bq8vcV65LOSgOcOmJihaUL+w0flA89yvMDvfWDmUB:+WvcVsOSgOc3whxLlEU0uDRB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Google.exe
Files
-
Desktop.zip.zip
-
Google.exe.exe windows:6 windows x64
00ec79d38140327a3c9e9df18f0ee262
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
OpenProcessToken
msvcp140
??1_Lockit@std@@QEAA@XZ
winhttp
WinHttpOpen
ntdll
RtlVirtualUnwind
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertAddCertificateContextToStore
ws2_32
getpeername
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dpE Size: - Virtual size: 16.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.h6N Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.G1+ Size: 22.8MB - Virtual size: 22.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Process Hacker - Undetected.exe.exe windows:5 windows x86
Code Sign
7d:e6:61:e7:bb:da:51:bc:4d:35:6f:66:65:69:34:faCertificate
IssuerCN=MobileDENot Before29/06/2019, 20:37Not After31/12/2039, 23:59SubjectCN=MobileDEExtended Key Usages
ExtKeyUsageCodeSigning
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7d:e6:61:e7:bb:da:51:bc:4d:35:6f:66:65:69:34:faCertificate
IssuerCN=MobileDENot Before29/06/2019, 20:37Not After31/12/2039, 23:59SubjectCN=MobileDEExtended Key Usages
ExtKeyUsageCodeSigning
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
93:4f:69:e7:55:8e:b9:38:48:b3:1f:a6:4b:a4:f4:0f:3c:d6:dc:7c:d3:b0:a4:b8:15:5d:61:e7:f3:cc:a8:e8Signer
Actual PE Digest93:4f:69:e7:55:8e:b9:38:48:b3:1f:a6:4b:a4:f4:0f:3c:d6:dc:7c:d3:b0:a4:b8:15:5d:61:e7:f3:cc:a8:e8Digest Algorithmsha256PE Digest Matchestruee3:b5:d7:ef:e5:19:88:80:99:cc:6d:a9:57:33:d2:c5:19:41:41:4cSigner
Actual PE Digeste3:b5:d7:ef:e5:19:88:80:99:cc:6d:a9:57:33:d2:c5:19:41:41:4cDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 163KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 43KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.38rlqw Size: 7B - Virtual size: 7B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Zoi1JH Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE