�3`��{$��U(u��V��wE쏩(�Tڰ�Y,��i���y�P��L������`�O�y.��9?���m�ZP[�����ܳ�h��f�{zEg�^�,��K�M�>�R,T�� G'>���-ͧ� ���놷��}� ���=q-̩�UůsV�˟$2/�&�K�a� �k�y��$���i����[��GU+�l�ݼE���\�emk�ї�7+�y=�]����Mu�묲���;+�Z�3y����-W�n���h� �V2�Y'È؏(Ԥ��I���I%�Z�n���K�y�����9���\~%�B� ����1��ݎj��9ԩQ\��zb]�Q�{q�z�'�C�ɩ�����w, X�R�<f��,�o��T�y���{k2���Nt��㵏���V�� V�l\P�\�"*�;���=X��%�r�gYR�3�!Y�"��D����8�H��l�����DK(�ڍ9�"QU���)��6��FG�@������<V�Ih|(��y�qq�K�v�݁�*���� h`���=V\l���wɏ/y�����T�����nr�d���F�sމ���G�Εbjb�N:H �(�B-�69u��A�늸y�����7�:9� VJ�?�uQ)�3UV�¶>��5Wrr9�g�� yCj�|S:gs������Q�#��Z��2��oO��W�;��¯l�������Z�~����cJ�l��^��!�ѥ�/�D���h��LnX������,��Y_d~=vG�X�l?�!wSC���)1'��\��f\���#��-e2�;-�������$���1�d���a|� U����UU0���8����턣x�����<����Q��%<&���g%�����ey�Ku�#S��DkS��z�"��ENFa�Ω�*҆V�,h� �@�'�!c����2���+�)�M���(�@�~����@�aT�v��6��N^��d8$���9%B������ ��AC����Sr_E��i$*w \��S���'��a\���h�� �_1�c� ����$:��O4�K�Odsi:3θZ��̆,1�EWW7p��\4��E] ���e�g��^��4_,��p�7�T�D N����9F>Yg���%�Lx�.D�:G�v�Y�:k�0D�Ŵݏ�V��r����m3��4F%�T����s.��)#��(psd. $���Oڙ���ȼ�<��u9��>j*��#��Į��ڰ��n�Ws,���������raG�M��,�)��]�ԏ%��*]v˄� ����h+/�~OʱΓgf���&u��}�am��e"ɡ.}�}�dA]C�b���������2eQ��䍷�%�Po@ VTg��¾G������U��Q���TT�oa|���*�����}�t9�yP�[!���G�7��%"���`�$S�vT���L��%L�����h篣�{E���g�$���oqV�C��}`�q��$�ɵ�|��R��6�Pn� ;�����:�C�H)�Y>g���Njp�㐇�N?�����dH�W� L�R��R- �c���y��yu�K�U�w[*�(q���"${I�%bE|�,sS��}=8�ҩ�r�#�2��$9��y����s�%�Q�-���)vz"թ�ǟL�������0!i�}]��*�~��HB����AQv��^\��%\�ƍn�ڞ���1z!��L�>�H�n��o�0�K�j��e�Ux�� �=��0ӳv�j'�n���J��q��h��[z;���@���� Az(J�71��&5��Aف��W�g��J����^��Rx��C����=�iui�7j�&J�&\6��՚9V�e��[��ç�����'����+]���/��B��ˬGB2@����a��`Ԏ<�� Sa�}� ��%g�9rǴ���h;a�p%�pơ�4!��K��)��dz*{�f`�(� �?AKjN��H^�`�H=m� ıV� L������#P���y����^�7�VN!�("T7`k�!�]��&��dӿ��.?2Cq��ӯڳ��L��\ �c�T�y��߿�P��>�k������vƅ#W/!�k�eb�a�7s�����sN���C6�c�cT��)�����ob۴�}CW��.N^�X��z��zO�A?���H�?z� |�"�����D���2��'潦Q`�*=�Y�A�x|ʇ�ne��F�_'4�n������K��2$�M�cJ��<��,c�f���6��b�ʀSѸܻv��kF��]���"+>z���WU��&r̽w�i�!�S�q/��5��=!�S1��i�������bf/��=OP��<���:VD����L�3�|#INW�$nv8�}< �+g8�a���J3sf�ZmB�8Lj��\lϢJe:fÞ=TR�ġ��-��3N�3G'x-ew�j�p�8�g��OYؚo[��ԧi�)�$�����-�r�B��Z-M�%��si~�7�h7fiIQ�ͩ���j�p�>&����!|D�f�o>Pki����>����.l�$� <d��+�)|���Y�����,1�?�I��G����x���^~R�iCn���X9��҇p��bl�x-�XE�Ђ�:���f2k�8� *q�%*�F��7�U�5�uC�(LIϻ�����I�ۨ����a���|���L��ࣂ�$�&���9�_]�$����q:ӈ���H��QqC��T��C��VMx��K�Yu3��2�T=�]�"��n��i��}��y#��5g)��<�ud0�B������f�"{�3_�KQ )�n��������w�c�w��n) �0F ?;U�㖉���`5-�*�g�Y[������\��Iά �*���M!�_�}�S���QC�Gw���M{R-�d{Wۅ&�|��1�0$���is���r�+��2)�l�kk@̺d;�)h��i-��fI�whX� m+J��_4R��C�轉������_/F������x�&��f��gNeY��1���%��2���M��l=|EOX�k`윒dE}p����{��#���r
Static task
static1
Behavioral task
behavioral1
Sample
UnPackMe.exe
Resource
win10v2004-20231023-en
General
-
Target
UnPackMe.exe
-
Size
7.8MB
-
MD5
fb8dfd5ccb5097114d2b9cea52cf58bd
-
SHA1
9742aee0dd392487d4a36a5315a232d55652d49d
-
SHA256
0078a8df149516227512dd42da5449a835987ff929d7e0ae2e8ed48cd49094c7
-
SHA512
bb049dc2059f0e14bdfc4a0bbec6b07b9fd30ee4422707ed3dbf3814b6c7e58b10ac6830b727f0a5ba7f46b9200427202a9f3f4c94a79d9b5372df99af2f2148
-
SSDEEP
98304:TJ6pBmj4thk1JRv07LQfmq+XWZ82EeM9tjK+i9LC867N+QWKuGgJOF6GipBqUd5I:96aj4t+KReujKy7IQWL6ipdPFofc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource UnPackMe.exe
Files
-
UnPackMe.exe.exe windows:5 windows x86
7d5ae4dca70c3f1c825e725c1fa1552b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msvcrt
getenv
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.7Yx Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.]J: Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.LQc Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ