T+!J�.�^���q�!���f�w�� ��H��������*��4:��R���-OC��C-t�����* �b�qf��1T×�z2�$�%�(��ي�U+�쨾�8w��G]56m^*x��4i�er"�>M�4kS���F���G����ю]Yd�m�7lr J*�o4�0N����tz��*<��H�[��A����{H����#1ݎ�i0ۘ<%zp�W/O*y|&=tgN�'�r�,yx��1�D��U(yo�3tE�䙔��*Dچy4�B��%�)�_����^�[�LV=�Ο�uoX�K�z%�_�Xύ ˺ �Sî6�$�q�`e�Sv�c@9{"zLSӭ�$^�f�%&+!�P'��F�������m ��K��M���Et ��F�?V������r�dx����٤2.���*�-��k��o^Z?܊\��t����Z)���t��K��h.�4'O�a5�4I��Z�Ћ7ư��{G������K�A�����_���C�`;R�S�����F|��'ӟ����a�8U^�@9c�`�,[�7�[LU�I{'`N���u �bCR@.}�� �ڷ�m��%�:ڨ�JpQ �`PIw�`�%�G[�V��ß�]�{!�JWPpy� l`_^��gT��5i�|�UcO��� ���7DZ�c��!��CY�g��?���� ��J���&�<S#�eD�<�z��?0!L=�@�����tw[�X�V�`�Ӈ�2�a���4��bkH��3i(��_�h�Y�'{��5� vrO�^+ J(\�v�����P�̍�{]~|q��}�#Y�S��ߒ�af��ě�H�[�3|���B�U��=���l� ������_ݲ`'��`ކ8:u%���o�?i��b�����gpw"�_>(��ծ����M����`�!���m�a���i���@`�u��{��O�� ���M�����"'<�f��y����5\�����$!�^��z�{�k��(DNcQ䲎�*��B����u�h*n��O��=�!Q�}Que|8_���1ǭu��U����k춴�T^{�(�K��ӿur0�$���SM�N�4��_�l���-��T�5�׆���r3ȳ&��36��~Z��`'�쿧&NO�6ne�OB-)\8U�U�=%�^Su��Mﶔ�nG����s!���Y".��@->\�I�`�l�&U[1pl�d�a�_���M�X��p��N����&q��~�WK�`C�^>S�t�B�?�x��~��q��������(w��`��%6w��ى��u��g(5���O&�8��P��Ъ�~���[����Ew���D�����"�>\�����$���=A��\��W�xWY�z2%�Z��:T��#�,*����֎te���$���]�k�lc�B`�(�Se1���������Ʌ a�IE(������o�t�(`��*]�/����53�B)��ӭQ��9Tz���D��踻�V<�%�Z�[��n��bd1B��6)w�K�R���Ֆ<�������\�&����������,���\��g��Ո���2ڏ�٢��p��YE`F�����(e�3�1 �tḤ� ����I�����*eβSvs�{�ͥ��&8�p�Gb���A@�\��[�m ��-���]�,X,�����oa�Oǻ�+��'�o�:����>X��X[��4S�������bST���Ƚk�5�j���8bztfGC]���� �2�ٖ��{u�Q���87��./a� qp7 ~��YX�!����oU5W����z�z� �=k+@�͡=c� ���Z��+Z��*�f��3T����Sg�{ovE�i��.r/����p,� �*�>��T��,��a��=!�42n����(�E���8bM�k�Y�X���������{J��e�Q�~�Ik������ƨ���Vڐr���tu��̏M�NS̾)��F��tف�(`�J7j]�Iw���pq���}δ�a�8������aIs4É��lfO0�����F�hT�]��w�`����� �_g�#�n���X��`o��ʛ��H�9R�Uz��[�h{��O�=�"n�`�eá5mE��?y.+�V�KQ �8���V��:��s�w��0�{���h���z)?����i;��X�ݏ}���˿=9�뱲>/�K�ᢽ*e@����[�FBf��C�� ��CRq�%7qI^�DH<\���閴i����/�oH.NSC�S�{�۩�ځ|�}~�eXp�D<��j;�[��|^��z �2��L ���N���_]��A��_������3g����RW�;�d�k��Zg����1��`�Ҧ6��i/̱�X^�c�WJk�W���:u��v�64Uy��_)� �+�'hI߲��v�e�AAģ+0�xPR�$}f�?�O��xA���_+��N�x����(�~@�@�vb%��D��� �9� <2�{�$��P��=���9��H����Z�3R�WP���:o�#��E+��'L�]��Hji���4 �~��H��Tk��E�WX2+��t����.��O��_���Xa[��e�Q�Q�fHYa@�U���bq=v�9[S�⠜d��x�Vt�{�E�T���Ű[.5Bb)A�s��3�,��q����Pp��Ц� �=�Ǧ�\�"H���<��4���E�W6&H �#��Y�BSe�}�s����p�������K)B=;������\�M��985\2 V @C�p!i8l�un��9m����b~&ۆ�ȉ�$�Fc ��U��j��\[_�j�[S����%��dy������ͤ�d���C_s��8[� 2�����d�k�p��%���dB�1����Pgk(h��8՜���ҤG3����K��C�i�j�' ��]@CL�SXv�y$ 2�4֡'4�`s�����Q�rU������td��vo� � �V$n�@��ߔ.�������l ��Dc���ue�~J��U�\�T�ц5��Nu�%ˤ���W���.Τʷ/�K�b��n�~7�AS�H=���8��YAY�4$���
Static task
static1
Behavioral task
behavioral1
Sample
4238735f13c70db87f63ed8313dc699c6714adbbfb5936402da3b4835fa825cb.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4238735f13c70db87f63ed8313dc699c6714adbbfb5936402da3b4835fa825cb.exe
Resource
win10v2004-20231023-en
General
-
Target
199d2995bb4a3f28ab0684324f2a65e5.bin
-
Size
4.9MB
-
MD5
b4c49ed94977dddc7a2f75034b1805a8
-
SHA1
18d8884aeedece280682d1126f213c145edf3103
-
SHA256
db00b20acb403d77abaf8c43ecd85d318b0957605795facc7a9d56f036057df7
-
SHA512
bf064a5fc746fe949a6bbb3e0814aad74528f8aa30eb92df14ac8c377dad76dd4023a121c6bb154da8418adfc3c1e1313bd826514dde5d85be0008b07f359df8
-
SSDEEP
98304:ud8UnuW/tRTwsDkiYX5skww4wAZYBOzrEYY0LIVLioYY+r+esNvxOWoq89ifdo9:uCquW/tqPHqk+wAvzr8UNrSa6C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4238735f13c70db87f63ed8313dc699c6714adbbfb5936402da3b4835fa825cb.exe
Files
-
199d2995bb4a3f28ab0684324f2a65e5.bin.zip
Password: infected
-
4238735f13c70db87f63ed8313dc699c6714adbbfb5936402da3b4835fa825cb.exe.exe windows:6 windows x64
Password: infected
60e03209209bb692d0b1b04bb119d74e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
psapi
GetModuleInformation
kernel32
VirtualProtectEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongA
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
_Query_perf_frequency
ntdll
RtlCaptureContext
normaliz
IdnToAscii
wldap32
ord35
crypt32
CertGetNameStringA
ws2_32
listen
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Zorax0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Zorax1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Zorax2 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ