]��r��s[I��u2OπW�ju]*��`���LW( <ՖZ�is�O�"�UO��� +�q�:�x��"���oh��2�4"*��DŽXР��.A"��v���>���?��?26��T$�9�����弚����K�K��A��{�[C9��Z���"&2�}1��i������E�o�tĪw��eX�k\��PĈ����P��D�' e�=�>K�w����~�gc��=mٿ�OCt�,��B�J9F���?���a��z�.B���"�r��_��v�k%��Hj=8X5R�� T�" ,��(f��p'*�+�"��v�����Z9ڀk�{��n#֠A&�(��{�����egb �"^=�/���A����9����;����ع��QD�9o� ����:��]�q�Rnr�t��m�{?� �WXE��7���5G��i���]<�� }JСYz�� >��z�S�c7Xϊ�� ��Gh�����Ca1:��Q3�x�2�v��-:\.��!8����BXEC��Ź��,���y�AD�_x�A�v��ej�"�BWpC�N����0� �j�W#H�YYt�X/`J��$�6��3�χQ3oq�F�����qsfz@����=}$�P�}� ��5?C]-��_N��tQ�J̱J�sov'iG��w�^���@��/�����}��9$$�ɐ۽$�ЄGP;&i�}ܝ��&-�]�_��iգg�`n�ެ�=z]d��Z r���*`4���b� �~G��+�J��z�c���h4��RF���tn,��!^{�wH+ຫ���G�Ի�g�uk�����py�"[�k�b��Gė?ݔx��i�ϯ����XQ����Dᛂ��coڊ��Ԡ�"]܍|@>6�UQk<F[NP�?7�u��vG:o�Ne�3a��L��������U�}��(㺗*]���ߌFW�����.���D�6}�7�uXK�v3H�Mc�a�}�2�Y�QUm��U�+�(U�1%,�E} �\���y �����~�0C��!C U͛l��x����������?/��6\c����nm6v�c��;:,�{lZ���%9����y�F���`{���`DƷ�q3������Q�r�2����K������Qh���� ���U0�>�ЍD!�B1�6+��=bE�Fm7�A�LN]�<M� C�D*�o^-H�jt�9�; ����Q�Kr�$b)Ҝl&9�f�]�+�*E(��|q�(�;�0A�M!���4�P�u�'��Wl���+~l���lQ�ރ`��M�(��B@Xm�$t�R�l�'�K�7]Wڶm�!� �w>��y�%`��Ȏg���=Ͼb� ���eKw�e[T- �y[�V ;��20I��V�egF��Ȃ��g�n Ƽw�����Xx§:&��!�'Z�=H3.���fhk?]����,�o����� Ζ��U#%u�x���ڎ���,�>�R��m*h�NǏo�S�#��he��ϛ�P�N ���l���V�DTlf����V������|�Gꁤy���1U��������8������t�Zez�q��y�ř\���8��o[F]鏶P�[������O�5����c�3������ՙ;"�����h[Z�E�D4#OrV���?��փ����r��d�����5�t�?z����;�;�:Ѿ;�wGd����]�V�pw8�J~��.}�x����$#��#����/ 4L������T�1�J�c�f����{�~_gA�H�:u I۩['b�0H�ԉf������9��І��Ë \� ; <A2�?R���1�����`��ߪ�|�܀R�I��O)� �t�WخS��O ��d���~F�6F\�(�6#�0����������/����(��LH�� s����$n5���(h����mbI��m�]����#!��#��#�H��\�?&q�n�> ��\h��Sd����Eבux�e}�)fo<�Dg�o0^�B�����W�:�X��v�@If��[����V�W^��Z��;����s1���R=���j��$Vv���z�@8$`���Vk���.}�MDn>1���@MƓn�X.����a|Ԝs6�k�Z��}Pv)גy��0ޝ�QstKN9>fk*W�]�Ud��n[��?ù�J� a2|.L^�H����ו�g�+a�nkM���A��NU؉ �`���va!���Ply ұ�����|� )g�"t�d�l�a3H��mDA�>u��7#��V�YD_�~;jud [zKխqzx�fS'�w�����]�;�Dkz� ����sg�dW��vG�@MV��=n�w��+���n�/M�B�'��<wەml`�Bϭ�p�a�Nh�����]���a���;���ɖ�T��$��y���,6RB��0�$a=B/��^�x�5��m�(f@��Ң�7�΅�Q �{����_�nc�Sֵ-�;�qj�_yr����*u�|pv���<d���3殳����@Я��}�T��$j����ܮ���ѫs�gW����w[��n+���M��*./��ё�C��#�?y�7�L+g/t�_՜X��@�s�7��ƕٞ_�3�Y��c����y�40T���9F�=g#�;x����M%��=O�j�= ����gh��ޥ�� �)x�?�iV[ c�tk D,��D�����gS!.*F{����̀�$1��Հ��4��>��k�>��� u4�Q���m����F�gǤXH�F&���!�qzr��4����h����+݊��\�{R����S�"��#X� -wW)fU` P�{�2t��d���ns�K���Vʔ�/� Բ�fD7� �1���m�z��-����ΌM���[-��~i<c�N�i\�Et�C� nml<����� 6�?�h��]|>s���t��v����ʥq�K��-�IC Z�fƏ�3?��]����0SG6��wߤl0�9��t�����X!�Q����ɽ>���i��>�;Я��s���qus�U=��,�Z 8<��h'�k��0�P��HzbZ��cN�o�ֵ<��2��e�y#�*|jYzj;y>wߦ�D�#A��Z!A[���h
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230915-en
General
-
Target
tmp
-
Size
5.0MB
-
MD5
8ed45ce3da2016fdea7a9660b8fe8783
-
SHA1
ee7d5ca0789d85f23eada55681356f8dd3c64796
-
SHA256
fb1369db68e5618f8d07ee088518606fbfffb71965770a06b8458cdbd0001644
-
SHA512
45d9c4aa0e0bdf7873ce4ff86191e94f63371c905d5bd1ede52e86b94b3b0893feb14dbd31c556f2a1d7a8b4cd2ea2dea154117327e018e5dc03458eabecc205
-
SSDEEP
98304:yKrDNNAhBqpSF+yIy9BpxXdtkA6CwkRCR4D8gxHHmFKJAw:PN6vqpubIyXPwA6cwOogxHOK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows:6 windows x64
711a9c282d41dba615ea331c114e8e0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSACleanup
kernel32
RtlVirtualUnwind
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
d3d9
Direct3DCreate9Ex
urlmon
URLDownloadToFileW
wininet
DeleteUrlCacheEntryW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
atanf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.br0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.br1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ