СD�^1�!=.j+�1c�&E^¢X����>a ��)fu���Q�n`�����K<�1�%�q~�w�"3�We��Z���~����!�����:K3�üv�;�^d2�̓�j��G�@�N���%���� 0~E�[�r>kZ�4��'������*�ⱴ�����ɂ:ٯ8E��+��ϩ��p�S�\���ra�I�S���Q������N?�r�>Ra��jD�C_��$�Z���4P�½�o�c���=�['�H5)�N>i��Y t��3� k�@1r*���3Vk:�����X��&��.���x�Xd���x.h�s�D�]��>�k�ý��]!��=��\��\��2���-����(Y���|J� pH|$.o���K��q:h3?� ژ��ͣr�r[���o#a&�)}�/�i����XzU��s�g�IA���7<NC��p�kl������.��?h$�Fm1G�/��cf�j��������@:}��h=i��Q��W�j<��1j/�z@�"����K6>��b���{h�?��<�M<��IY����!O�v�s�2�p���h&�XU\C�,�U��>\�)������CN?궬,�E���L��>�t@)��n�� �'l{)q�~[��Ai����Q7߁�Ә7F��ٵx�`ި/�\�$��ם�r�U7�TC:)M�&ze@�<���;(����{ *IE�ݪ+1!D� U�ah�^�z;�n������P��nQb�4Qn�Q�ڧ(�b#JG����v�В���K��%�J���y��v|���*�f�Y���*Iv��$�?X� ��q��e-�N��N٠��RΠ��� ��!m֩ƻz3t�M/�;�%�!F%�p}|��TV�Yd�ɶL =���Z�j:���ñ��a������H��x�V����#5�[Lu�:Cb��֔��9��Q.��ּ�+�h�D��$���V��YHk٘_�`� �ÿ�t%��w��6��p�����סv[� ��G�E��^Ψ\���4#$���Sn��-�6�M����B���2K7(�Ah���>�&�[ ��w������X2*�R�_�}٩ą0��WkIa�)#�w���&]Ρ��摊0�:��*&F��; �.�c0�2~��Q 8�-�:V#�����a�j�$H�����]�&6�d:~?�ʬa���h2��j��[���߉'R���O�C����`l�4���B���τ�m`.qi*�� ��)%���m���0J��s� ���8-頴���;A���LA� }�f����!.w=�Im�J�}|W�vYO���7��.���� � 1 ���<��خ�7�˲�$��U=MJs�YL6�3�tOx��h �y��Lε��Z���(1�u�p�ʳ���3��Д>%�ڰ��3��l�`�����4����-�-������-����l-]�{)���-|ӣ�)!����$�����P>;��ı`�.�Ɩ�uy�<H�)��yN ]q}�:�bq�#� hi�;�?#d�N� �$Y��j��5m=���1 W��Gi��E`.�.�.[����ʆ0�8 �}{�#���)j!B7���w(cj�eN�S��EK)H�`d`��佮2�Z�500N4Ƚ�S)�*z`_or�8��Ez$�t)� ��e8�����;A+c�R�S2 �i�ꑻ�"mg����2g��iW�C���a3+��������q�$��t����:��Z�Y�XSY�dػ�t��`tQ@�e�i��&e�4*60d�H!*��I:�8� Z����"q�|���oK�N����H��fPE����q@�`�=Q�rȡ��?vq^k���]��ZX�z6#�D�{,sV�ak H�ӏ��ֆ$�� ���K{�g������zK� ��� �(�w�~��gR+-�?�C;�w�d�]m��<kn+�""\"�i�-2�R( �OS����M yᒞ$��;���Mb'T�oN[W�_��_U�tl*��=4��l0���� ?�r$�֙�~:�W�k5A��iCtq���4��gĴ|r��#��_dG���X H����4ס`T�˶��6�'>8X(ؑ����9���O�2�G��F��G��2*��Gc\'�u=~�٤��x&bπ��fa�X����XF;lk���G�z���������~����j2v. dbod���Rg'@�䀹��Lf���a,#T�,H�V�DvYp0Ld�D�4�4)�I�p�/>D��Gl��m��T�D�* ���{���;��֮�����o!���4�Pr��~6�yI�n!;^D�������h�=���4���рӣ��;H<��)���ǠKx:Uj�?�N�X?����k�hf�Re�(���➫G�� ��5pS�s��� �_��&�u�[���0Q�,"-�Q ��Jp!mΔr��R��&G̉��Du22U����C�����/Y ������vD)�й��k/��ͱ���Mm%U������ivi�g 9����R$��čojD�&�� A���z?x[�p���n��8ڡ�M�%�६�xI'f�;J��ꥅ���h2~��'B�1n�q��\�c�:����p�#�d�B9�SI�-H:�;��d?��� �s�� ҧ�/�������h��G�:$���6"�#M���a�)�Ч�쐽�C��]���3�y~6=K�X�-PP3IP7�1i�v����\������Y*)���G.�8��m.�L��NJ�i�����j�8�~qy,p ��IUY�}�z�ViJ!�d9۟dy�kl�[�;���w� BS��c E8�,q�Ř���I}�t���X@�xdޟB���Lfl{�0X�ԓ����,�^��`gڒqǕ��+���w^��y�o@�ۋD{��k���v��Y���;�h*�y8�4���������@)b(���S`R&�;o��������ja�NEs�����*:`�ߞ-�8�lTr��Ѹ�#2�f�:o�}V�+��3. ��JJ� $��2����9ԣ������"]�C�HC�BT�tBl$Q���$�5ʕy��5��\��T��
Static task
static1
Behavioral task
behavioral1
Sample
a155fd5d4ebd9802d6af0d4100363b42fdfee3b6f153e6eb7ef042fa999f1578.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
a155fd5d4ebd9802d6af0d4100363b42fdfee3b6f153e6eb7ef042fa999f1578.exe
Resource
win10v2004-20231020-en
General
-
Target
a155fd5d4ebd9802d6af0d4100363b42fdfee3b6f153e6eb7ef042fa999f1578
-
Size
5.8MB
-
MD5
ea90b8613d00a6232567eb297e07a683
-
SHA1
fa613a702323b1bdc3493625f8ae7ab31dfd06ed
-
SHA256
a155fd5d4ebd9802d6af0d4100363b42fdfee3b6f153e6eb7ef042fa999f1578
-
SHA512
0b897d98619addef91d65ecfc7443ec80fd5ca7b60a0df662ede9cdd0f83ae638d91a3d054d9a303f5eb21e6686d16e4d17a91372ae71ddb315d64b35de23d3f
-
SSDEEP
98304:70TIbnmgLf6BsDCHOpiT2v2XlzbnTbNWhKW74beRzto7A70Zj+8nBAzl0UWJ/A:70TamnsTiC2XlvvNWhKNbMjol+OBARku
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a155fd5d4ebd9802d6af0d4100363b42fdfee3b6f153e6eb7ef042fa999f1578
Files
-
a155fd5d4ebd9802d6af0d4100363b42fdfee3b6f153e6eb7ef042fa999f1578.exe windows:6 windows x64 arch:x64
6c64a3a2698d86b864aab9e6e470028e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32FirstW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
msvcp140
_Query_perf_frequency
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
winmm
PlaySoundW
ntdll
RtlVirtualUnwind
imm32
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
pow
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 824KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.000 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.001 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ