����� $�e: p�:��-i�c�/�~=��3�U��\�h������\@���'B%px|���bt�$*�m�ף�j���z5��蔱2�ި�eM���C��s�s'��T���+����L)�lX����N � �R��O��͆8 H�� B�{�X���P~��?"���e�>yĽ XC� ��^�Sz��H'2����똪��#]�g/̣��x:t[��&(��ImGL�KC�̄K�v�W_'�����[�8�%U���E4��� ���� qg\��Y�.7�6RMijW-E}�흥*z�aR���Ә��qA�9q��̛C�M����H��t�,��Gee~+;w���bÔ:�δ/ę2�N��@�1���)��wP�opQB��[,Kdk~�EU:_�;����2�����^^j��]��?,�Xh�=��'1O�9�b��:)�ݸ2��5EV>�Ժ���[�v���$'��(���,����]3�L|e��կ0&������h����� K=j�1�l�!npcI�[���ťXǫRn֤����{gAz����K�|�%w�M*|le#�r7�$�����L{#it+��o;y�})_�W�_ ;�d�$��M��j��5�Ul�A�f�7�b=Ф�댠��Q7 �:�.�".2��_��Ue��� �����DI#&�F����������,��̅K��t�Զ��my=�\��E����PG�E$�q��GH�n�H���O�W`m���Pʥ�����?a���gFa?�沓r�F9�]������|ȏF���U���bI815M�415��8)DdA}�S�$�@g��Ax}]ڌ2#��t���Y�?�L��m�m��Ɋ��:7t��En�Ǥ+��e�]�@E��U.�b�D�҈z��5H;��F��Vf9Z���g�tFJ���7���\O/e|��"8�r�_���1� +Ӌ��s�"����wX������@�&J�LԠ��]����������%'�a�W/��Xy���Z��t*X]��H��a��u�����t���@��_n<����$+ځ ��GO���v��9���_��c��Y�}7�@}�/b��K�v� Z�ÇJ;�{����Q^��ٶ�FY���i�8�ܾ��Yi ��J��B����F:n_2O�J���>0v3ධ�Q8]0?���})����{�G>X�y���1�d��j)����D�\k���_21v��:�����ʓƘZ2�v���Xd~f��D ��DG� ��ft1ʪ}�Wt2 �s �ezG$XP�����-%@حe��Ҙy����?[΄q�5RdمsWb5���/�Ni�twcN�c5��=��#��!_ۦ�>���zs��#S� �-��-S���ۚb�9]�Ւd��6)鈻��T"wI�4�.�\�H�Θ��� ��y����B'��`��x��xQ�����-��N3�� ���j��)�8��a ����|�ufΟ��w��a�2�^���O��0ӢPrh�݃���U��)����>_�o�����KVc�~7d�$h|C�1&��BJ���u��h�� KR�1X��d�5S�c�����=e��k�"�������{n�\{�ˇ�f�iHd�#%��٢v��c %T|�K3�F�3[2��a�o�~Rz� �r]&�X���zK �P&$:Z׀F�F�v��{�)��.&��!"b�I<<@���3�9��������+�J��.��Bgz�fCj:�aP�:)Yl4u�B�9^*6 �d������1��ȯ�$I���Z�s�ͬ:�v"po�n��{�X~��Ӊi��J�#3�M3���r�_��a��K� �2����WG+w�ӷEhq5ݑd�Y�Z__O�7�`W�hv�=O�n,x��_ZSp������x��mvV�<2��$I��2՛���ɍn���<z��h��p�㒑��ư��X��?�r�.W�%\t�Nq����m�"��/�R�K�o$3��D�!E!#9��8$M������ut����_�1k��W��8�� &�?�p�)�ܩ�|�?0%�����Լ�gû����zG���T�%����ȅ�>�!���1v����آ����H��o�c w"��q��6��f��iD�C:W��z���{��B�;��n7�"�%�c���>��J�?]5��¦�sV��Of�r�~ŧ6�g���H���\�U]�����B�H caJ��D�:�o6e�ȭ�u�$v}����{v�=�ɟ7mC+�g��&�3�t�8�(�/�c���".=,�L-�Q 6�������Y���8�����~/`|�+��psO�'��I��2b�1��%H ��e|����x�G�[�S��<���J��� ���$�����6.B0?���Wj {� \:;����{%_9:��a�;�k�ԝ��R�A;�_ױ� ����JNi� �6��A��%��&b�(\b��}�e�i� �a��^rᘆХ��6�p�}���VOq8�>F����x;~\�k�� ��aˊ���!8;s�����*�2+�^�������[??x��ަ�LL�ʤX�X�����*=����4a�,@�@\��:�P�pu+;������]��c��{�k��r� HZa�4X}�OK ���{���!�m^O=M��8O�t������2뷭���w� ����f�2x��Řz �c�q��/ZK�6{��o��,0�f�k��Б.��� �/�ޤi`ۂ�� 8'�1m�/(cU ��}���5X��锢�X�������k2̫�`wLё{썳9R�/�9lam�\N�cHK ����R1��`X7�|ޠ�&�'n ��ST�z=�G��v�qM`䳹�V��Z&P0%�!:�{�DY�Q��䯲 y}��wA�Io~�������D2Bۄv8X�,pZ���� �-�V�p��y�f4��$R�G�.���uL����zM��5Af_.|�tQ�Ky�`kg��U�ŐMp��IJ6ι�7�|�n��[Ƴ�xx���� C��AN ��=WD}�w��o�p�����y���Tyw]U�\PL�0���c�݈H��WP�N
Behavioral task
behavioral1
Sample
36a3b7ac2ba0d39019a0fd15fa81734c.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
36a3b7ac2ba0d39019a0fd15fa81734c.exe
Resource
win10v2004-20231201-en
General
-
Target
36a3b7ac2ba0d39019a0fd15fa81734c
-
Size
10.7MB
-
MD5
36a3b7ac2ba0d39019a0fd15fa81734c
-
SHA1
dd6a7257366d3115e776af3e273c71c7e3109bc7
-
SHA256
ffb7875041de4bb9b5f9514599fbd0fbf8051af703555444724a36b9ea2ca876
-
SHA512
26b5df27abe2abb20cef51f1ca47be23f78a868bf8cb440632436713ee651426156bb4bc7f75ba719cd1bd4eefe9bb56cc2ae310f3acda81a147e1071647d894
-
SSDEEP
196608:ygojZKlSRpmzR1tDJGggdOveNsSaJRawxKtC7tj+wNFqETHBuwBXv2N:4Z1mzR7JGgde90Rawx/QwBuwhv
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36a3b7ac2ba0d39019a0fd15fa81734c
Files
-
36a3b7ac2ba0d39019a0fd15fa81734c.exe windows:6 windows x86 arch:x86
5c2de98b3a494913b8ad18a096133923
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140u
ord5411
kernel32
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetObjectW
advapi32
CloseServiceHandle
shell32
Shell_NotifyIconW
shlwapi
PathAddBackslashA
msvcp140
?_Xlength_error@std@@YAXPBD@Z
winhttp
WinHttpSetOption
vcruntime140
__std_type_info_name
api-ms-win-crt-runtime-l1-1-0
_get_wide_winmain_command_line
api-ms-win-crt-string-l1-1-0
wcscat_s
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
_itoa_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 10.5MB - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ