��a�욑P9�Y�h��[��^'�>�B����pÉ�,�x�vO狝�#�<X�U��6Yg�\g7�H"c��X�D�q��^HhE�gz��n-:���A�f��RE~ �|$v_��@V�i!�����|�K���6�A��% ��-�5D�-HĝMoƆW �S�w[>���˨s"�Z�0�ʪ��p����R��t��l:��GI�[����<L���b��|*��]���axz��K���;���>����8���L�8�����ނ��܅�W7r�p�����S9ύ�K��N�����S"%��q�!��: ��倲�P���)E��0u*�F5���=���j�Ǯ�����q���Q,����B~I���u5��F�w�r7���|a�)�ɧ$�(ulB�.fT�ə��orr���J�,Z"���+6ңM�cA�;89I9F =u�ѻ�T�[�Q����ɺúe�2�j���Y�� �\ ����δ�W��\����ϫaW�<�=�l�.�/�Mq�i2HT!�L�"W�*�b/_��)�@�uv��uD�{+V]�_�:a6/�s�<���;��4�t(�Z�Pq�Ry��e�Zf�^���K�_���Ѝ#�i����з� �3`���CLE3�V�ۙ������ȁ<^��nj/I����h�I����x�����g ���T��!�Yq�oG0�7=�r �$?����GP�B�����'��C�����w��D���z���c��Q��ix��t�0ٹ1,c�E�U���R�䠈�[���#���D�l,Z�:h�,��i�#�3 .w��1�"w���Y>�������-8��B%��h�]x%9+ث��4�ӌ}k��g{��A��l�������j���%ƺ���p����fx���7(&d�=�B�f����w4`��I�f���l�L�dZ]"4?��<�#��� {����tF)�/}f�E��6k̒�_�n���"�����)���}A�8���̹�� *������yZ��gu;�LQΘ:eP��)�)�2�c�l�W��y��<ߠ��\%���lw��OF�^�xz�O�H\dFSt�Y�'sf��dp���P��S�w ��ȯ�����l������CN�;�ʆ��&p�=7��h��8�@_!I���@�iP#3\4ƺ��ykKC����6���/�A(Z���ގ�}Z�u��݇�0��?c2�w�f���) K6�o���oYF���S��F?�!��|�/X[��{C�U��k��J@��Iz (Ɂg�=M?Q�c79�Q��&���dzw %lc�� [= �l�?MT�4�?�j��Kg`8�Y8�uQ����X����(Qں��9�&wS��t�J����|6���-!{6�3�v&��xni��60��mt��zY�i}`�~��W��-؞�mz�ًyo���Gp=����z��BWC{(�b�Z��r.�{+Wa��C& �by���j�/�9��z�]�˙ۅ�j�vs�<�<�y_��I�i����{�ڌ� v�'J���fLL<�=ƖD�3�9���A �;�<�}d}���l�9�\b��LdԦ�Z���z�� 2�nN���v�_��>�z�oQ���K��jQ���Y$�����2v��L!8y���9��s�2E��s0��<��/2g�ɪ|$��i����"�F^��ެ�DJ�E�����7)�2�$�O��� �� խ����*J� ���PC_\ IJF��� ��p�B������k�3~n �(65{l�߮�A�����I�&��/��"hZ2l�\�Yxz �QY'�/a�S�,�m��H�A���������,#�h��H�vΖ��{�v�'����k�3�H��0A�È�]ܐ�N@��?��@}L!���@z,���O[��Z�z��.�G�U�}��a�Dq��|g[[C0o�^��un'��n�Q���> �yEy�Na���P����7)]U���P=�:�#ۚ�j���r���9���Y��_,��ر<�b�v#~!������P|LKgSdb6�L�5���%�r6j�<A!��Y�SƟ�Iٳ��Vx��>Zĸ#Sh%��>���4n���>��� ݸ|G5yQ2����Q���$����YE�:.0��&�ƨ+���A�3���<�YW�����I���)���(6+������W�������]9H��7CtDK*�2�v�6:Ҽ��%]��y��������t�F�b���vH�J�v?P��^���Ƭ.dX*�IVf��wN � S�Z!���1x�W� ���%���F���92t �Y�?����2��7�b�����S/�mB�KNP��J(��N��m�:�Ә&�8T-����,�3�@���g�H�˫��Z?�E�v���aD����:��`G��$fE�)\���wIJ�vG��PGc�W.������F�J��y����;�v��50� G֗��d���Xр͇�ʥ�\E������)�W�?w��S�`�)�z���T��O�����w��h�T��!���#5��N�\���E��A���f���<�m@wK~�p�����G�y�Z��Һ���3�;���f��*���3;� ��_V,�t�Ҥ�ϱ���d�y^%؎n2M� K�;�@�ذG�Ur���z�ϰ7��<�gҗ����ߋ�)�&��Q�1��!�w&� �vI��c�����g�9�t�x����H@r����Au����%�����7�S}��f;�!ŌO�Y���9[�?9�y�m�+�;�0��i�@M�� ��ӎv@AG�}�/��W�ݚT"�������E;�������s�����BiN@���blM{�~�1���흟n��$Tn�}N)�=7�4�Ҙ�������M�Ji�lx��0S���[�[���-��`��)���-J��+-���98����0�jSϱFb/� �uM' s�i�}��)Hy˪,�=\v�7�O��חS]_.��m�n�4�I-����wZ�Ղ�fliWl$���{��{��;Is�`�2e.$=�gJ���*� ��M�F�L�uC $?����I�"�%��
Static task
static1
Behavioral task
behavioral1
Sample
6dcfa7d8b52ffe38f951a88fe1ffd051b187792a0095cc826126c9dd332a2490.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6dcfa7d8b52ffe38f951a88fe1ffd051b187792a0095cc826126c9dd332a2490.exe
Resource
win10v2004-20231023-en
General
-
Target
6dcfa7d8b52ffe38f951a88fe1ffd051b187792a0095cc826126c9dd332a2490
-
Size
4.9MB
-
MD5
de8a3f105727aeea6341b7ffc65fc1f8
-
SHA1
eaf4bb496b354c4ec88a5db6ed0fc99cd6201a56
-
SHA256
6dcfa7d8b52ffe38f951a88fe1ffd051b187792a0095cc826126c9dd332a2490
-
SHA512
a5bb7a5b7997c98cfcec2e5b972d259406713159ad087d23fc7c3ab7645173f527676bafb07e82a2b61155bfefe97b05679614a4cf55596298046bcc3f358563
-
SSDEEP
98304:u6WGgVg8PsESIhnILxKp9EqMgV0gJyJYoKomWpMDPAUA:u6WFg8NSIhIVw9LzMSK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6dcfa7d8b52ffe38f951a88fe1ffd051b187792a0095cc826126c9dd332a2490
Files
-
6dcfa7d8b52ffe38f951a88fe1ffd051b187792a0095cc826126c9dd332a2490.exe windows:5 windows x86
59e1f196bb8d7a8ec4968557ed303eb0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord540
msvcrt
_controlfp
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
hid
HidD_GetHidGuid
setupapi
SetupDiEnumDeviceInterfaces
ws2_32
closesocket
advapi32
InitializeSecurityDescriptor
winscard
SCardTransmit
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.luk0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.luk1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ