PQ� ��r5����}E'�v�m�.�.��Z+��B!��t�/�8^�>��ތ�P�T���5��ߗ|D�l)|�4�U(�n��^����_S�_�M���{|��'4���a�n����It`�������(~6ISO���yV�e�1d��Q<�h������y��\K����������ۆ���k�5ؚa]\ x�L]o���!�I����ˈ���09�ւ�C���/��l��ILC�.Cp�̀1)��J�F o�J��R=y��|���KiM�ZYA��*� ��Iܰ�ѵ t� ��Bp,�Q�B���%��3���>��E� ����p����(�`}�&��¯ci~tԦn�8�S�ePb���݃&+�{�"K0+s�j�qd����B�rCiJ�wS��9�� �Cg�Z����]�m`t~��8��il,U � �}-�o���*5�5⍒K����^�Ћ�_,K�F{��@�Bg�F�0�a�t[�-K�̟�>i� ���h2?�ʐ,�VJ�^�&����N_��v�O��i�����S�L�rT<���Ɇ�K*L!ˎm�:\�����6��T���M������4�!K ��d��a?�Zbl5��J���+�E�t�.[n��4S�n��]�&�b�Ҕ6�+')�DV�b���mMx���_Z���_�JX���c�Ƒ��㛂��C^ס�tr��9�f+��(#���?�:�r���"��e�����^1�Ѳ$ܨʉ�����_A��R'�^Fw?F��E�����XT���\"����#��i�^�[oD2 -pYH�!r���nl@�����MP t��� �'2�3�: Ծx��>\�b����*���A;5���1Y&�nRv��q�HWc[��úY����g]��.����0�7�)�i,Y���z����P�TՔ%�,t�ܒo�N1�ֵ%185�>=��.���p��/��l�r�O& �؋�%D�"j�(�Zc���{�aM�nt���) B����hN�B�>sZf�D�.�櫅�J�W�Wo������eۿsll�P�ڀ�B�D��@I�7�g�����C�#���a�U� E1�3������Ů�N�hu0�y]9��Me�w�\���W�{�m�Mh���N%ɘG ��WZ]�HsׅSgQU$�S�w���۾[ۖ�,��#j"iwZ5V'O��o>C��8B����c4��b[pN�J���{�I�_d�oi��y��A����]W�)�Z��[_�ֳ�x�2��n g#��|�����_�Y��*�{VFu���)2�Zvuf̞Lw��a��[=C�?�t7�5u���g��.�������n�� p��'���#�i��wuQo���U�n�1��]xғ$w�� <��e����s W�� ��xN��j\�8Dr�L����J�1_��v��8�(�lt���(&��N'd�h��?~�/� ����l�w���+���ΐL��n˛�o����N�(��/ ��"�hp-'*�%���Չ8}�CB�e��@���3n�U���x��OA/�?%��C0� "��_�g���m�|!u~�TYc9Ӈ�c��*�LH�m}�}[e+jn(m�y8|aD" ]�Oߓ'����}H��#.�T���_Ռ�,��<�ݚB�����������B�2��.Zs P��t0b3/�8���rq�a�������n��9e��jS�-]���cZ��H�w���W�B�צa�5@\s]ݡ�Q&R�"q�l�ƻ�.G,�����)�2��}�f���_���d.P�F�I��#`U�]:�K�P����\4�}jl���b���y���UQ�-7�G�Y�ⱗJ:�X��d�g��(�־�����,)�^�' �}�C��3�t��J�v�寋��4y�5�S�� ���֗����x��Z8� r 7װo��2�k.�V�OY������d���m����zQ�f�ލ�T4���H�]��Wy.�.���97�^�u���w��G���8�Y��M�7L$ܙ��ss}��E ��<FN���ˏӂ�L�&p�Ӎ�B�w�{�� e�>x+`Zh�m���l ,/�RS������p������ n�����*�9�4R�����,�Nv�fc����(/���X�Q���⎀���K9���o�ԃl!���U��A�[��zyf��n���9+wSI%�h�;B�f�$)~������Xlyy52R��\ÿl=֪����˂�e�T�hH�~�nT�S�@nŎ-�x��u��=IM�^���f~1�*�<0dJ9֔_��'kh)D�Q�s�� �?���T&�����Д�'4������zT,i<X�9lGh�&.�づ@�W��3�6b�#�"��>� g�i�o<1�Ymx�k[���y���OB3)42�!0?6���;WWėe��c���c1 �\f��Æ��<tGA��:ye9�?&v�v�?���ve4����u�і!��6��)0�TzK�>���Y>Ο*N���1�p�7VO�@��Gg�DD�Z�=��v9S�K��7����a{�k�Bb�-�/�+_�����́j��Muq�U�U(u�R/��+�~{�M��@l�O,̡��,��_EAJn�l+f���8b���F"�_�� :$j���bp���[�����ܝ���e�Ē��XxE�F�X ��F�|���������9�E!�dZ� %�'�����c��s(��u.��������!ŠH |$� ���]��#����5������* ��BW�1kjm��Vjj+��s�Y��h��V�}�ͼF;*/2+ekԎomś�v���vDa��h�ǯ@���*Ր�TA�7a>�3p3�W.�&�[�'���T*��,��#0�+�7lu��8�������7_��M�Ҙ�j8�7Ց���R����f((�څۡF����G�� >��"|1���ӢvW%:��ޜ���Nr۳>Dcë�0DDJ� 3�.�e� �n��zJ����8�)�鼫�S��@� MqB;�j�i={���ne��;\Q[iO�9���_6�#��N(���
Static task
static1
Behavioral task
behavioral1
Sample
143b60656e62b41a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
143b60656e62b41a.exe
Resource
win10v2004-20230915-en
General
-
Target
143b60656e62b41a.exe
-
Size
45.4MB
-
MD5
2378b6d134777185b973a4138c2137b1
-
SHA1
02f1111e12eb9fe07f215939e3cb8aacd068ad01
-
SHA256
f079d08296b841ad96647b5026e2e8de7a2215997db184126cedf615c23a985a
-
SHA512
b0b5b78e1c7cdc8191fae8476209dceb48f604894fb1809b7b21d0cd31390d8da0090c246230675fc02db7b46c17a2d04fa02260ed2e9901bdef1924343289a4
-
SSDEEP
786432:emLhqCcVugwhrUf0pNoo59y13evvK9AX/jvZvJgp2+ahxV27taa0NGp:eEzuu7L8VeKk/jpyp2+Gb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 143b60656e62b41a.exe
Files
-
143b60656e62b41a.exe.exe windows:6 windows x64
1553de9b4c1010f2d4d465830773e434
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptEncrypt
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertCloseStore
ws2_32
htonl
shlwapi
StrStrW
wtsapi32
WTSSendMessageA
ntdll
RtlLookupFunctionEntry
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 875KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 355KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 41.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 45.4MB - Virtual size: 45.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ