���#ԝ�A�o�c0 �D˄�����>�}���MΞ��������s���w<�W����0��ȧC�"FڍO��{(em�f��@ה�?�n�y��}v>+���G�sz]f#[Q��-�`��wQ|���?��#P�:������6Zd �S�deY��d���ca ��yj����� JɁ�m��X��X8 3��#� a<Rut�>��Ҷ��K��1W�"l{Q˲ěv�L_��q):�8LCxX��BZ�ም� w���KQ{>�,`��$n���rw4<;ITFm�j��RQվ飱F�v���IK|}X��c3�A �D��*+�� x �r6"2�����H�d_R���d�8F��~W��KtU����r���~����A!ҁ��^Ѓ- #�����V� e���(��J�d�N*��0�m!�OY ���_)��ʶL�H1m��� �.v�̣H�ٙ@��c���W�~�3�KX��W���*��#u������h�;��b��i���Z�(IuE�>����s��ŕ(��_��r�}�F��Qaf���=�%Wy1�(�������:��ܚ�uPԹM=�:ZҦWT���]#�V&m<H�7�#�]��f��/-�@3��k���+���2�ͼAh�_)�gz�evN�$ˌ�V�1ˉt��&�%W�:¾]�����ߞ�K����wC�MI��Tm�d���<�?��5lK���w@W��Mx�6�WP!ySbab�Tظ�W� ����ww�n���? \:�}5�!�t���|��-))n%/�_K���?���d@�关nc�F��ep����r�51:s/˭�Ȑ�V�Xt�cw�7ۏ�W4����.廜�Z��M��8�#�hV�6��q�X�m&ݧfT^ 'ɜ��#�h+�)E�]� �G%^<�=�_��NZO7~$�ut���9��/al�zr ($��N:��*|i�)^��lU�]���J؏���&վx��vv,� ��vڀU �37� F����Z�Ӟu�A,���Oڝ���k0�*�Ǯ $T[�V����H���X�� m�K$��*�r�)+#�{����,��i�r�ӧ��#@��8��Q`�]CQS7��ȂV�j�P�?��,FH�[�s�.�Ix�2S�S��{���w�Q:� �9���i��7�zfڵ�{��嘦&5�E�эUcP�/���k)(�����>�5�o��8�A(d�ݓ$�6���8y �m��$��o(��R�N7b�>� iP��i�����,p;p�Or�[�3� �&^��'k#�SS�PX��������B�$M�#$N�����I_�~��J) <��Đ����ab�Y� 5���%���0S�0�����c���T[7�,h�vk����t��c+��5���9`+?W/0��K�i�9+q����ȵ6�j �-�6�~0���x�jv�KD`d=���u@�>=;�������b~Q=uB��Vx����&���P��֕�i���piy��Fl�G����:�Bش�SF5�>�@C0�=Am�>~�e�T.�U�v��9�Ob#\�����J��O��U�x8���~},��CH�B4�1��wqz���B;����Xl.�6�{�����~/��ݛQ������'u ��� ��fW���]G�E Ė=M��OrS����=�Vh� �z��%��3���v����:Y����^rg_�oM ��3�&Ũ�Y-d�u?9�l��9v$��A��J�8�R��'W��2�]��9c;��Z1�V$=��{����𣺸��gDI���*���N"��7"@}�\�������fZ$�H����z�\����Tޮ��w���/* ��#[��Z���<��YJ1���}��݁ g� �����O�\g��������/��M:��Bk.�I6�[����2�2�����[n�}�`�Y��f�^��po�j�s�$k����`X��cYq�P���&!�zf�o#Qj�����PP*�u����\��)��37�rdI�=ȈW�����y�Ih#@r�+���~�t��H��p�T�u�9��玺6_N�A���[��wڑ�.,{�� ���yL���;Ah}���4H�&,��� >��T��z�%����Rpl��I#&d����*�EQ�H���ܿ ��b�!�mJ�=�QX��\�P/s��-ڽ�1B�ȅ��tj��n������R��v WHӈG J�����x�R���.�v�9�GY�91yQ����>k��z@ rڑ�`}�+������E�QX�f�S4W�K=D8o�S�%�E].pJtOs�5�_�oC�wk�����m��������)��h�Y��iY<��8��M/��y�b ���2��4����'7�˅_2[q��h�G@́���dz�`����9@q l�y���{бq�Y�j��P�Y�ղ�*�`�vܰ�s�zB�,1)����|����j�a.���b�V9W��z��04 �L���)�]O�\N'�����9lܠ;��Y�/;���t�-o��j�ys�R9m�ﻒ�lïp�����1ɽhYdӄ*.�~�����2��v�Y��}~p���\����ߩ��Y��]��C�����@�*',��������b��P��&�`k) �_��R��ʺ��h!��IX]��J��p�����9ؐx_ ���?�3D�����r��ȸ� a�>�v��o�t��cr�o��/���J�i{Z�t�QnV��#?V�D;#�sԹ-cV)9��m�'�Q7exy�nnj�"�|*��-�?�!=�h7*��%0�B�Y�V"�X��`Pa���&�D�(�w�u9�@f� L���V�{���N*����� C��["����+��Ƅ�x��u-��#��U��TdH}�]�5�+��WhP��+O�V�tq)�?�v ?^^o?���EN��\R2%�{��~�Z��jX�x��=��d��Ψ4ǭ����$}�?;@-�]7�*9����?_�V��R�E/n��nuwVM�a��7�卌��(a��43
Static task
static1
Behavioral task
behavioral1
Sample
f8f3a683ef3c48105fb3153d7d0de5d8d0476e596792ce7b57e7a696e518eb19.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
f8f3a683ef3c48105fb3153d7d0de5d8d0476e596792ce7b57e7a696e518eb19.exe
Resource
win10v2004-20231025-en
General
-
Target
f8f3a683ef3c48105fb3153d7d0de5d8d0476e596792ce7b57e7a696e518eb19
-
Size
11.8MB
-
MD5
dd80488e0fc0795936962ab00e8e6863
-
SHA1
a9a50b4614a8150eded75657e46da166c2c422e2
-
SHA256
f8f3a683ef3c48105fb3153d7d0de5d8d0476e596792ce7b57e7a696e518eb19
-
SHA512
d2d2bd07beb25299f9668f609b2fe0f7b6d551466b8e5929b78a9e064031e64dbd2ea9f17e9fa7cf1bf82b3dd8b7b76c9ad9a885903daa7c3c39be4a745341cc
-
SSDEEP
196608:KndrFm1+ATizzUrFVrzcjHqEXYFa3wKGyyCG2xohtA/iK:KC1OzzUZVrWHtCDaKgl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8f3a683ef3c48105fb3153d7d0de5d8d0476e596792ce7b57e7a696e518eb19
Files
-
f8f3a683ef3c48105fb3153d7d0de5d8d0476e596792ce7b57e7a696e518eb19.exe windows:6 windows x64 arch:x64
e04124922d2ffcab8c295ffa05ee8015
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
winspool.drv
DocumentPropertiesA
advapi32
RegEnumValueA
shell32
ShellExecuteA
shlwapi
PathFindFileNameA
ole32
CoTaskMemFree
oleaut32
VariantChangeType
oleacc
LresultFromObject
iphlpapi
GetInterfaceInfo
msvcrt
_wcsnicmp
psapi
GetMappedFileNameW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
2 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 647B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ