�K5�"��C�ce= ���J�s�(wh�BML�7]�� ��+���u�mA�W��^]�az��J����c�=h8��uQ"�ӻc�N��'�M1��?�1\#�计`y_~_-(-�Vi�a3r����՝�����S�u,k)F�A�v�I�<�_3�R.�G����@�7�VCf��[��]��džj��#ST��#�q�X���������$�!��R `�M70�F�: �{~��a�M��7\��S��B����%��A��hr\ Bz�����p{ϩZ��T鑪��CA�~D�`�PC�w��G>k ?����R3�?��Н��E�\N��?v&��ίJ�@��"���!y �����9s�w!��� W$<��yGo��x� B,�d��w�?BD�Q4/� ���Yl��^P�l�u�y����?C�_���{������g���'��~f��`���I'���>V������GQM7N��g,|Kd�M��f�z�6� ���$ �7ª,(����3u��n�=o�O�����g4���5�慊���h���� Z'���&�h�W�1��������g?��h��"bni�/�Y=������>e�|��u��9��10���h����>�K��U��mp5 ���R��vR�K��r�O�֜$��'�e7���>��TD%gKK�s������^�L�[P[�{�(Q�3㢩V�>����j��|Yd�� �0�#m�7�����a4/�� vf+���n.�N�W�᭪(R�R���j���V��Ϊ#�s�PEf�A���2}�A�'6��]��}�<��^�p(�����"g�ӛ���G��j��(_�]���UT� �~�]fKsF>�b�ԭ%o����X��������p�A����^��QW����J�I��J���B��M���`Qv����v�p�^��hO(�°U�����|�)���x��0Z��;��i5�R��2E%Z��hl�,>z.�1�{�,2������y � �ej�]�y�h�2���:��/e���� ���T��ȶ��+�X�<Ɩm"rȇ�?bz��'�Ύ^�����C�� �$�H=�6S�2���m��Q�p4k:�w����[�|yBq�U^F�M/\:�h�j�>�kC�TbJ�4rWW�P�y���)�Q��R�,�N��'��+?�,�*�3s?�2��T)�'��<3�p�[�u��m℮w��F�l�,��l��(VL���e3C�5�-�s�<����e5������ߍ��L�Ew*7�z�5+����`Y�KP�>|�e)�x�P��|�y��6+��A.'y�ʧ}B@���6�����^=R����j�&%6G������Q%尴���BEH]���wD�~���x��$Y_�h�C���8��;^�Լ�!I���7���~���vO���;�ZAEf��c���"�*AW�P�Ӎ��#�^Q�l Zh�u�7���Fؠ��Pxe�$3h#����ϩ���X��:���C�,����8�P�CL��UV(��������)����hP˺������� >Cf�8~�/5�\�7b�C��D�Z������PF��[S ksD�I��zq��#�>W͒��{��bC�9@ѕW�x��1��̎冀+q�NU ���Y�&CWLP0��o��x����q��<�5� Us6����;���7��D�G��%�tcS�?�"a� >���gL_�=aǡ��z� ��e�G�;�t�ªt^��M*���&;�$Θ�5�&[�U����u8��碎߷m�8H�=���+�R-�e� \v���\��.[�!�~�m�R��7���8�R˅��+�!�$��� �����R� ��>W�d^d��l��<x*����? n�(<���� MԞG��`4�WkK�$��L�W�g��i m���LSxK�>G��{\yzk���B�_��.��(iϑEU��gZ���+��y@P(���M%��ճ���1��`��=��K�$��x�>G�u�d����ת������������!ѧ=��q���Z��a���u��nG��YX�|0C��i�gWTﴄ�3I���J�jH���ݤ�|���k� UE��X���u�i����'q-O�k F�Gc�%B���`6��� 4�ׂ �� 2K.`C���cdVA��{=�M� �j��u��6_q"n����г� 3!��hJ��^A����õS�V�����fx�7y黶��A1X�#+T�f*�L(ȶ78��~��`5��^�^<=g���UK>��f�|ЭJ��LY�� D5��Ѻ�(ͱ�U��[gX$�cM1�����ݳئ�'߃b�qe�2H�f{D�I����B����������X4�_��:��MW�YJ��a�l63��� ��_��h\����Xk�m����zPzCu���a��[�̤+�����kT��XUS�������=⤅1��`>�q���5�<Ї���OR�ջ�Z�X�u�Ԗ�ݢ� �>U$v��9C�q�&�$6�W�[Z)7�V�/��(�V����A��<�� WNcf�`�CJ֔����q$�x��_����_|�� ^���[1G�S��ʏ��͇jۑ|O2k�,�ż��5�Nj���$�9IA�r��|K��[����a'�őz���\���2��~%lp�y2���$�r��Ģ�2`Hp���m��3h�����L|����;Ē�KW�9e��qz���j4�7�aK�`hꇀs]���)���nR��ĜZ̋�Wm�m�r�)�L{�/�] �챉�7��&�wS�RH����e�|�I!m�9��`w���~Bm�W���*�����N��{�0NP05q�9$SA3ɡ�����#�H"Jr�TdE�{6��S�rT*��ox�BX���!FG�}n�g4�DB�Fk� 1H�d:��� �����p(nKi��5��/�ǘ�F��h&�]�q���t�ͧ�3Y�����p%�%�.��E�Y�c�;Ќd$qpQ�t�.��?(��M Mo��KI����U���3��Kb��8 �(��h����H�L٬��� ��k������
Static task
static1
Behavioral task
behavioral1
Sample
for_eac.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
for_eac.exe
Resource
win10v2004-20231023-en
General
-
Target
for_eac.exe
-
Size
10.0MB
-
MD5
89628ce2cecaae9326c478714dfc1737
-
SHA1
02a8b81b2d7b73d1c210c69835a4ab98b871f2b3
-
SHA256
4c66c6e3aac4c7c14cf304581a64ca4ba2c5b5999b867ca8626050c4dbd6f320
-
SHA512
a4301b2e3dc866e0192d016063f222ca9959feebf861995a8a253ff83490285ae7abb97f1f96c39fc17273b1b743a3618c5721a6904e9d7c7f75e880033438d7
-
SSDEEP
196608:WGtlkIE1JDqrmEUPRXn0gab1CqR+9r5oHE5L9E/FUiRp6KqQm4ng+KP:W/zJDtN5naJSrEkeFUHKqQrng+K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource for_eac.exe
Files
-
for_eac.exe.exe windows:6 windows x64 arch:x64
d3a705c211d054a14f8a011dc84ed2ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryFullProcessImageNameA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
AllocateAndInitializeSid
shell32
SHFileOperationW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
iphlpapi
GetAdaptersInfo
shlwapi
StrStrW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-convert-l1-1-0
_itoa_s
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
iswxdigit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 972B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xtreh0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xtreh1 Size: 10.0MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ