@NV4�W+�k:���0:���w�����L*#�8�(�H��ƹOp����7�JA��p��>�lc���o\�S���.����;�ٹ��<��)�7�k$�=PBB}o������~������B���wyj���! ��Շ��+�o4ʥ��r#���1�X�؛����"|깒¢���A{�jd�����h;2����7���:�2��Bi��4R�^.I��>VM�]��(O��K/��k� ���Qm���K�>{̒]�Y1�Z���"��S��7^����U<�2������h��GmD͒5���Un݈c;=�m0���s�k��Հ������c�ԗŲ�@O���#�;�'���#�q�*���<��P�Ɲ�R^i���7K�ڝ�1����,��C+#�F�T��������y����*i-��^� _�e:Y�A�M��=�K �ܬ�ͧ��@}���3����l���}��']>��v�t{����� �Q��yۢ��L'VZf�����#]Q�w4�W��� lʐl+Xm���模��9��#c�c�vf5�+��Uε��`hWw�6�eH֜� �ٔB�I��� �&&?�d��g1��舯(:�.���_�������L�d�=�����5a��},m��F�f�th���@�5\pCT̥O�a��"�.�H̡ ���h���\ͽ&jy}[�/aH�K� E2�>]��k�������س��d6�Al�Xb�ލw��2Hu�'���#���e#��� ����.�ރb��̸.(Vk28Q��#�����F?n�ZTi�/������g ��峩�k���^��fO.Lc�R����3�MJi����Ÿ��)AT�6�]h&�����qk �h���D���\f}Ո, ��l��v�Q /��d�-�Y/�4�� U�he��&oG$��@��+f6*p�^s[,^j|�����*R�jX��Y �"G�����M)�̜�Gk��Qr��4$��w>�m�Jt�/����:��+g���NY���Vg�����S�%�Q���&���Xq,���$��Z��}�u��.�oBA���<f�Ng �v�I�F����];�����!��A[+h�kZ��U�y P{�C<3��.��I|q��-�2�QXW��q$�N�QNY��/ η������GzJ��]F��������4kD��F�*�C�2d���Nӝ<9��?S�P��]띑��ZI�w7�y�;�,,}��u�/>��+-A:bФ�EA�����%�5_r�t���`��<���فb���t&���1pTvU2��"&r��� �v|�y-[��:R����Fr���A����x���BԹ���7L�Uj�g�B�*z��]�������8FWL���{����GC%��Κn��*�D��P� Bq!�1wD,���*�ۡ(�uŒV4���o�yP�KF���`A����� ����+T6�-�]������琽�R>x9`��J&�0 f<n]��V���f��3���\S�E�)�%��*��/L�ۏ�)��_io�L<�Ob���VW/�D�~D��<z�������Om�^�$/��#{���Z6%p��ޙ����eB4?\ߵ�f���+~ R'��7@Qͼ�q�_�c�D}x�H%�\� #C��%69(�21h�nY�b����|��X.��{Q���.�����X�����.i}��?���9 փ���';����OX�K<����J7���mّID ��G'tGW)�7m�5�*�싵����'JT)�{�Í���y���f�)`!�4�]���{����:b*��1t��1� M��0���hݏ�wI�ή�� ��.|b���{�W;Y�q�R<�7��b��C�gCm�z<Ӗ��9�xY[�����Ā��OѾ�������)y��[���U�hU�F}g}up�M ��.�W��.8��u��1ۻ���]�؍zu�P}�N�|�}ڱ|����.9��W�(�N�\�T�w߿�^/S蔱�F��`B�����N|�N���:�c�<��'Fx;���K�k�@#z��#�ѥ��ݞZ����ڶ�E^0�ul�[;SXĪc��OBH��>� �F�����I��(Q��ǰ�� ���w:[���3���*ܔG�*)��ޠ�ض��K�s��=e��mh�:�8 Ҟ~K�W��� [�> ~K����t6��]� u�)�H3Y����yS^h� �T"� A��,u��r�ŕ-I�~�s&t�Y�,4_p?b�˗�&.���Y7W^0UB"�p6E�����������������h,��: 7�����8�v��U����ti0�����oQL�N�?];�T;3I� +��%F��`[�����'����%P���F��_���̩~�(>��ݞ_�R�e��_B"�ak(�� 7 ���Z��(���[jL �n&*W�����#��w9�m@$��zt��l�$x��UvL�?0��vx�S�g�t>`��uHS�����"@K�s5` ,�X�d5J�SepH�?^��O��Dk���%��{ so�x��iY��a�(��"��264܃�Nʠ�i��Gk!Adc�������4�9�Uu�3�N��I�����cP};F�0�ҹ�A^��19�3����K�o��/�k��Ɨ��f�Ǜw�m��:�-_;����=Йs�-�8ƝP'��.7����d+��p����������0b�Ĝ_�pK�Zh�oB��{�d1,r=����j���K�L�B�6UG�Wo�h9[S�^mWn�G4B.�q��B����^�ߖC�Zp�{������<R�F�H�4Wx���o��]/�?�;x~6�����snW�Z���G��\�(P�z����� po ��%p���Pt��qPH�s� �!Nl���i%��48�6b�0$ Yᔱd^N�XI�~n�.6���M�E��8Nn�����qf�-7P����r|���E�ט�2xu���Z[³��NG�R����(�W�� PŅ h�F(��&`k^;�G���r�0�lj�TK�ߠ�|E?uF��f���֚����^��f�
Static task
static1
Behavioral task
behavioral1
Sample
438ed941ef0737f2e41817af3daa1cf2dcb36ce4450c0856a739ab6eaca39891.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
438ed941ef0737f2e41817af3daa1cf2dcb36ce4450c0856a739ab6eaca39891.exe
Resource
win10v2004-20230915-en
General
-
Target
438ed941ef0737f2e41817af3daa1cf2dcb36ce4450c0856a739ab6eaca39891
-
Size
5.6MB
-
MD5
1ca760914c505b5dddce866fda6a05d2
-
SHA1
024b26c8fd1fccbfa3106359cfd5938e6c1f4cb2
-
SHA256
438ed941ef0737f2e41817af3daa1cf2dcb36ce4450c0856a739ab6eaca39891
-
SHA512
0ea100823b2778aea9b4e1d69fef32d9eb4133e66193f2f0c15e2ff9ece8d7e5dd1af53b0d05918a2b8d0b3e20a7b7ffff79d80aa4ee7bbdf16491bb31db6b7d
-
SSDEEP
98304:fTpluSZyJ+BX/eZEYu3f+fuovFdKy3GPrypCnwy24esLP+aBL6WH/ccZpU:flRkkRf+f9rWPupCnrsraBLZv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 438ed941ef0737f2e41817af3daa1cf2dcb36ce4450c0856a739ab6eaca39891
Files
-
438ed941ef0737f2e41817af3daa1cf2dcb36ce4450c0856a739ab6eaca39891.exe windows:6 windows x64
83b40b036c9dd2c9632729b3d20e4205
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
_Query_perf_frequency
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cos
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 739KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.000 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.001 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ