g�*��u��^�jc�kqݡ�#?]_q+��l��z ����zgH:*����{r�o��kf�����A�^c��̫^:b,�1��%�9u�������^D_��A�e�NW�8�(�{&$I�;S���#�T����tf�� ��E)x��g#�"��PsxQ��/ �à���ԝ)��+���z��Nz�,�a�7���,�(AOP�W��H�.{��כ!�Fu�o�`⢽|s ���e��d6 ��[�S�C"Ɨ�(2��l�*/A�\Zԁq#���٩eJE��nAXIl1i4���Yr@�i����T���*S���}Ց����`�}�v��TmY��i��p�;����u�U���7�6Ԡ8f�l�=8|�/��>�X� ���������\���ų�m��������@�H�>�.�� �Nel�w%���Xg�����*�#�w�bg0 �W&B5�Tѕ_�8�<�5�~�w�5H� �3�����O#������-��{w�t&��8��L�P�ܺR2�k��}'s����cY�l"�HȊ��1,��GKR����gU�) ��,��(��X�}�1v;=�0���cgUY^�m�V�5��<�>z`%�'��W�E%�U!����xW;���TWu=�~����;�+�MMZ2]6�w\���c9.�~��f���"������_|"���J做�(�,ճ��d6|*�r � ��v_���]��������a�74�7g� J��;�RU�ا�"�>���zC��x8����#�[xB@:� 7b.��r T��~K/�f1Tbx�.�bÔ>H��q �Z]������F���O� y�CCs�JlTYK��!"���Wy�>��"v�:�p"���|5_�8U���du��2�'��%S�?�-\X���xdM>ER`�'#�� �j���$��`�������>q�����zg,&Z��b��K�LY ��s����Sc��7�[�O�ѵ�����-�;:������W� [ң/n����^��:Z�p�A_�Ӿgi��rE'x�͋!b���]/�$����0����1"�G6�s��P;��b�v�w�2��h�M=n����j���yK�WY�~��A�Z�[����a J���zpC�y7�և)+&�ξS��#H&�(]�\�7�l����P�x�8D���IR�i�b_�;#��1x�g��aE?(XK��7�I����ҕTD��C[?7h�o٩����C��*����1MQ���3�'�����I�bTY�]-6LjTچ^� ��R'�˿b�)H��]k�E�������@C��G_Z΅��I�=�e�Z�U�l������٫t���/qCj)��O1���r�i�Z�W��:Z�Q�jg0�vx��p���ËV�A�߇5 ĵ�Lժ��l[ � ~y����^�Ob�= ���ٯ)L�åݦ�B�����nMBp.|�q�/�ra+o�E,�t�g������������b@��5T<����s�.{[,Z���WW��A�}Y*�� �` �K���y�V�������u�}>�w�P��isf��:�/�n1j.wn���v&��F{��,Ĩ�l-L,���Fy��������B��T�8�u3nUg+�=�}<1V��?.������<��M[ͫ�0��5}��-ؽ�#��k#5�k�������5.'�D�O/`�Q�H��d�kI����QU�����\��4�;Q�>[�+?_ds�����j�Q �K G���H�V3+�s���$��O��&O�)��(;�� QT�G%��"Hn$T����Q�lC�U�0A�й���O��U��}�>��nsMi�I9��xf<�Ip}��0\?�1��l'��@�Y3:��'���t�� ���H�w��a��b�aԩl)6�����w�C�[�0��~/��W#K�Fve��r(�K���N��5�@^`b�Rţ����Q̄,�rrX��H�o����s7��U��}��o���ۂN���c{��J��ذ5�݇�����Cn%�v�8D8���\�������:E��R�7_��y�.���e�҇��N��EyJ�շF��9�5�K�(��q� ����y_�M�0�zU 3��V#(K�$�{�)aS����s��`s��е�����0obK�N���W�>�[�����ܑ?Tv�<hF:�@��̟�vf ��d���.|0�3��|,�Za U�歝���_��ƿ�A$Hx��|P��zq�M<��3�>-���+0��6~WL�{�߁~C��P@>G�H�3�H�N>ru�S�����^� �1_�n����=�+�`�^�"D��oݽ�=V��N~)�/g�������F%/Lf)ʕ,�����:�N��a����A��5C1\J$�u�}Ԛ�R�������=v�،u_�n�� ��q�������^~x�ؚ]]�,i9�k0Ϝ���IQ����U{�=�,PHbiKWP,���5GZ��#;��B%���YR��.1($�,�Ѿ.�X� jx����f�Sa�s�Nx��g���1��0.�Y��-5W�r%�q;[�c���D=��ۮ=��� bD*�d@�g����@j��K4�.|�{��?l�^����K��J亱�z�T[���(��°���E�!��v̹4��d�yB����t�� rQC� ��:I¦ө���u��c��}�;�^o������Cğ�*#X@�4>~�"���6���rz�}E��Ġ@�mX��.�gڀ9L�c��%��(�t������X�Ꞔ�)���O�]]F� L�E��;�\��˗B� ƾ�5��QY�^?�F����6Q_�=����%4�Ր�h���)v��4��W�M��]fҩ�cw�����1#�����ix��4���7m)��u�������c���yh��O��&��\͍�<�bO��_�c�ӑ=WB>d���L�W1��P�q� M{�<�D�E����P/p֢��=�ŗ_� ��>��_����1'���X �g�f��P�0v��a��������Z��ou��\����iJ���϶����~Aټ�R_�I
Static task
static1
Behavioral task
behavioral1
Sample
4ae2f6de4afbeb86e673.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
4ae2f6de4afbeb86e673.exe
Resource
win10v2004-20231023-en
General
-
Target
9519107d4166a4ae5dece68933d49efc.bin
-
Size
7.6MB
-
MD5
9519107d4166a4ae5dece68933d49efc
-
SHA1
d2ca98f7d14b318f21295557d0ff9159c451bac9
-
SHA256
0ec2bc4f6db813f5efa5b96aac1b1c1758638235eeb8ddc3a85de5e8e910344f
-
SHA512
1323f77779c430e4025d42ea38230b4ea142f24b6eeea0396986e243379a0256eb05b9dcd08f1d7808dfdf6b333080c4932d68352d6da34a174b498e52afcc75
-
SSDEEP
196608:ap/tAFSHaqxUxrNv4x6lPvgEEt/wmw6eu3upHVR+yAx:u/tGSHBxUxrV4olPp6wmqoupHnHu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4ae2f6de4afbeb86e673.exe
Files
-
9519107d4166a4ae5dece68933d49efc.bin.zip
Password: infected
-
4ae2f6de4afbeb86e673.exe.exe windows:6 windows x64
Password: infected
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 998KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 529KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.?cl Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Ql+ Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.2P+ Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ