6?t��Cq�-�tc� }�-uC�v�&��;�d(��"�! ��u� (��{� )�:��`���G��}��brmP���H�qo���;Y��>�W��SN��ϊВ14�fC����"p�Rk���,�A�sJsJ�uAg���̜�����1S=���"cq����'���g������lf���g�q�f�,����0_h��b ��S�5�|��$�ޢRp�Q�8Ƀ�F�dʰ����a�5n�' K����7 �C�""�=+XŎ��8$�t�W�%@U�&���B�M��hE��~n�Z}x�:=�;�ޏW���q)�l�X]��xdH|�%^J?��c���P�O�H�/Aˆw�s������<)��:j ���I�ە�n%�~�T]T|�����,S8��X�9#D�)V�[�PF��w-���n����-����G��=;�=���Aw9�t� L(�>�p�f�����Ո��]T]!������9Hr�#��E'�ҁ�˪ݻ�e>�]�̟������T0�� y]i��9����������L����P�Vz��x����0��� d���Ga��9@z��M��:�j���G�n�g����../nΖǷ���K��h�@}�s�}X���1�DT�����[c��m��sp�_8轄�L�����c�K�M��&B �5Džp��N�~�'�z��4��F�r��(ko�k��OC���RQ��k1�Șc�Ӽ�:%yZ�G�p�|X*��MJJcng݄�'�H��Y�98����U��6�'���� �2����q.�����5������[ {���"��up �1m��3E���\a�j�;�B`x� t��L1Tg$�a����x�o�)�f��a�ޞ�TT��䵅� �!@�� ��ڡ�B�L�Ҟ�NN��/�V���T��z�K��VW%�l���n�\ց�� �O-=l����2�I�X xj��J�l),�!,*�t������� 2����Z>�խ!<�/l<Na��)�������W�wQ�Y/Gt&k�I�DѬ;��I������f�VkO-~�I��+ܿ���e�d`��1��%�Փ��)��r�3� �BnTxw9�T0��%�u������M�G�5��E�^VTE/�Q��O'�4�l�����r/�M��"���4����=.4}z�1�f��D��7,���)���.�Qm��c ���Q}��V�Ѝ�v>V�20w�;�]31bOޣ�� �lF��&���Jy����*������04��Gb�lC����<\Yn������܅���ׅ�����1�+�Uų�����������bnU�~��Ϻ_K:}t�m"ߴ��⠩9BFX�#�v}�hΖ~���Х����S���a�y�eg ړ:���yx/����Iݷ��$^}p���ˎd��x@���,$�H�(�<�Q7kX�:[׀R+���Q��u �uն�#�vr�^l��ĵ ����E�>+A_�f����|T� ẑB���� ��@�W����_�5�����#�����sxqC^������i��0$˻�r��E��^K�wX.�/a�nF���/����N��-jv[���ޛ<h�c'QܫwN8O�$��H*9�w8RK��b5�"9������^|D�G������H##D����D�1�?��c@%�?A�r$6�p� �������"�w�1�.�az���+�h�W�w?D0>��>z� ?f��� �ѵ��#��R�+�"-Go:��L��(�{�]A2�����Y\�<۶e�ﻚ�ҫd���*E��,�aku�@��2��Ty3b�dA#��$k45�O�l�p�*�T��ʍ���jr Z0�����9�&u���a �����3�|A�1���५��PgH�k��WZ�H@�(��*�:�C~��\���l(�Y�ʼ�1z�u4��W�u��6�J�|���^��c��Є����#���t0ݩ�](���rQ��&��yuh�D,��jwJLA�F�����aetL�[���e)�|w�����vx����PoB�:���������T�0E�?rOAj�ih�U��-j$�}��e�$�$��/ r�#�(�I�}�(ۍJ,�����:�+��Bw\��z&�T�m�e�$p�T�c����!ՁV��E�b�M;r�R*l�9sy)����ۛ�O��d�V���� ��Ӱ+������0:���1O���1�D{��VO����I��P?��2�����3���L�Y�7��ËJK�m��߃�Gz�6���=����u���/}fq��W��m�L58~�ѷ�fhw0l�Z�ʾBi�����s\��H�L��]v�̚����[jޣ�K��S!�lF6����<�LB�撣����"��MP76��&9n��f!��=���{<?Po���r#I[m[�(Q����S���ݏ`�Vӻ�T�9*v+��?�֟8n�h���H�B0���*�-r�v�vGZ1ؓn��y$:!j��h2��%�Q��������k4�5` M�#���r��3�+���IJo,Xz|�r��ж�G�]�T�k���D���XA�o �u�}���\$��Y��f�b9��!�}�X��� ������_�o�ПhrO����XNF��h���w�Cp��S�Z��)VE�L��N�6L���:Zv���Ja&��ΐ�{P��),����(��p0�t˧й�pi����o����9o�"��)D�<��%NO����C�eB�D������X�P�mL ��Mn�"S���=��)���e ]"}���C��7b�E)���Ik��ܱ ��F����.v�sO� ox�f��M�h�q��b�g�5,��6G�"�7����d��곃������,�5qؒʶ���[0�J��A~��?���J��< 1�m2X��0&��x�����D�����N?������)��"�ae��/:�L_�T'�{����u�j�Z��P�й�4���5y�0��Y�� ��v�ņ���t(��/���/g��6�?��D(M��G�/�u9tW8�i��;��S(�ۮ�a� M�5���H�n���FV5V�ƈ@�����T�&U
Static task
static1
Behavioral task
behavioral1
Sample
253b611f6af2b57050f8b5b42e9df6ec.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
253b611f6af2b57050f8b5b42e9df6ec.exe
Resource
win10v2004-20231201-en
General
-
Target
253b611f6af2b57050f8b5b42e9df6ec
-
Size
296KB
-
MD5
253b611f6af2b57050f8b5b42e9df6ec
-
SHA1
ffaa9c305a7835cfeff503fb7cc77c6afab9efb8
-
SHA256
f6493ea09541aa220c704ac3e691b0d4089487b0c31247af4300205cc879c4db
-
SHA512
ecac6734e80ca0ccf860d450b0451a07afb7dedf18bd1630c796217da080a6cc9cfe6c0cb5fd6042bd0b50bc3d0e6155ed15d887fd2cb7ccaca47465f6c37750
-
SSDEEP
6144:8HMavav8yLXQAofZGNutSRcKI1GPS9kfDYCivoL2SSn6m:8swy3LXQpZGNYr0ikfDYVoL2J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 253b611f6af2b57050f8b5b42e9df6ec
Files
-
253b611f6af2b57050f8b5b42e9df6ec.exe windows:5 windows x64 arch:x64
fda6fc6606ad62631b3f82d6f97bfcd6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlCaptureContext
kernel32
FreeResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
advapi32
GetNamedSecurityInfoA
shell32
SHGetSpecialFolderLocation
ole32
CoUninitialize
oleaut32
VariantClear
shlwapi
PathFileExistsA
msvcp100
?flags@ios_base@std@@QEBAHXZ
msvcr100
memmove_s
winhttp
WinHttpSendRequest
iphlpapi
SendARP
rpcrt4
UuidCreateSequential
ws2_32
inet_addr
Exports
Exports
Sections
.text Size: - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hello0 Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hello1 Size: 293KB - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ