��"��b�$�!�H�Fk���S�r8��楉�Y� @M$��v+%�^��#�M��~���xH�m<E�(��k ��WN�EDxyO�U��0S\��u�G^)�#�xڦh� �[�)���.��G(���۬I�-�D�lĵ+�7rO�|-ih���M��;T�����+{!�:��݃"�.��_*��:����H�OLjh����7�bϡ��ظ[3��U������O�U����[�J� M��~���~�|��&:�h�)�=�����ȰD�T1���Or :���{!�|׆�`��B�-���6ロJ��|��O}����)��?L+��#H�a���?�|d���jd���^�$��Y�6�(�)�W_���E`�a#����]�l�"�+@ �N���wKr� YK� Y�,�`_��H��k�Mљ˄�4�/�28��E�&[\af��8Z�6CY?/�~���*���8���fP�qEƗ֓b� �WЊi��ځ�L~�|��.#���R-d 4����� �����'�\8 �\U����1d�Y�ÕK���i�����M5�Ƃ���߱�C~�����.3PR颹"�����N�~ �����^\��R� j��F�{y�Q� ���]�HÂā�k��ԁ�t�-oD��� �B� �f̓R�[�Qx[��,�9�aX�!/4l��H���g�'�Ȓ�j���Qj�1�r�-��P��2�q~�Si��Џ��jD�Lt�``H#7J��J�eR��5Qh#\��_�=p��^Y��By�DmPB>v�w��=�>kW_�G�����Jiv�{����-�Vk���C��������,�Y� ��\�����S}�Y��t�ݰzK�Ζ4���V���4�&P!,{��l���=r�ɪ�ݸ_�I�8uZ�_��͖�*{�Y#��]F����@~����:�����f;d���%��>����n�s[��)n&:�����V�������5�Ō�xM�����[<f�b5��� #bq��/Mp�B)�Z��ߙ'��s+�_q����6�nU� hnP����(`o�jay���Î�����A �{$�|�����M�.oѿ��E߭kH9��L�>�4��'��B�|�� t�/0?���A�3y-.�!]+#�%�� M|0X���~ ���Y]D�n��p=�O�z1��� e�_p&���f���jsCy��zy��Y|�)���K�YeH��f-6� ��YІ��M������������L>�歨�T��"묱8b�*O y0����:4��(Gq�}.|[N2�~�7Uԕ+!���ۢ��d�RΓ����dT��R��=%��ōw���%~�$��v�ue�-���)���I��I�)�K��_Z �|�~K���\��uv�Z�,�f"�\1�2%L�ܷW}o]E�܅թ���g�qx���/�Iϔ۶�-���f��k�/~@t����2yPX���A�(.G����"[�ģ��\Ԝ��K m�����i}��B�G�;��u�8�.����3g�2�A��T�a� i���(g�2�_1FC���CD��N�� ��AY��-1Ep��FD�}ąvީQGH���]��3y�R=�e^G6�`����6�H*0 ��7TӒ���J��T��ϐX= � ��f9�MM�b��V'Z�aE����B���c?<2� ��*uʍ���v��o�����n�Iɂ}ϩ�6( 17B�F/[��7�,.�����c�>��(E�x����:��`��\���1�N��)����@Y�C1��V��{� z�����3�]!����L9���~��n-<p����h&f�υTK��W�������� ��)��;��;,�N��}2i���~;�6�]�r��9��a*��#-G�fݠ]c�хݼY\~/KY�yjA'��Mk������Ir<Ґ\����%��@w��n�?~`�F�=���+�+J]�u������V[��)G߃�V�e���g�g���5j7T���9v�)�c��J���T�JU2��?�#�c)�)a��kcG�R���ڄz� �Қ�B�ǔ��1d<_�� ����+�t�E�����7 ���&��iN�2�"2� O��;�R�,�?�_�Bܯ�/pX�1a�;�0&�(�^���dp��L|kOK�83�mh��Ѻd��>Z<�u�lvA��W�[axh���VP ���V�BLl� �\�O��.o~��ܥ? $#ҕ����A#��#i�x`֖�/�:��!���B��k��"V���3�HZ�bAN��N8ARV2��O�5����w�F��HwF.g��D9K]D �s�p��Js ;�-��>��CA4��GC9���|J�=�������>��9�bN6���N������J{G%[���U� fd�K8��2'�C����v��p�_RVO�,#{R�F\���?�Wԭօ�<��L�W�G��H!0�Mm�!��iwԚ�+$0�k礖�]�t��@O'���q-���)���0���z�|����i��*V���{�t�!�~A�s8@�y+��T!^�u�������k�Qo�@�U�hAL. ��; B�`\)�p���/�f�i��,��%�Z��b�C���h�g��V������K�b L�/�(����1�pe��A��$�o���:��8#T��=�J@���m-<����`�^�lC�� `���G�����#UR�㦥]�|�� �f��}����g��.��^�,�X�-V4��0���"�+����� ��n�/˽6�9�[� �+h�A` 4�o�D���L�-� �4�����^�,���+�J�Y]f��$��;'�B��Pi{!~�R�"vǪ}F;��Q�m�d���7��?6���I�tnK'yh۔��cH�4��� |���(RƑ����p�lN�5l����B$��R|��\��F�]]������;�ܻ֘|�Y���wR�z)�G���oP �\vz,���_H�譃8_�+8�)0Mc�����'F�g��B��5bD%�~i�=5u-P�ɬ" ��p'3����ᗈ���L6�"^�'HI�8!w(�f�z"<��$t"�h�o��~\��uV�9�#"�h
Static task
static1
Behavioral task
behavioral1
Sample
92d4268e19e91bfe.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
92d4268e19e91bfe.exe
Resource
win10v2004-20231020-en
General
-
Target
92d4268e19e91bfe.exe
-
Size
5.8MB
-
MD5
1ecffc4612c32cb035be923f9aa949e7
-
SHA1
e4ee37020b55dba7bc2b6ee399ff563627b18ee0
-
SHA256
65835d44e03f1eccf06b03f6fb27d6aeb54f8ac4bd6e6d43db03490fa62390ed
-
SHA512
0fa7d4ad7d3f752e223cadd3301fe9c40353de2419eb4ce526322aaa59b4e6db2741af314a5bdcba5a518f98834281045de601499b69fdf758f73769ea4d9147
-
SSDEEP
98304:xVe0vRprQlVEqN9mt2E8rJ1KLIPUVaNhgU65vE0KT5AeNrMvBE1qs0kWD0GKIXU+:C0vXclS4maJjrNhME0mSuUBv0GKOUbbw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 92d4268e19e91bfe.exe
Files
-
92d4268e19e91bfe.exe.exe windows:6 windows x64 arch:x64
7748ce1a2b7499e07d0ef9064555d429
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegOpenKeyA
ntdll
RtlInitUnicodeString
urlmon
URLDownloadToFileA
wininet
InternetCloseHandle
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 301KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.t`\ Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Osf Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.'Fx Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ