d$3��{l8wx4(�2 6���+ʷ+�S��T� WFـ2/il��b��* �"C����8a/f�&�cQT(loﴞN��L>r���ݗ�d�~ U~�~�hKS�$USN<Z���j��\ᝣ^�߈��\����� �9;�5�B�2aP h�Tjg��,���a���\a���)�YH}֨����e���{-ծ=�����g��s�]�m��wn\�阸=�Y�י0�4��{*a�@ ~�~o�NPmʫ�0� 4�`'J`�t�.K�S47��� ��؏�f;���$��V��~�ᰣ�LlEqN�*�T�|H��<~O� �Q��w����6&���/�կ�]KW-�g��8�%���뺃D�"��/���,�����}�v}���H�K��f���5t� �U���TL$�k�_ɗn�n _�3�Mw�#_b`z%Z�,�{7�e/��3�R���k&g�K���|zHp<m?v�`݃��d6���M�&�8@T�cߪ��������'���ꐽ���͆����t�'P:_Pze���S��\�Y��}�r;��� K����N��G���q�LL������:��\"�Z���6�A�����p�0��{m�K��aؾ${�Q1*͉9B��ز�*���V�QBT�a1q�#��b���V�������cm�z��>RD�4�6�`�3��\����l�Ղ��)���;)\7F 8�]�}��:�Y�R�� �{dg���%����� O6��vU��,��#b���D9G��}z����� ���q��K���X��6&�_����bC��.c*�V��7+�?����@! �����Kp�ï;�_m@5%Q��g0��<�ga=�S_�_�'R� {f$��ye���칒�x� �qi���{��+��x�����ǟ�刜#/Y�cV�f�4* �qt�ȭu�f��X�����j��,F�M?�+��)���8D���c9��5�T��nj����>�����lγ����\�%�ª�3�Gm��@�H90+�R/���҇jz2�;ɘNX�gNc*[���������s��֥d%)[���|yԕ��@�D��5f�E�&�:�%�F��9p����d �o�1(=^��}��In:���d+;�A3-�5���|eT@���қ3��8&͋l�T��]w���c��R#ɉq��g�.<�j+�_nT\s��V]!*(k��}�a���w���"�� �?/O8㭫�z������v��c(�H�F��S���V+��_��تn�K����EQ��|x�U�7?`�'��׀�x%�~��ϵ�l�R��8��g^��o雜$If^^�?W{�K$���g��Λ�j;����c����#y��y^;�YϪ/0ʊ��n5:gw��K3�]@'�FOʺ�])(2�&����Q[-:�X�K ]���^.��̽ �#�=��d�v�pH����+4F1��,(���w�� j&�1T%�P�bX�L=y�cCx��Z�����������%g�W�A���� ��\kװ?���M�Wq��0��r�$�͏��n�_��*4Y��Ag��0�d�� ��Q��V��(k�е�i-�4��iX�z�~��Gd�y�I.w���`T{�ϓ�H!*��Hq\��L$�x�{q0Q�m�����E��1���������� �<,f2[�[a<vu �$�EI�f��J� ��.'�������F;�ޘ��)�|�� ��r]�cU`��:i$�-��S�6�V��F ��v6�֬�Iv�s"u�n����\~�''�/K���2$jh^��7�%���,��q"?���2. �a�|'�!�Q���;��Rq��OM�����1"�f���j���ݠv@�>XnC�/���� �0I���ɑB����lV�g�~Ѱ��y��i��.���;�%�����農ӳTT���+R�(�M�M�|f��^&���/�ѳT��U%�zT��� �\A�2�?�C�Uu3\�>���{�ޭ�Rs}�RM��?3�G��gD N�DN��]>"�$�k�يۢ)�J, ���>m��*X�hR)f�4'3A<�_P^v[���M�a5�,�E���#U�����걓ZP�bO;��%1,RQ�w2�������ս� d����h��w�C L�����Gk�3���gg�2�ʎ}���6�J��� �&/���Ȑ���~��$*��ͩ���|��Ɯt�ah]������1bߖ�g�V��Oh�A�;.|0�Vטd�X��}�8Sk�g��LP>�;��$v"��㣮b[�R�v��Lh�%l�.�C� ���i����HHݭ�/h��n�US˓?( �9�P��Y�@Xb�=�f���T�|�<3.H��!r�<��/>s�̰��\�J��^8�V�W 3b����C�ؙ��i����u�/r�\$v;_��rn^Ḇ�,��^��[rZ}���*�̾Ü�;F�qc�'2j��v���Ű#vwb,M,.�cr Q4e���=�~����8�-�| ;.I�i�J����_����"��"3ص�%�L����g~��ÊM���3nU�B���2�d }OTp�Obk-�Y������i<��M��e) ��=���.ܠ�-[e��놇c�-�|O��p)vT�+��h����f໗�i���Trښe6���`�+��.!74,-gi�n1�FS�Dxj�$!�X=���Q�l��,uk�#��M��'���{Ew�_����V�j))�1?;b)���H�u7�Ow��DQ��_�R�Q��3e�;[Y�J�h$��奐�,*��k�D�CP�q���C6���3�9szA�^UO���(|PF2��U�\�{���%� �R(��#�:it0"�������8��E:���{��I��R��Nv� �1��χ��P,�b�y1�e��0n����C�i [�����iۮ�q�l�Y�x���$F��H#5���^�5� .B�G���&R(�<�V���!#T�*���J:!mQ�W@"e�?��:�[��E�����a�����u_��������pX`��N��"��Ĺ��no�ɍ�ָJD�:nu^�r1�L�.� ?7���3�
Static task
static1
Behavioral task
behavioral1
Sample
3279b9ce2e214b4cae75e9ef3133c01b331bd967f1b8fac0a8e9a617cb1d1750.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
3279b9ce2e214b4cae75e9ef3133c01b331bd967f1b8fac0a8e9a617cb1d1750.exe
Resource
win10v2004-20231020-en
General
-
Target
3279b9ce2e214b4cae75e9ef3133c01b331bd967f1b8fac0a8e9a617cb1d1750
-
Size
8.4MB
-
MD5
a2d0410ecb95f9aed03916442df606f6
-
SHA1
6e2707ba623b571863fd418473c978db292df787
-
SHA256
3279b9ce2e214b4cae75e9ef3133c01b331bd967f1b8fac0a8e9a617cb1d1750
-
SHA512
a8ad85de52b0f76fa9086b36aa4e77ca611e663ee741a78d6e0506b844a7f7b1d44e3b6b63d2d9fc51ce5dd155a9cf5dccc1f0023817130fd59a05231d7fbd0b
-
SSDEEP
196608:iGDWQepdZTdPsDdyFvcf9tMAzJHg1w5JdW:rDWldldUwFvc11JHg1w5rW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3279b9ce2e214b4cae75e9ef3133c01b331bd967f1b8fac0a8e9a617cb1d1750
Files
-
3279b9ce2e214b4cae75e9ef3133c01b331bd967f1b8fac0a8e9a617cb1d1750.exe windows:6 windows x64
9628e7a7c4e45d286c653112a78956e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DuplicateHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharNextW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Random_device@std@@YAIXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_mktime64
imm32
ImmGetContext
gdi32
DeleteDC
advapi32
RegSetValueExW
shell32
ShellExecuteW
ole32
OleInitialize
oleaut32
VariantInit
shlwapi
StrToIntExW
msimg32
GradientFill
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
ws2_32
WSAStartup
crypt32
CertFreeCertificateContext
bcrypt
BCryptGenRandom
winmm
timeEndPeriod
api-ms-win-crt-multibyte-l1-1-0
_ismbcspace
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ