�E֘���qS>��je��s<����+��n)X3��Njq#�X���0n���?�K��u9�x�0�qw�����N��q�K�LjO0���r�I����7�\�G��g$���T1m�?�K�H�E��qf}��k�J?��7�e#�����b�Z"����<ZL�Q����1����*�]�:�D!>���/�{?�#��T�VTw�ߢp@fq;��f�*�!��ۙ�J��� �"P����#��LF��:��=���~������5ٍ��}Z�py���c���7��pR ����Ό ,��K�+E�hFՓ��ú�P7��-~�7u���^�;���ʙ/�<�u����7@Ă���&� ���X�H�n�`^$B��Hצ��~����m����f��Z����O/�Va���07_N**������<�cU`Kr{�~q��<�N�Oa��@W�2���]Èw?/�]��Ŧ�����֚S�7a&y5�^1'��vx�v��bA3H��BO��lY��B��� �� '�@�?�ۓ����"���?:�LG�#(D$+[�s7� 5�����#J k���]�a���:��<(�:n�N�z���5������o��J^�� �_I}�*�㣈��������WF���V���\%-��>P�·�G��̔A~J��U��-"�-�g���#�ve�.]7�I^�w�4#�"��)�!���(vR-̝�ybK�hmvSX2k��xi��\l�"v ���~F�hX���腏G��q �w�i(#%���� "6Ot�tO�7)R$}�?&[�����Y��1cc��]�n���z�.A�莮��$st��x����o������Q_ײ����/��I�{�J/��"�sD�{�E2��K(B{��Nc[�_Fw�͉W۫���<w4DWΫ���o��Y�L=҂�H�(c�N��!p��\5���w�nz��x8VG��xvLx"j����T��s�"��3����G�hW��G6�d��v�ƅ)�אp�i�W��6��*;�x3�7�����4�C��İvw�J���!屈t��N�v*��.��[�V���D��&f}���e��.z��/�u����\�N3�c Ϊ�Ͷ���=JK��X ܴ\�K�vYO �#�κ��3�'��._����o�N+����~7{�F�3�eP�%F[FX�-�wuz������m�����@�>���Ej1�A���c�;� �-��j���v�WB?Y�-����"����T'[�ɪ\��C����N|Gm�3�;��������._���%�(#ɇ!�ts=��bM%�G�L�����=�ot����`л���Im zx�^�XV�۰�~L����k�@d]Mm�&r�/��"ɹMS���.��0,v%K�b��O�dz@3��!�|��.r���4�.>�N�(��K�Ѷ(oq>�P_�e�cڤ� ��� VA�L�Q$�<��c��a�UL�<���V+�C�Zd|�UƩ ��X���?�*DY�jJۺ�'���W���dY�-���(�#]}����AG�lG��e������. �R�+���T�c�Ґ`2~���$d�������6U&��0ӌ�7��8�7-Mॐ<n��@-0��DU��ص��d��R���ѵ��p%�_�.��E�ВӒRӡI���US�'�����E��~��OM���H�c<O�S�0$�����K�$.��W��bm+YBk�J�I[��]�u�������l��$�J�S�t� ��t+����r�u�t�3ۄ8�� P������^�ص�wL�\��b����l��M0ʹ]��k�Zj�i3�:u�m�\'���V\ ����ġi�B�!3�F�9Cl��,��'��s�����q?�!,EA�;xI��bMT��K]�O��!Or�b��ȭ(R-Drȥ����a����Fس�X='����8�h8�������V*дx3C�[K�3wk�p�fa�EВ �f�|�R���M�M����lYZ�.S�]N�������7���{�!�L�Bm��^n�Mg@�MW�Y�s��m+�ex�F�y���n`�3e-N ��;3W���zNS�$,z�\��1� d��GQt�"�G���e�0c����ƴ�"aW���\Zen���F�$VMXt�z+Y-exZ�.�#b"�n��#�U^��Cm�n͈ �KS�O�m�}7����(v����K �!Pd�"���iM�v��[�J%��X)�gNeS���k�@�Nz�]k���6�(��bY<0[Q��[�:lhă�nu��b��ɍ��K3�S�a����k���� z���1ݼ�]M��V ��{P��fC���I�u��M��饖E?fky�p�R�f��i�q���Q+�Fh���OZ/��V������]��q�͟<�;I��)sHAOI�ẙ���Qb%K���C� �)�&!u�AF���v�=[R=�g#��3DȏM��h���B���U�E��Hر����a���'��3�Izd�;������(�@�ȑ���#����馾�"��J{Ds�i���<�lw�TBe�������g;V 0{r���Pd�(Q먏�=ݡ �p%.�]���7v,z��~�x-J�_#ؒ4gɽ1Cr�ќ"b���@g��V���g_�IQ�vѸ'��ֆ�ā0#���p]�mc�p·$��7��M����KD$ے�潉٦Ƕ軙�\G8�w}�6J[� � !k1Ēc�J�h��e^7_�,��y�FmRR�<]�{�5�Ԅ�e����Z�#��T[B/��NnEJ P�$���1�*���ݙ� v$�'\��ȨJ���ߑ8�����*8{_�54x��G�������|�0�٧=)J=��ss5P*���{��#s^eT��y~h'���� wb�*��}��%�w��G���t>�z��x��WOό�Z��L7B��&zl��H-#�c�[���ʼn�:�Bq���^�`I��!�!N=���^��!���S�'j�%�~=� 9�8���g����w��er�M�5��
Static task
static1
Behavioral task
behavioral1
Sample
abf4e83e04cfaa10e27c3db0c3e68ec27a7bac84f779135396bc602104dcb9e5.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
abf4e83e04cfaa10e27c3db0c3e68ec27a7bac84f779135396bc602104dcb9e5.exe
Resource
win10v2004-20231020-en
General
-
Target
abf4e83e04cfaa10e27c3db0c3e68ec27a7bac84f779135396bc602104dcb9e5
-
Size
5.6MB
-
MD5
38231883f3014fa5e23d49a7f52777c6
-
SHA1
0ea578b9c1037a91918fc0fc325ffe480c6baa87
-
SHA256
abf4e83e04cfaa10e27c3db0c3e68ec27a7bac84f779135396bc602104dcb9e5
-
SHA512
7461a02607ca311c389802c551e78240d1b71d4f43a77f9c622fc5125dcd2efa70f95c212c8eee0a7c91fcd6fce008abef560fc2c608af221ac2fac2f581d9a2
-
SSDEEP
98304:LaBlLfe1w+a4WW9G41naGyCqnRMQAFOzep8b9D+bwdKY0FeCU6srU/Y5RyJn2ZCo:eBhW1w7pW9vaGyXRMpFYeaVEY0Fet5U0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abf4e83e04cfaa10e27c3db0c3e68ec27a7bac84f779135396bc602104dcb9e5
Files
-
abf4e83e04cfaa10e27c3db0c3e68ec27a7bac84f779135396bc602104dcb9e5.exe windows:6 windows x64
83b40b036c9dd2c9632729b3d20e4205
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
_Query_perf_frequency
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cos
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.000 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.001 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ