� �<�����3S���-����K��B�����&O~�W/w�� f��$�G��:�=h]@���ܲ���'?��ԏ���6[�r�US.�spa�������VLʃ���͵E(^�~P"�N���������'zM{jn#a��>we?AY���u��4�˻�>��<�^�o��Ynw�]*^<ˠ8��'� +R��Q����a�Z�c�gU]�N�v� M��m'��n2�D,g0����qd�[�����Q �}�zY����z�n��;q��5n�G��FO�7pГB��ɮp,ɸ�Y'ƿ���hUr�u�w�Q��sP�z�RA� =:Rx(*�7�w� 7����<{'�DO�������,�?�x��8(�噇���Q=�ͭ~�'S��ޔ�R� WL��J�fx���1�҉S/����5Sd�Ǽ%�18-�1ڼ"�[3dI $2+��� �h�:;�#�Pȟ�f��p� �I��z0{t̻ZA��C�wZ��R�k�QV��k�$�h��Z�mj�yQۣ?)>K)�5E�n��X5g�ƻ���:�4��9"IN)�������*ݢ�>A��5�r0˸6�����ه���."�@W�5�2�3��"��a�ud��jȜ^�{h>]�|��<�X|�x2n�����{QT�^�!h�����ў�$ٱe�lH�T�B���._Bc�~�rdG��1�*6�tfat��� �V���N�߂��m+h}��8�Ȑ�A������ 2ە3��T�2�K�8���A��?�,x(1����Sb�.�l�m7�9#iԭ�(�&& Kȷ��\">��c�����f.�yt�Z�ո��]V�V(��<�ч$�������R#�[E]Mt�';]NWL�ف��Y^ձ !����Lr�I�A�ep�v����s���·��[��D��������ti�%W\O��2��V������Fцn�Mn��69!cx����< @鳈��߬R�^)��x�Y�aR�iu��,�}.`rI|N���K5X�tC ��f������<�<kO$ج�"|�k*�n��c���+SUK��� �>8�8��%W���좽�Sg�Z��'-������I�����r���x�s�p��ёpZ�b�x-9�����@:�3 �Z�nT��1���%>y�rޅ�%�:��\k_�v�qK�\��V'vY�!Q���&(|WȝW(�-cuQu�R�jtL}�C��:�R��^#7��i����ኤ��3@�9�3����c�q/�=��WS�EV�A�]W�bb��Ɩ�w�H���尸�����(� �e�Jt��k�5k<��,��T����u�E`9���R�� 7^4X�?�J������>��%�Y�M5��#�ۖ�і�ެ9w �c�)�Z��ֻ�&�jՎy��(q1�w����"+�l�m%��T�r���FHm�3��{,u������6!1����ާ�|S9��X�h�������t�fj]�h����5���-�����U����ǓF�<W���+u+��T;n�C�q ,��́j�&9 !��q��C}��q�C�,mG��6��$,І�9���$�i�,.ڄS��V�y(����s4�y ��ш�;{��s���,�@u��v����>>�)����U�ܚ]2F���7vhx���I�� ?�:�y��H��c}�V��k��*�`Y9܊Uax�R�?�)�拄��!�P�ޠ��E�Q˄̥�L�* ��k����葦��8�Lݏ�B�Y��ÔϪ��0n?�����(���2�ߝ�Xy�K߿|���>e�L�U:v3U����)����}��`I2>��"���N����c�� ���8h�mm��hu�]�XP�����Tn ܥ�V���v�z㛚��p%LB�4�gO������c5+�Һ�l!E��g�-�N]%������KJ7Jd�4,\d��V qZ� �P�y�:�o�N�߹2 %���;�%P�!&&-��c��s�o�H�����m=PΌ>�dP0���m!?��;3�>��p�r�L��$���̜�\S�$�2��J�hg�7��T=؆28�K�94�G�*�Q+���S��;��B+����Q���q���wt�x�ί�VB-��*���7�!��%���8�TY��*�����$��)��RV�?�O�V��㔻��YŤ�, ��C����+�vtF�:�N^ږ�S�qkZ�2.5�3Kd[���fG��ê%�GÎ�5ޔv����Qϥp��`(��M~]��Fά�+���r9^������y�e���z;�N��4>)��/�|�8�4�S�Sf������o/�ߣތD�B���xy��M7L�E�U��mK�m�Qa^��q(����K%��� ���Լ�ZӰ��y�8Y�%�6���41a��H��C�P>À�~�[C���=���Wj�R���ٝ0����ۂ�Qc���`}ܵRe Fz�zxD�o�����4%��oz�,�V�mUw��U�j��Ж՜b�/H�p��b3�B����9*�t��U�E�e��B�4$l�W~{�x���M��˾�H��ܶ�;9�V�ݟQ�X�E���]�����I3 �h��]�7ⱉA���l_4�4T8�ɏ�1K9�8�Ū�X���J��A�w�*Ln`ru���F�4���G �pU���n���GY�BG�;O�P�v*�V�����c;�Ŷ`����็ng����zR�M�s��� ���qN�=�P~!�M������"�����>�1C}&e�/�?�� �W�J-Ԣ 6��p�����8IQ�)��uΦc�5��R�'B!�Mѥ��]�Qd�pw���.���T��v|� ,�-,���@����_w���]� ���v����mH�������RU�s�J �WmF���N4J[��q�a����+���Z�X�� ��V#�����c�ߥn�ʣ���ֳ� {!�>=~�L~R��������㎫�4�x���gpEC0��?R˶o(�G���3�S����⍷�1��J�����ƫ�;�Hyf��k�|x9͑�8��ӿ` i6
Static task
static1
Behavioral task
behavioral1
Sample
bf87d175a39cec07c01736c7d0ddeeb4932ff14c66f23e6075362617ef2ec928.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
bf87d175a39cec07c01736c7d0ddeeb4932ff14c66f23e6075362617ef2ec928.exe
Resource
win10v2004-20231020-en
General
-
Target
bf87d175a39cec07c01736c7d0ddeeb4932ff14c66f23e6075362617ef2ec928
-
Size
5.8MB
-
MD5
fc51a04167a8ab8e9a62bd6d1cb95c95
-
SHA1
3dcf6406e353490bfc75896742c29f21fa35251f
-
SHA256
bf87d175a39cec07c01736c7d0ddeeb4932ff14c66f23e6075362617ef2ec928
-
SHA512
ed25fdd26d8a365b45ddf581263d869d9f9509dbd7a2c125797217d939082f4caae4852d42e56f2cc25aa4a20040c68d25a97da3706458f709fc14e234c94b96
-
SSDEEP
98304:ktvv3vXctN53e0OlxWDLsTafF//h9R38OjcEys/EJ56O++Ic41wDKaDq:ktvnstje0OlMD5//fl8qbys/kK+X410C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf87d175a39cec07c01736c7d0ddeeb4932ff14c66f23e6075362617ef2ec928
Files
-
bf87d175a39cec07c01736c7d0ddeeb4932ff14c66f23e6075362617ef2ec928.exe windows:6 windows x64
35131355b318ab473f66a1397d29cebe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winmm
PlaySoundW
kernel32
OpenProcess
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
mouse_event
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?_Xbad_alloc@std@@YAXXZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlVirtualUnwind
imm32
ImmSetCandidateWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cosf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 773KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.000 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.001 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ