�<�0"�r��5f� ����k����Q1�!�d|L%?L��.��%<��73��}���n��";�ϸ8�˫�.F�q%~�E��wYô��~f���0D��)=�ٙ)�Xz�@��rc�'�}n��3�BPuk�L��~�u���w�砊z7��1��X���:%>���ڕ80fd`W��VTC�� miY�w�A��}�9���6���+�$Q`2=l�x,�M{��p�*Us9л҈��w���[%�������Zr��p7����E����f�*���YG������N��50,�!�n���M�ֲ=m*2�+�����#� �܃2{��_&����(� ���Ƨ3o�g��$xV��s#�S/�}z��o��C�/�=��6���b�[�8������I~qs��u�_65�W\�/2���!r-۰A�D����f��v=J�ދ�}:�����d1I��������I0�K."��$'��~�T�LԔ�ʓ 8p��$^�=�C��e�\���N#�bA z����N}0Fea�<�ǥ�|{+�(-������"E�7o/��75�Sn�X�%<���4��̒�7�R�ͅK���G�n��2.~� ������a��1#��Է���^,vRL��A&e\R�5��V�<7��w�¹VN�6y�ܵ��!Q$� j����ΜӐ��ahZxS;����,q���ű�5��:˰��!}P��&tK�|�ʥqc���XiWs��4ξħxWZu\Ĵ�ө��z�FN5���b�)��JP��Oq<�ҰD2hPbH"�����N���a�m�O���|b� ��}r����GmAe��ԫ�bv�.Θ�ؿ!T��͝[��w���<ӳ�(�GVӸ� -���]�6m��T�^�/��V.�se��]�h��F�i��8�;��,��B�����f��¼� FVu�L�4 H�a�@z�u\��X�&����k->�P@�»�Gi��j)7�r�9�=bj�H��|d$�2 �9R�eB�=�Rؚ��c�[J���L$�C�y9�^�������?E������m��4دL{[�V�iE�.�Oz,i�*��|�dc{�e�Qzb>r�=GSM������*��Ǫ�!`,�*yP��K�`�� u���x���� vw7t���]�����ƣ{�-9Mv�YP�����7�p�B���c ?��r��`.���,�����Y�e�-��:�e���Ф�X��>T�'�|b0{\{q�wkv!���-;7�s�W[y��ylZ�a��`�"G�nL| �����>�|��u���_�HXx��P17'�������|*�0j|�|Ԝ��Q�i*{t�,ɨ���mTV�V��_�3���\���{��l�6�ҩu����*Ŕ�[%�?���f���cA�����C8R�呹SWt����!�z�=!� GDI�p��8p��v��kwVٷJ���C2����ǀ��_e���%��q �&���3聏�:K��4-X�遐�x>ΐ���T�n��~��JRo�Q�x@bS�ӋC� �j��z�_��Lim�=:,MAr1MǠ���4���pa�Ci��s��� ����;=�S����V��_�J�$ti>9Iػ�L"�dR-ZWdQ���z�y =&!���37NR��7D��}�\.�_p���Wh�����;8!�|Є��r��pO(LkeN<7�� ��p ���S:��c(���t����K7*�9��#�����X����b�Y�;q��h�:>rNW�#�Z���� a�M{�V�e��.���BU�m��n)�T�ư0�Vu��J�x����n�X�O�[���H�A�z�ޏ�t��q(��wK�� ���UL�ߥ��ް�z�-8�M$R�J�d���z���F2q�����7RQYȂ��T���=V�k1y ��ה�8��������9-��a(U���ju|T�nE>����A��=��'w ��kC�=l�lHS¶�P��ڣ��K_^���'����Q{4�D�1�{#���} _�X�$s)�&�1�Dͫ�)U��}��w[ ����Q�Q7��+�s�5�Y��A1+Ƕ��+Z�5B��9G���p����i��%Z/���i�{�W��g ��|�qED.ׇ���� Sy� k�:S�cM��9Xdj��:��9e=AR����M�y�nT����2�K g+�7���=k�,���t� 2.�Xe����eP��Z���IL��E�Xbl����+����E]1�R'(��.^�f����j�?]���rzN��p84����r��3 �y��Z�M�y���I,L���"/���ܥ.j�yZ�m�46��D��%��9�M*�蘃���xM^BĚ�G�`��͍�"g�B����f�������h ?6���^32'��CZ�e��Mҵ������,�]z��'/����a_ �V=%���?C�K�;|&PT� *i֙�$�/ %͊;��\�|v}7Nl���I��Q�{�۾k#ɮ��ŸD�vV`X8ۉ��j�/�s����J��hA��>Y��;g�I�:b��k�G�xR4S1�>e��A�Ί��a�魣Ŭ�ߩo��W�PH��~� ���1���M� ��N�ے�>�ZwD�W����GP-ֺx�}O�����J�_a��=�r|3E�e��<�6.��`H����/�I;+}źF7�&�ɉI��wm�t�e��0Y�Ͱ��h���8�m� �Qg#I�.6����3>2Fd�M�-d�s�H���6)Z<���y�<�pdE�{�~J�Ҋ��tV�"��Th��7���B�����tH�"�z㕄F�m�|� �>�����+�V���ʰ��#��}1O w�9��2�ǹ;#��A`�U�d��6DK��/�w�%���704��2\��&{1?^�y_8)�X�L\�]&<�k����� ,#"Y�ɽ ����k�1�}�S�y����ݵ�m?���|�1m �,n��"�[5X�7fE���J������nP�ζ����J.�ϥH�Qe\��%Y2Vw�qD�������&�x��g���bq��Z��M��C�Ace3V�S�\zDz��ZV
Static task
static1
Behavioral task
behavioral1
Sample
55a2ad772970ec6b25bbc53cd7e71933533896372d8633ad64d0b618d61795d5.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
55a2ad772970ec6b25bbc53cd7e71933533896372d8633ad64d0b618d61795d5.exe
Resource
win10v2004-20231127-en
General
-
Target
55a2ad772970ec6b25bbc53cd7e71933533896372d8633ad64d0b618d61795d5
-
Size
15.0MB
-
MD5
9f77999bcc911a71132d598235cf303e
-
SHA1
73f481a5de2fec0c82fe967a2680f1b430d42638
-
SHA256
55a2ad772970ec6b25bbc53cd7e71933533896372d8633ad64d0b618d61795d5
-
SHA512
1db5235c0e46a2c5947ca9bdc925a85b03c618255705489fb5b62d27b8eb6c3ec6a34f44eeff7797c15ab39eb3ae60d1f28c176991f6fa879ce3c6b8168d6e34
-
SSDEEP
393216:BDAoBgoKeHS+RomlbJ22DCKQfCuHdpj/Qp2e5du:BMoBv6+RF7bDbQK622eC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55a2ad772970ec6b25bbc53cd7e71933533896372d8633ad64d0b618d61795d5
Files
-
55a2ad772970ec6b25bbc53cd7e71933533896372d8633ad64d0b618d61795d5.exe windows:6 windows x64 arch:x64
9ac90dddff74e00cc0e04015815bfb58
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowsHookExA
CharUpperBuffW
advapi32
CryptHashData
shell32
ShellExecuteA
msvcp140
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
wininet
InternetOpenA
urlmon
URLDownloadToFileA
ntdll
RtlImageNtHeader
normaliz
IdnToAscii
wldap32
ord27
crypt32
CryptStringToBinaryA
ws2_32
ntohs
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Exports
Exports
Sections
.text Size: - Virtual size: 614KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
./"T Size: - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.KB] Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.S@b Size: 15.0MB - Virtual size: 15.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ