S,1�����4:�X�N���3�<��rz~��5�o1&Q5��l�����Ѡ��8:x�H=��V����]6v��j3=�D�$/,گ�C��x���20���]qȭ���l�~0C��I!��io?�ȝ�e[IE+�4o�9��/�6�H�zB'prLu@����%q��4���puaS�w�*���tX�ã+�:�X��`�2�t�U�0<mn5.��*�Y���h)m���L�d!1�y9�+ƍ4>&����ݫ���Lr(:�T�+��%%7J�^����<l���4�h�K6@P�������;��R>�VIhSb�H(F}cp�*��P�JP����0.T�\&���!����F�_�%U���כ�x���A!��1d���:�{�7�4���^��X��x�6];�9��+��@ܲxXF������cw��K����$��nὓ��e��w�{���%A�y�'V��|�;�����txu㫜�_/�DY���l"�Bt�|Q��??R�S`�y$8%eQ|wد�Y$˞�_]`�کCs�Od?��`'�f�ܩ��Ռ)�,��j�4��!��h�_�U]k/@�(Z[��eĀ��jfӱ�1s �@&���Oپ��s�]��+�8��cH�� T.�NIU�L`Q�͵�xA]`���<�t ���c'�f������dIH_�ip��X}Y#83�j[�t��K�C������%������?X ��U*(ۆ���%�]S��.�� ��/U8HnH�S�^J��vDA"V��.K,�2BU{���j��v� ����]ˈi������-@<��5��qES����;�g(zxDj �����E�=\1�;q������7�}'-^�'���!����V��~�s[�� �]?�_,[^nц�"5ޮ5�������D7&���i-D�.�aj�c����I���K�Jl���E��e�"ٽ��䊸� ʴ�28:O�]�t��4 b1;ܒd��hn5� E�\�R�0�w<vc��i��V�?)�]�x�;I�EA%�w�ZG\�MNn��F엙���nN� sx7x�*3v�mg��;K�M��Ĩ����ν����#P a�I�y���13�3�L��STb��f��l��Y\+�bbU>D��F�9�4��LӲ�߭j���$�9�lO,�~"Dy�P ��T��7|ښ�QSB�_5�4䆚p�2s\����7� +@�8����oaCp�4���x��*�%�����a`���(:H��K���a?�u۵U �+����$G����t*� ���Rg�a�VXW~'�+$P�#7p1m~�9�a��2^��X@�,̆:)�#j��@i� u�6����JX1� ,t=�vk�'$A����`��j/�x��ܹ�����y�v�zv�z>�Y:��Hl���̠ڍ�e�`7�=܉ժ.V^�]�m������1ʛ�X"b��:����lP'I5=��b�{����Z*ƒ�:�.S��K��(v������)������ߒ���f����{w%J�N)�C#�w�A���x'� �N�R��'Q�{�P)�(2�������]&��}h'�u�%N���]��Z}�Z�2B$�'!;@#�Z� 5j�"� )�6hF9}�t��N-Ie'�o�\ 6�9�a����>5�8#˽o#L�`�t��E�#��) Yq>�u�����Y�q��W��s�b� D�F��|�����2�� �x� �Q�������4Y��gP.z���C:��:E�;��k���^VN�]��s϶W�SM6t � M�"N�Ͱ��#�g&�Q����_[?�Yet�=���r|Cx]�9�RB������*��%�gqb�٥��tq���<l����`��od3��)8��εL %�p��u�X���B��䶌vQ�)q���g9R ci @�/O�JM��u�S��!�lߣh�!��SeѶW||�$m�_릧��G���XP�P��w��8��G��\ �\�u�)�y-.��Fʚ���3�rI(�[�A�44Nzf�g������[��PCl��r� (��ß��A�G�a0��\�j�.���]��J�q6�y�9�� W��.� V�^��.(j{�?�F�k�R7�,`{�e���zؤ���K�"gL"r"��+����Ԙ������R�̯;��)����aBe��m{[0O�U��i1X���"��x�U %��+0� �Jp����oN�u쵹�h@�Φ���T�>^�{���2��f�x�y.��Z���<�ee�(^%}{��g�t�<��x��-���O�d���Cv �Q��~�t�U�������t���G��O�Q�]q�Pnq�u�G퇱WoU�E�)�>3.cn4������ �o�g^�h�=� ��J^�Q4c��xn˚ڼ���E,$���P�1k^�)�0LV��1NM���� k��Z.y���� w�6��᪆�Hl�T%��2P��A!X@v ��/�HHZ�ο:���f��~�� ���ɇ�z<7C�$�0�F4J��NؿtԿ}���P�%��W��Gw(�=��!4Z�!��|S'����_���A�8� @ ���*�2�R�ɖ'��Q�b&�p�9p�T��?� �y�h��a���I?�b��G#'���F��JB�;҇eNN�b֒��Hᡦ�2J�ן��pWW0� �FAΎ��?H���\[-���4�� M�b4�ށ�釻�����J.�ќO�� 4h@�7=�)5<*NgK�RL��Y����D6�m�ʐ��H���0�Mc���i�^!E?i�e�QT��3����\��rM��M(�붷5�c�!����㴊U��@t�]C5�u��*�;����RR=�3s����35���`��?ຽo��3��x��x3�pu�T%I� u��h�i���n�a��-4� vw�k MT���2?E��jյ/������r��n<K�Pf� ���à�0lK�.�tv�y0%�o�#M�Y?%�`��I���|�O���J >߀�>,���j� [+������f!��43�4�߀��[r��A-��4_ <��ЖF����A��\��{�:p. �
Static task
static1
Behavioral task
behavioral1
Sample
5m.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
5m.exe
Resource
win10v2004-20231020-en
General
-
Target
5m.exe
-
Size
7.2MB
-
MD5
e3343b50a16a5824751ee2a6a4e1f36f
-
SHA1
a6109a19427785a4b9f23eeba81b0f36d6f5b8a1
-
SHA256
262ba46286a157442cefb586a4de6b4e927a5141dc87abf2ec88759f42c60c57
-
SHA512
8550ca251aa7f4bc864229dbb8ee95c83c6c1464396b76537427c29cce0a3a20e792aa44f3c377ff9d10dd31c60aa51394dd10eabc1f665e50ecd523d12317c2
-
SSDEEP
196608:VrZr+FvevYmi4kLMTdkGNL5HYkj7mDrprKo:VrKUP5ko54k+9rKo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5m.exe
Files
-
5m.exe.exe windows:6 windows x64
ec23430cac9b75afe374c1416ad0d8f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
TerminateProcess
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowRect
CharUpperBuffW
msvcp140
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
closesocket
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
advapi32
AddAccessAllowedAce
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 761KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.x5< Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.C*p Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0B' Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ