���9�����KM���j�Έ��zO�~�+C�wm�/����G����}]P��f����l��R��#�TcU�c��X`�k��=��Ql8*�T��a�;�:ۘVl��l�g$��)y={��Tu!��Q�*�õ�$A��t#�����J�x���4���?�E�)�����VF]e����b������xRcO��G�n�C��Wq)�q[��.^"g���x��U���@gѢ���m���su{;UC��J�ԃo=�Įff(��ұti�S`S��]�s��N��x�ݕ�� �"9mOGs��*��蠒�5M�iʨ����i��O��N+q����Ud����5���%��C�����ɖm���D�V�Y��>��YT�[X��c &!u���y�}��'��ߏ�F�$&.�#�<ì�&H��l�za d��T<���{��'�9��<���R � ��*�����C�/���z<�����&�;^��R��� �F&���T���3|��&f`� ;�D k�q,�pv����q�0w���zE������TQa�����-�t^wedc�LC�sY�K<Ipu��3 ���y�P�\����+�r$�¥�`�~��}�1��}6$u�d��!-뽵y�=+V?��s�M�W���I$n�"|J���Y��#�0̨bt���ge-� �Wt�ϧ��6`mS#���o϶��� � S� ��(��Q������Q�h�,TËɒ+��9�z� vGJ`s�J`�m����~]�OuQ�%2��xG���h`lo;6Đ/�>n�݆l��=9�E!�NS�i��� ��H��V�ޏ����l����ER�'����HZ,!�O��;?� �%Z���y�O�D�%<]4 ����Ȍ��w�H��IU�0`�罡(+roS�>���C�= ��S9���X����-���:ƭ�F-�8�e$�+�~tL����Xt�SÐ�[v�KC�������>c��~Y@iR@G�ej|�x�7��^��jP� 7TuL�H7��u}c$�~E�� ����x��t��/�G@���!$�����s�5��Wm�pT>���t��Ʀs�.� ��f'�Ͽ%�h��ն�^-��T����-���t"�2��B����� �K���ߴ�X�鱹a����?�W�؝���M�\_����A�}������\(�6X�$~�h�p��M��yf�.�\-��B�> �'ٚ5�t�Pˁ���"]��ܚjdz0ɘ�v��k��,TV,r��Hg�/z i��z�*��^8�}�h�����7_^�7���ϥ����ֲ'j�pT䪮>%��TO>�X���#�x ���9XKDZe |�ֲ)z/ �*��ɠ����Z��Ln�� ����s"[ʷZ���C�R���s#,�b{7c�8�h[�� �ٗ���� �c<E��kXD����U�t�E %�0,iZ�ܘ���l���=�4�HC!$jm�B�6n3P��+�髉�g���K��|�P>Bg�r;?}mAǧ�@����?�jn��_ �b������ wZ��e,(��AYv��*��)}��g�"9~��u��-�1��4�^�G~1/B*���D��"!fQ,���0l�Z��p�����O1��IG���n��-5��L<����͔EwZ��� �`�X�n�[K�y�^OG���I����5)̕X���3�QuS8���03 �{���>a��b��7Z�AO9��~�]���� h���bȤ���?B��w��s�5-4�d�#7��b;- ���O�z�����&I��2�����<m��6�Cd���Zv���q���2s뻔,B,T����� ���͌o�zp� ����y-�z��l0�$��K����N�r�>Ȉ����ފ=��K���]!)4�� K����sk�C6��@���a9��O�X�-��3������)A�~$ D/E�t�F�rvkg��c ,�dM�Χ/� N��H �O�#Ն :�ٮ��\�"����B�m���>�|Ȕ�K\3��A� .�6mv0Dm�kE�4"�����v��k˨���[�Ҿ������#��9l�]�6�k���V&�=��S�Z�5h~7��4��W���P�M���&��翘M�������So5N�S���ԁ��r@,ÀEs�h�<��F�7j��t�%��̬W$�Ԭ��8Ԃ�պ���n ���ތ�������F��gP4�⮻�����8�1z��)������:����v��2jo"�$G�f�����RR����*Y)�dޘ[¶߂y�����v�>��,�I>RϹ��hD��������� � ��a�|����@Gy�%�j���D���_���)' 0�m|��e�������0ei~���Gy�Z�$_w� =�.�j{Kp�<�hYJ���6~G��>�^=��>���y��B)IjxL�=� �e�[�[�CTr���Heלƶڍ�Q 0����������VtmIY.�)��lv������#��vM�W\��k��&��@1Ct����i2���gQ�!�LCQ�������+Bk@��� xً%�9i^/���1n2���� ��$�S��D0�� z몦eB�6869Z�Vu �2����}�w?�?R_��� �35��֧6s�۟z�ԑ��`$��+�>�KZ/q�����O�-[�������@���R�!$����d��� QW�X7w#(i8D^�L6)����%�n�� �l5f�9J�����c�D�#�fU��K�*�c��_����$�G�&�I��>�X�٨�o�TL6�:����ɀ��L���Q��Iή�1 ��Ǯ�*?����]����e�\P�;�,�($|Տ!����,�W����G��U2�7��ԃO�����+ �|�0˘�x�5ȏ��\�y��{��X� ���D@͈DEnc��Z`�[ 4�������j嚒�� @��0Lj&{ƾǪձ�I�<R���Go��3t���3 KN��(5�ږ4����c��(�� ��U5$[�b�F�7PE�ɮt��џ����*}o�ݣE(0���1 Of>- '��,��ٜ��
Static task
static1
Behavioral task
behavioral1
Sample
efa3983ad0ad45bdbf68ec33e9546fc70bc7a581e5e95d1a99bf252e91875585.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
efa3983ad0ad45bdbf68ec33e9546fc70bc7a581e5e95d1a99bf252e91875585.exe
Resource
win10v2004-20230915-en
General
-
Target
efa3983ad0ad45bdbf68ec33e9546fc70bc7a581e5e95d1a99bf252e91875585
-
Size
11.3MB
-
MD5
4d08835afd39ac80d722bb70ed66f91c
-
SHA1
6445f90159f3b1808862af99c1a0fc398faedeb6
-
SHA256
efa3983ad0ad45bdbf68ec33e9546fc70bc7a581e5e95d1a99bf252e91875585
-
SHA512
50fbad85391a6f78e0c902a950c82ddac0dae37d735b460321f56155e76da40eb6662c0e3d7f876a908ec960f4091fa7bd7373a4c2607e2bf669f98b8cd5c14e
-
SSDEEP
196608:wy2oIJblgeWNYPtRzC/76ikedvSxu42JbsL+CZNLm+aKk4ahtPxCH2M:wvT6/KFRzC/76+vWibsiCLRaJtP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efa3983ad0ad45bdbf68ec33e9546fc70bc7a581e5e95d1a99bf252e91875585
Files
-
efa3983ad0ad45bdbf68ec33e9546fc70bc7a581e5e95d1a99bf252e91875585.exe windows:5 windows x86
351e205464ada98915c94b25d46b71a5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
LoadResource
SizeofResource
FindResourceW
GetCommandLineW
SetCurrentDirectoryW
WideCharToMultiByte
MultiByteToWideChar
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetPrivateProfileStringA
FindClose
FindFirstFileW
LocalFree
LocalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetFilePointer
CloseHandle
ReadFile
GetFileAttributesW
GetComputerNameW
GetSystemDirectoryW
CreateDirectoryW
WritePrivateProfileStringW
GetLocalTime
GetModuleFileNameW
GetTickCount
GetPrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
TerminateThread
WaitForMultipleObjects
GetCurrentDirectoryW
InterlockedDecrement
GetTempPathW
Sleep
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetACP
GlobalLock
GlobalUnlock
lstrlenW
GetModuleHandleW
ExitProcess
InterlockedIncrement
MulDiv
lstrcpyW
FormatMessageW
VerSetConditionMask
FreeResource
LockResource
GetFileSize
CreateFileW
GetCurrentProcess
GetFileType
WriteFile
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
SleepEx
WaitForSingleObject
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
SetLastError
FormatMessageA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
FlushConsoleInputBuffer
GetCurrentThreadId
QueryPerformanceCounter
GlobalMemoryStatus
GetSystemTime
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCommandLineA
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetFileAttributesExW
SetEndOfFile
HeapSize
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsZoomed
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
SetWindowLongW
GetParent
GetWindow
SetWindowRgn
MonitorFromWindow
GetMonitorInfoW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
DestroyWindow
SetPropW
GetPropW
AdjustWindowRectEx
LoadIconW
SetForegroundWindow
CreateAcceleratorTableW
InvalidateRgn
ClientToScreen
FillRect
GetGUIThreadInfo
UpdateLayeredWindow
GetWindowRgn
CharPrevW
DrawTextW
SetRect
EnableMenuItem
AppendMenuW
HideCaret
ShowCaret
GetCaretPos
GetWindowTextW
GetWindowTextLengthW
IsWindowEnabled
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
WindowFromPoint
TranslateMessage
GetMessageW
LoadCursorW
IsWindow
DispatchMessageW
CreateWindowExW
OffsetRect
UnionRect
InflateRect
SetCursor
GetWindowRect
PostQuitMessage
SetTimer
SetWindowTextW
GetWindowLongW
EnumChildWindows
GetClassNameW
PostMessageW
FindWindowW
SendMessageW
GetMenu
ReleaseCapture
IsWindowVisible
GetWindowThreadProcessId
GetShellWindow
GetDesktopWindow
GetForegroundWindow
ShowWindow
IsIconic
FlashWindowEx
wsprintfW
LoadImageW
SetWindowPos
GetLastInputInfo
KillTimer
MoveWindow
GetSystemMetrics
MessageBoxW
SetFocus
DestroyMenu
TrackPopupMenu
GetCursorPos
InsertMenuW
CreatePopupMenu
GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExW
RegisterEventSourceA
ReportEventA
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
DeregisterEventSource
RegSetValueExW
RegOpenKeyW
RegEnumValueW
shell32
DragQueryFileW
CommandLineToArgvW
SHGetSpecialFolderPathW
Shell_NotifyIconW
ShellExecuteW
ole32
ReleaseStgMedium
OleLockRunning
CLSIDFromProgID
CLSIDFromString
OleDuplicateData
DoDragDrop
RevokeDragDrop
RegisterDragDrop
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
oleaut32
shlwapi
PathIsDirectoryW
PathRemoveFileSpecW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
urlmon
URLDownloadToFileW
wininet
DeleteUrlCacheEntryW
ws2_32
freeaddrinfo
getaddrinfo
WSAIoctl
gdi32
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
GetTextMetricsW
CreateDIBitmap
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateFontIndirectW
CreateEnhMetaFileW
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SetBitmapBits
GetBitmapBits
GdiFlush
TextOutW
MoveToEx
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
comctl32
InitCommonControlsEx
_TrackMouseEvent
gdiplus
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipLoadImageFromStream
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillRectangleI
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStreamICM
wldap32
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 444KB - Virtual size: 444KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.png0 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.png1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE