��<��i�i����eUg:��^���JG�Kj�@a�;BMn����|T���'����(sb�ZX�7�H��2D6c��!��xW�p*o0�����9Q��s��>��f\��8I�$z�DG��/u2�d2��3���%�f�% ����*���$�U� �Q���E2�'z��"�Ӏ�%��2������xܖ��*Az�+v���hp4�|K��6ݙ�\��<Zf�8ej0+��7q��#���+��۽���v���S���a�0k��\q�c�Mt@�z+�#2P�=��7� �##�܊�)h�� �W�hwxx��%'FAd���wq@�~�K��[��y'Ŏ���H_T��D�s��N#D��YA"Q�?�٣�)�5M��b�S��x�����{����@'�G����;�s�`��UXF�Qat�E��u�No��Lv� y����F���K���88���E��˲)���6b�f�Ӭ��z�7��R��Ф�'$8��� g�y%b���X�q%�o��j�{o?��.���b̺����&��A�IM{䨕�7���c�s:0E�sh� �}��#���zN�����l��[t���1�k �e��YUGÜ�Y�U!�o^�!Mw�(�n��<�#�������y|�=�����K�lͫ�61�M�m-�W��l���Y?K�M_���W�r�6^^$(p�<�a��h <1�_��NV�TM��(��+���/����N�^���[��� l��BHYI�D�\2[Eo*5r��C3�*�p&��{����T2�Et �"H@�>�n����4�����_$�!�VKt)W��.�jͼ=D�@�T4n��3�G2 ��8�`�lh��Sp=3��b]Ȃ��~�#~#vOI���'����J��p�������0[��a��O�;ECC,�s�RA$^#��70A�ûp�Q�yʅ-?�?��V%xh[k���}L��(�X GR�ӶO�!3���%�"��X��AL������X0���'�>�*����� ���5��F|�mT��Vp���o���� 4W:�~��/�!�߰��)ZI�4�(u@^,̣���ra���/�����Ѹ�b�ǘY�2� ��+��;t���s�v��9t^�Ci�j:��.���KY_TOSK����[���$�K�^(�-�cO��oM�7����A {%?@�+eń����8d���HƎaR�w���c+}ˏw/q�~_� �~���,q@�HY<$P�'��-2�$���3[��U���$�����J�(�a���|��$mU���i�*��n��H$\j����<��t������A��/2 P���o��Q�Qq���J�'�y�3�BQ˙0�'���'w��|�M@H�F�x�Y���,��Z��/���3ꐵS��z[Z��>�܁��:��m~S4���פ�AC��JOAJ*�����?V y}��n���se3!Q�ғv�AT��[}�D�`�8Z���S~������`�9��A�Lj`f܂֪�{��v����`������:���c�g�-�P,�M�YT�E?���U6.��3����`�T��&�� �De�#��#�h���4Zq}Z�P��D�p�����Q%�fH��)q$ߪTڠ�aF;lm��zB%Q�\=M�:�A�iK�u=���r���LG/�����q��=P�_�9�:�cQVmC�[�6t]�{f:p+J�b��+�."r;:lӹ<����21l1N-�]���C��?-1�I��.�]n%n�ZIt����ELJy �>���^�����#>&���{��Ղ�Ґ���Q�)İu���6� ��8�-�yk��em�4��A��W�1�F�m{�(@��u@�ԉVR��E�}25�����7�܄n�0Cڕ�*#mX`1���ZW�-7���k`�x�r�� �휱XE�S=2��4k��k��B�ad������L��������YQ}|�ds�({��;�"��u���֜oo�Y�s��`���k�MHj����?O�Z1*@��M� ��k=�閒U캩W%�ag�͵��P��� ʍ���mf�J~Ԕ����/u����5z�[���6#!<����5I�B$8���N|_��,�8D~t_��W`~%x�X���;c3�{��9� C�aJ����ȗ��qt�i�e\n�.qS{��ʴ8��W��We��a�d������%����2?A��6�����j���A���U��~�vp��g6�����F��u)�v:op��z6y%��]��S�9�\�I+Y{'~����W�@�Ӓ31��9i.k����HPOh�xf���5��V���J�)q�vb�{��^��n\��s�d&�Ԕ/��D�۬�O���W���+N������>������n��q��#�Zg�J����t������"< ��������m]*�WON��i�� uV��٫?���/` ;P����aP*�ь-C�Nɂ��0�Q�ѱ��1e�c�� �_m{��>��h��l�z�)��P0�8 B����Fg%^�T����"����A�����s+L�����Ԩ���S�;��hN�z�<8��)$�IN�>[G*h���N˳( բ�'&��Ar�]Jjz]�dͦp��i���u�EѤ�J3 �+D�����eiR�G���Xi�.u��sS-οn ݫ��7?�l�5�,���X�A���u�W��O #|:�� !]�bB����#4\Y����2@V%��Y:iQ��ot��-���Z���gw��sؔ�P&����!9@��x�GH�n��-�K���ߝ��ɶ[��1���� 7�6��A#�`�����X�P��v�:��d��������z���9B���H����љ�=cJOĠ��T�/2K ':��Ġ4.��_�&`��k���a��a�������Pc�V�C,�@Y��6�,� X^��A��t�qx¶H[��b⥶;��|����\p��n�k�`�L~���= ��x����я� 9���lr����y�n;u��ce��}0����wj�F�F�v����j
Static task
static1
Behavioral task
behavioral1
Sample
b6a420d2716ad687e3cd9417a57a3999.exe
Resource
win7-20231215-en
General
-
Target
b6a420d2716ad687e3cd9417a57a3999.bin
-
Size
5.6MB
-
MD5
b6a420d2716ad687e3cd9417a57a3999
-
SHA1
47b199bf67d051864362394a658ca119719d2d02
-
SHA256
eef3cd2fa8e3e63c1134dd130f2eccf14cbaad2e9125726cad262f4b0f863e4e
-
SHA512
89a93e8e5f783c4473b9f9c304ff58cee723e10e58a280f53e7ccc0dcf257053a106978d2f8fb37009455cd714844474f803a4081f2117aca55da29556bd723e
-
SSDEEP
98304:GOduw8wk4zFkA48Ss2XZp7v8loy2baSwNntJ6N2c04vryAl3C5jl:5dutwtFk2/2XZp7Tl+1tJ6N2cNvrf3Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6a420d2716ad687e3cd9417a57a3999.bin
Files
-
b6a420d2716ad687e3cd9417a57a3999.bin.exe windows:6 windows x64 arch:x64
3550dabf0949c75ee05d6c9875d4afc7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCreateKeyA
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
normaliz
IdnToAscii
wldap32
ord27
crypt32
CertGetCertificateChain
ws2_32
getaddrinfo
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-time-l1-1-0
_time64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
y;WkSy!& Size: - Virtual size: 551KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
os]?;veO Size: - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
V(^JCA4k Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
B4m&sx2? Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
u"dGkO`B Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1,0r$LUG Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
X'NZ)(aL Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
B/ePO7mP Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ