���̱ɝ��c/�E/հ��S�n�x7t�Q׆��1L�fZ4Jp^�6�w�^�A&S^L�:��7;���~��l�9�q���us��Z̅,r�P}�B��T8[6��5�y�-bw��sg��4}y( 5�擜Â|B�7"˯�Ab�A�s� �0�"=��J�>����|��T����f�@)̸���{�dF��B��d�T�,�d��=ޠh��������^��kn�Emb��2�B�ٖ������+�SeΎ�C���� ���/�l0���(��n���������Q�D�ݲˡ���ݓ̳-�5T�^�fK�n����<2��Y�?�Z����N�����a�F���� kIw�K��0kBE� v��/��$J+���3��U���O���#�gP"�m�8����A��&[[7�QH�Jsu0B��ZC�/�T�����2B6��q8-�7u�'L����ǥ|T� r��i�x��$�Y=�I.6�o�9��Ň�.7�,֠��NL��fK&r�BVu�.�Y��2|�J���ѭ�z\�G�D��Լ�oG���x�{)qW�d�@��Q�ҔX�N��=�T�3�9d��T�BV=-�7�[��c[��>!��@�xߎ)�/K�|�e�a-�=F |����Cg|���yJ��<���ܺ}e�����b�ǵ��.e� 0O9S�*���Y*j��?�v�/�KW��7�Θ7�7~� �; O�+ڿ�6�vg�ZM��C�~�nF�vT��r ����JD&���@8E�3[�LO�?{%{���?�P�]�x3o����{��3kk˽W���6VVභ>"���b�L�N�ܸ�g������X_ K��"�4����4�B��� ���6�5o2v9� ��.Y&��>Z�3P�jڕ7;��j� _Y�����K-g��Yx>G���ґX �Y=���YB��'4�1*�B�E�*�c[ܛ�^�J\h,�z{s�s����U�U����L۶!e�g[�f��Udܣ'���ĉ��@X�a����$�m?sB�х�ݓ77��~�y����Ȝ �����@�<� >sjT.���UX~�w+泇i�pD[u}UfpH_��9��V�k�!��(��Ź�y��\�j[Au!�~j���(��W3�#q�Ʊ9�g��}��������p�P@� b0 �V�#@b�jS�r5��Ő�� ��g��~�� $0��y{�i5a�qW����:�ET����m��z�Y���e�5{(�dm��Y��W8|�+�:8�$P�X��������o(bP�mPv������99�~F�T樌(w�����`Pѱ��:M�1( ���1��}T�]�D�:��1O|��%ћ�u�*��l��@�t�U����N��o�����/a����o�7_y肑ۨ����e�~��^��s.�l^���ϭ��y���t��Ro2����b�ν-�x��ih�=�A��J �2�:�P�����7�'�� ��)D��Ͼ\�@s��w-�w3�p���)���6s����OLOM-��C�� �v�v��Ud�m��-��G�G����?�4�y����\���-tܰ�֑R�F���4X�c2�2&I�z���Ÿ��yg{�Yھ�[hN L����t6Ca5�����ʩxŃQ�9�rrN��o*E+���a����m>��>f'�����B'�n����-����H���Ҙ��h�������(�M�L8���K�[�a��fv�|/����3�i�X^�?!C�NUo&��W���럌���~S����!�Ѭ��]�����)��J�O������ۥ��!N�z`��6������Mߍ���Y�����A��<�r��F%�'���}�{ 7k�/�O(��,3���3�LS:��s'��4�:�`�I�nU+�#lj�.�ަ��mc}��[Br�G">z~��2 ��u�2�՝ �Y�}f4�(i��ܥ�++���%$�^�x??{�8�����=b24��cK#��������.8��6�~shu$���XGE����K]���I�/U��GX�ъ�Z����ܙ�h�œJ, \�mB��͵�*�M� ��D�����Sw�n��w���ک��r��3�!�;�a��Y� ��� ��\���:��(�M)U����R��9GD��>*����!��f�; d��I��_ղ-n.NȜ �c|gAo��!p�a��uO$䵔9���Mo��4C�A��i�ˠ���������+*�a��&lXO5�@+��0K�z�����<9���cwa�$L6��t%���F��;���,��(��IiP{�Ӽ%F���#SJ}Ie4G���K2�ك�'�� d�0����O�:�M�����olpFqM����q4���w��H���Tp�-���nYݪX� (�X�ηFl������=�͑I��G �Ji��&�ʲ��4c��zj�X��� b�H�=L�4�郭������J�i�?���� �7����OX걏��an��}5.;d�!��e��N����1I���v�?R<���_�Q�.�m��{sK��y� ��m�<E~6�K߭bL��=P��ʤ���R0���d2F54#�awP�& �X(�K��3`���q����}�@����E��4�4��L��?ǰ������<L��̄��Bю�M߈8y�{�:J\U7S��X�K�x�G|�O�g�����!bE�ϓflZ���м��y��r�f'm��/��l�������<��u�k������bV��Lr����%��y��=ab!A��ʫ"Q�?�-��F��a���a�B�f�m����Bf#1G����_"p�н~ga���ИJ����ɈA���)骽��V{ʓ�: ��S.)ud ?�fVڐ{)��8����)���:�����٘�e�,�&kQ:�ֲ��g=G`'=&������IF���52�aa�M�ġ��������\x.e�@Oi5^g�W��cC�=�TA�ߓ�C}X�Q��/�^�o�F<�W�a� ��B�i?O����ax�O��y�}�P¹��݊`�҂�q�
Static task
static1
Behavioral task
behavioral1
Sample
b757b9a11af483e216271b1424d1f3e0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b757b9a11af483e216271b1424d1f3e0.exe
Resource
win10v2004-20231020-en
General
-
Target
b757b9a11af483e216271b1424d1f3e0.bin
-
Size
5.8MB
-
MD5
b757b9a11af483e216271b1424d1f3e0
-
SHA1
fe93e252aaab677390c96e8a1205188436c299c3
-
SHA256
89f9b79540e9278a5d426dcb0f97815e4c210e7454b56fe639346bce0bb2fd40
-
SHA512
c206ed31d9a7c1a746e9190f6f22dc586d35909e2f554aa662a757c163ac88447f4587851f6c1ff7c6c8e742ddc30b9d8ee931cfb4e7ddfade28c0752697a931
-
SSDEEP
98304:soEkzdKfaKD1+5QdRiry4Y0A8nggnwG05jKbpKEmvVNcVg7kj5y0gb3cCxkJYS:s/F8s4Y0A2PwGSjKdRWVSVF5yXjcCGYS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b757b9a11af483e216271b1424d1f3e0.bin
Files
-
b757b9a11af483e216271b1424d1f3e0.bin.exe windows:6 windows x64
c8ca39e7b12c566297eee0ab5bfa6636
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winmm
PlaySoundW
kernel32
Process32NextW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
mouse_event
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?_Xbad_alloc@std@@YAXXZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlLookupFunctionEntry
imm32
ImmSetCandidateWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
cos
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 796KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.000 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.001 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ