�Ky�႒}�]-�X�������4�+I�H$�&91C���hnVhvRe�8ڬ ��X����Z��c0;�-ph%������k���kB��d�r2�V���b�ajh a����1�@�N��Ư�#���x�&�eU��\A>swH��6���bu[���w~97��/�w8([�Ѿ7o��L"���\������m"ny4�M��c�Y���j�kpkTԆ����4R�^�@�����{�9�"2Hzkkuu'��C�59�'c��tr����E9"9��t��y쫣�7䍛���M�'����Tҿj���j�>�ʷKN�D a�d���!+��ÛX��U�`�9���YAu_f@k�7�h������R" !��ؼ�5藫]R����<���Bk�߄�r����=� OS�N�fg�p�UU��ặ�9(\�w�H�}m�^g�`W������M7��֢��eԴ:�vB]����X�����1'sZ�Q{�c5�n��[*c�\�:>�`���$�F�}�3v4��������Q!�u���W*R�A�9C��E㑈���wl��uC��VNBhc���V�qs�.��y�e�YЛ�/uN�}��� n�%�1�x%c3��0F�1In�:���{!�:� bS�������,4��L�����4i��-3����"=u��H�H|R��h~���H��f�@����Z�f�[�\����&�V��^�B��5���"�r����2��_D�)����!rq���ˮ��a�#�0!�OJz�rA�a��V�ȥ�J&�W�g�xz�Q���e���0p�7s�(����3e'�'�G�o���ktS�/��T��J����8�ɱ~�Xl~�\p��6�8�Vn(���R��9D��>I�`-�e��_B��u�+M�nE�����/�T���p��\�vn��4퇤p�D L�pɚ>N++��o�d-J�(�]������h��B'��N.���#��4)(OaX�2���s�g<K��s��B��Nb}��P���V����r�ǐ��emV�Ł��(����Տn���Y/=��f�� ���7�@�N������c�E�֬J%<1d�:9�v_ ��I�v�E<�����eԗ�Ξ:m��2��e�x?�K����`[��+e�s&<B��auPM��J�V�ٽ!��$�qJǰ>�{d��Ȗ��J�(��A�b�)d AT��p�:���q0���vì���+qo��H@�V��X�O�Z���.� �A���M6���/u�i�g��<��Eg�egȡ�_�(v�-�Al���iw� ��`�J�USꎮ�^���:�����_�f�]/4yLE+Kocj�]�[��#��JA��֛9�J����>O��=���� ��E��o}An}OC�e��t�<.P����7N{����f��P�D=��>K�EC8�w��i��}�y*�\�:����ְzoWVPks��]��#&�I�Ш��NjH�m�U��w�v��P��y2Ɵ�Ϫ� r��{Q��7�l���f�K����D��)��ݣ�,��sz ~��VwO����;A�/�"���̈FL��?�ث�S�Y}�f�T��p�0�`@��������^*8��i,Qa�f�������<���W��J�97^_�$.?�#z)��v�="^!E�xJa���l�U�= gv�nHX��+�����Ye*�r�"����O`��{H��mM���+�eO4߶,����@Ğ��.��~�z���n��'��CdP����iB��߳�Y�F�H�����X$yk:�7$̟���":�^�6�S���g�� �!%�"g&orE�`H��?%_�=��@�{آ�&��\��Ѓ}��I�� ,>&KPP��%lͭ:4�Ø;3���T5��֗�&S��lI����D��!�sM7Q/&��:��ؤ'f���q�΅pet�0��,k������%���:!���ޥI�e?��؈� [';>�}��*��Ш�./@&��<�ɜu$�J��o0X� 7"� ]��U�|��H���I8:��$��[�D^�w�4�=� %Յm�����K�����7$rp�=���?����FO1����� {�O��g3!=��21r�+�����_�J,B��'&�*2�膒����e�jvM1𪛙��"*�ni��t���q(��q]NA�5VHҾ�2zP9/&�UvǷl��WU�#��XQ�����{şM%���҈���+5U �mp�UF�z�d��ؚ<4ٞL,�t�WߋUo�ei���D�]����>��TZ'�[p�iҞ�XV;m�����R�_������xnJS���Rp��XYe�ɂ|@߈ʔ��[�QQ�����6�*�}�ߘ�A����B �h~Е�wO��]9��N����>lo)0@������5^����qߖ]�9&�zZ�!��ڗκ��@Q�Ôn{�KUP��bE��3�H�I���C��p�f�/���o���@.�?�3������ww�9�(��E1�w�7(��a���.�8 ��~�70����n�3g ���&�R�z�E�ꭞ�JE�BpSv��e�� �j|�\�*)<R���[���z#�,N]}�4lk�G�6��z�2�:Rf�<��Oyo����!+���`A;�C����Y%;���$�\:@�ywΏ���%�K�4�͒�\'�D������7u�]��ߥO�G@ ٿ��e���~dj�X^ַ�x���ݤ�ͬ@���6H���l��`���D�0�(��5���� U���u4�@��"��y�k���������8]�����EE�Mj9�H+%:�L����N�k� ���Sv��&��L/w�*R�5ҟ��)Jjg�$ �ڎ���@&�@5TC�3o,e�Gvx�X�Lx|�i��rx8���ag��8�lX�%z*�c�����岪��<� mq%���������F%��r�$?߲0����P�j F�������m'�;jz�n�D8w� iA3z�0~�<$:���1�͍��m��!0��zd��~[���u� �I
Static task
static1
Behavioral task
behavioral1
Sample
eventscanner.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
eventscanner.exe
Resource
win10v2004-20230915-en
General
-
Target
eventscanner.exe
-
Size
8.5MB
-
MD5
c5320f93d2b18b5fd8841dd00e0b6c27
-
SHA1
434661981b9e56d80310fb4580353b0d6230e37c
-
SHA256
4f59610d6c537f6b400ff6c9102659ebd4dd8b0757fe8f94fdbba08b349c6dcc
-
SHA512
812be5759e07898aba9f525ae02b25c99b0e0e1529a8744544cccaedc1437dbf7a07e52244f688c44a8bf4cb70da5d4142d5a3a9f0075cb565628598b240d4dd
-
SSDEEP
196608:h6iGk4zVbX1fZQI0Fmlw0xuhzbOjrNZdEVPW1e7EV2ScBxf6EGSA:hc51fjJxQApZdEtW1e7EV2dSERA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eventscanner.exe
Files
-
eventscanner.exe.exe windows:6 windows x64
8ab858940b8a6742ee9d7e72e2cdcdda
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 603KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 850KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 533KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vision0 Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 320KB
IMAGE_SCN_MEM_READ
.vision1 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vision2 Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ