��d;dƃG�j/H~��$��6xK�p� 8����yl]O{DŨ�o�����d�@��O���tw�B,Fh�У��Y��^����Y;��jN�%P�{��ah���]6W�oC^����f�;0�wv�*�u��f��F���ɛ�J��lS��8%�ث�b�g0a4Zިа�6<&��lcg�H9D1y �)�2�}J}�VY�L)�`P�g�T���&��e���<����wìh~C��Kn<zݸ�*e�#�iY�:\*bۯ�ct���u��+m�0�3�L��1�r�"Mg��I�h�^)����ة+��Sv�!Y�� ��x�Aہ\��m�N4���0h���N�Q.[�IѲռ�����Z���-�����,�����5qo����v"����H��ݰB�f��.#ĭ����=i���5���,�N#�w8�sE�ĭXT��N Ūf%�����x�����Ťk���a�sf�U_5���X�d_�������8_*�^�T,m��?2'�m>��f�����~��Ύ�%u P/��f� ���Q'pU�t�����r���u+z�_�e�X���6r/��QY�L���Q�u�����D�D�I�#����%�Y#����]�5ȣ{~�E����mK��y��ϣ�x��'�e �f^b|K44 �Dy�ԥ 8ʼn�'.�x�E�Q"W�b��d!o #��Ʉ����b�H�t�F@3z*�M�yU�-�:Qֻ��5+������i���[�"�-ғ�2�1��� �ŦoKy��Zj�g��|�u�tTPKw&�#��i�XjV�yg����ۺ�;C,��0�_�/@�'4��=���~(�c~�T��_�;K�/��?к��xCX�������V����!���H�mfj�3T�UJ诰<�e#p��R�LQ�� �|��I\1v�UH~���K#���g=t@�/����ھp��ϵe)0 "��IPʿ��ԑ� #K�}��n���|n]T(��3�fBcK[" ����r-��G mTQnƦ���kl�3�����x~��Q��3t��p3��8Ɩ��0��,�(�GR�O:��v�VFs�5�~13�wWvh��t©������$� �!�٠q��3>�Z���U�� ڿ��)�)]>f��O�!+m�^Gkm/��:O�O�O���C/�Ѭ"�AX�>��e��\#�C-��u-��0�y�s=�Y�ϩ��vAz� f�������f<�uҰ������J�q�������J�Z��؛!Ԫ¡�/H�}�������:9����k�I�"g�u,�P�}��C��k�*�k���]-����-ެl$<:c\7(�/p'��&��k݊('��ˉ���/���P�xB�M�P��W�5�b��c6"_�����V� +M���%N���"�i2TY�����4����U�d�ӓ^;Qg+ +NB�?@��n�]�LZ�z�m����@�V"i�N�������Z�����Qdu2���c`���@�����*�M�J��ܚrB]g~&^�)F� ���+��,� ���<����r�x���ꭁX��;��?{b�`����}��c������E?]���iY��%KVHUygS&m�|鵚D�,v�}�ЎJ��?� ���d�'������ӧ?���֫*�F��J'�55�7��<�<=O��|�<����@�I�v��� q���Ds�� �J�x�BC>�'�$�OR؏�C~�}ƌ%m+�צ&oH1- O���~z��H*6��9�K�k�с0�%zZ�4����}��� \P�k����#r�H��� ��r��&������/<�J��36��/��ׯ��m#�k~�X��x���kG�eN�x}�/"�@5#"�) ��7��M�hXO�1>2��6"�i�I�4���ʔcIй;���9#���&�#f���%���k�=V��F��&K��5k�j����MbMr�}��%�7�r+�ͤi��+�LZ����t�^���L���d�n���M�m�a � XD���]��$y�Ҍ�>��L�b����§�#��Ss�5�K��~Dty!������v�gk��v�mE����nZsb�x���U�49����3��OѫC�1��+�ҡU�,JҌ�^�v\�#URmA��|>G��D��@8��?Ң*�(^| u[8���h{�b���֣|v�Δi���� ^�r�Z&����a7��8�W�����t{���_:��j��#R�\����|��8����,�"X<�s����(�5�"�C����"�|_�+fv>�NBH�\$��Bt�x=��A���?��&��}�QҲe� B��5��(��Θ��N�;�n�Lxh}�)Z�A�����!�Ƥ�Ta� �en�ٓU��W�<Ub^������rx�h���G�(TA#[D�����n"��h��P�v�Y��E�6TX�D �: >�$�a��|=��l���j�ܺ#�x��?}tD68XI�할���c�`�ӹ�Tm��&���x�����>"�}����m�CW�U���� [&$F f0u �_���(����]���HU��Z��Hй��{7r���|��>I�p,n2�x/��=���c̮g��o�iD`�ź,g�& �<-�]_P�+���t�u�su�`�E'��Պ�f5A~:��n�k�ڕ�V;5^/־����DTZ�@����Њ.���� ��|�}N�x���%��m�DL Z�;fb-�u�r�Z�s�^��^t�Gy�Vps?�?C��#���4g�k� �`l��V�ZcZϼJf��w�F*�l���{S�S f3���H����ae���C�p ��y;�dr���xX��w�b���uM�s����т^F�5&���g��4"\}�������ܾ#Мa�'�oR�W�V#��K/��^uK�l�j�>J[�����||"O{f�\���˔to���&�rE�N�(-/B-wC?S�0>)tM.�W������<EW>�!7�F�x��- ˱ˠ�) ��A��]o�@���z���)� +L4���<#�]LYƙ���n��j��Mݥ� 'a���\�
Static task
static1
Behavioral task
behavioral1
Sample
915c92ad28da3ac39fa4a01af7678bb38c95893c8c95bf952f9da1c8e7e0bbf2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
915c92ad28da3ac39fa4a01af7678bb38c95893c8c95bf952f9da1c8e7e0bbf2.exe
Resource
win10v2004-20231215-en
General
-
Target
915c92ad28da3ac39fa4a01af7678bb38c95893c8c95bf952f9da1c8e7e0bbf2
-
Size
5.6MB
-
MD5
0c04b0dc682f15ca4381b8a3fb769a09
-
SHA1
6021653d7ea85209251beb5f7774fd1fc0d1e148
-
SHA256
915c92ad28da3ac39fa4a01af7678bb38c95893c8c95bf952f9da1c8e7e0bbf2
-
SHA512
718417fcf678ce9571cdccf293e2c1a3beca8220aac366d75d9c507d8a81b3bf7424bfb82237fc3186e6b47e2dcc898b16a8a65ab386ebd9e0d4974c3c4bf023
-
SSDEEP
98304:/UqqSbRfK+pgRp1olWrCNT7xSZMWKvFRZ40z/zQs2JyMLWJ2greygRzL6:/bnb5Ns42CN/xkfKRyW7QLW98p6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 915c92ad28da3ac39fa4a01af7678bb38c95893c8c95bf952f9da1c8e7e0bbf2
Files
-
915c92ad28da3ac39fa4a01af7678bb38c95893c8c95bf952f9da1c8e7e0bbf2.exe windows:5 windows x64 arch:x64
76f527df5d6b94eef04c1125edf5a4e4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3600 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.3601 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ