.�wn�'N1[%�����p�ı"X��^�F��V�|�Tj$Z��{ >����ǟ�]C��S#N�Q^�Pf�� �����f�L����g��`����c�գ����{{�[�)�=u�����1������S��#��"$._B��q#�rQ�H����9��D+%�)� �g�ܣ%�q��/���3С��}���|I@!ҋ���J���m��+�`+�����fuyȯ���D@��&Kx�̙z3���ҳꊍ�L��3�����'����Vј�el���V��z`� ���dcky�W���cИ�hH����QG&�-" ț�M�����裮��ׂ�/�nr��!"a"ȧ%��/�R�3my��ا9ҋ\�P�4�`������8$��96�'����#-��"?d<ݹ�g�M]E�.a`s�4Rs�t~9�u����}�KX�5�z���9l`�+��v��Mc�Qo���?������}�V}f�>�+�N�!h�:������PF�#�.�E�����ג��f���F(f�+G����I��&���w�z;�Q�h9�R;#'�����X��~h�k��ak�͎3-�Djv�� 5��Y�#�by�>��:\��wt��Ԫ HFt�oG�V�tϮ�����B��s�k���i�L��Bj�!^�l��<C� ��s\9����.[ =�8�@v����Gj�z�"_��UV�1������:kMWG0��g}Vej���Ct�� ������f��K����=�1NQ����*U��� YK�Dˆ�yۗ�|2�i�IԲ��7k58��$��Z�̊�:�|%�)Q�:aL�H��mG��l^L�kT��,,�>H*�(�S�c�����4�j%U"c^�"6jam�ץ}0/��s3_?�لxݿ�t6�g�1���?��uEҘ��L����G~r(��7�t���v\+�pv�<[��$��*��MЗԖ6qK����vC[����f�S{�2Y�Va�-�%ǫh|����-�:��i�c���v�Q~E�iJU�a U�u����A���{]pߺ����-l��: �G�Y%g��"�;����N�Q�"��0Ε25�<�*�~�naQ{��s����̄n<�FÖ��+��ij .�w�O,^(D{L�Y'9o�,�&��<�]8�t&�u&F#:\l5��j5Jߜ�t(J)�V���>̪�^琢�)�2��MnY��Q �vR�Gpj�u��*���'�Y4�jS�+�V9�j �O�y�^lgh�n(쨓s�Ä�pMJ[�l}g>�O9��f�(��k/Y �ڒx��!�3�K&2��ӊ�����JH�m���h`���~����#�8�ħ�J��X �ؖ$>(��W��Q��,b� !�2����f�5���_�*�4����Q�f�W�T;4��)��ㄭ��9)�(b�2�` }���h��H1������:�QϨ����)�|{���e�-��� �2��# u��w��b�����O���? @x&�5}Sz'�` �����>h�a���*Au[!�խ�:xc��Q>2�bD�����/�ʸ8\A� ����r2�˝�)��9'�n�����u�7�<8xΟ?kC���-W�t���Iw��U/�p��fG���P1�rI���|�<�Y��&i��Ox��M���t�<"�q��0W�0�2�k���@�z���j[�5Fm���A�X�T:�V���ԣ�"�0^���b-7�ȷ�*0�b|C���9�{�yB���Y��+8͆#��@j������:�����1��iQUթ�ܠ��7�l�}6Z�����c�.�tOl���9�dC�c�\y�]�7��J�$����6]��:�֠=.�ޣߦKs�z�//k�bA�।Hb�w������3�Q]~`d�y.���o�僻���fF9I6S\?|�5+�S �^�� tw�IKI1�O�c��*�5�d�PENgS�\WW�����.��x*qQ��n��hel��"�~6@�����1��o^êu6ԥ�jo���>�� N�%��usG��;t?=0B��'�0W���hE"�z�5<�L,r�E��Es�;�M�x�j˭���}Q��0H����"NV��m׳���o!�)%����}�ac���NҢ�4kd�q�LC��ޒ��ȫ��Z�J4C.�*��~=.���O����@�{C�J�[�٠цH� �s�#da� ��o��O��1�7���I�S���_[��]�7T�,�b �����v�-&ky���x�a;�K���1a)f��H��e�f�n"ٵ�⡠5=��S����-3��ҙ?���ô��J7���]8��!��zjS4;��>G�����sx�%~�2sp��vZ@���=�g��O�뮚��Gv���c�r��z���CS��g�H9E����f�H��w��5�@'��7F|j�������<enjm�p�I���� �{�O�'Ɏ���������yl��]6'��i�n��X_������u�P��Z�e7���8��|-7$g� J<�~t���;r��*sh?��G[`�� &��=�8��E,�� �=�HX�c�:�e�������Hiq��W��U@/ ���N������uO�bm�����w/U�μLԔ�l%#B�{]�#�u�w��'��� H�v)�)�џԠ��IvB��F'�5׆e��]�4CΓ���|���Fë]ě*\+W���FnL�C&OJ�8�PE`"�Y��]��P� h�J(TC��-�W���T_S��I~�p�MD�$%�dc~I$��d��*�܇u�d�g��u�Ji=t�����Y�W{6U���o[�:��Ǔ���X�W�d����<�ܶ�U>�#����� �'<����Z���ˇ�k�����C�@�U͜�E�mZ �٫�ۢyb\ O�22����a_č��&���P�i�Gu�W��w?t���R�W������8g�!ob,���зS�ŧy�a�u5��9*aR�`��ئha���g(U�M��ز@�_�0h*�}zH���Ջ%���I�|���'0�ޔ����;0S�ڎ��v��v0�
Static task
static1
Behavioral task
behavioral1
Sample
a8941770276d48baa660e603b4b3a907.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a8941770276d48baa660e603b4b3a907.exe
Resource
win10v2004-20231222-en
General
-
Target
a8941770276d48baa660e603b4b3a907
-
Size
5.0MB
-
MD5
a8941770276d48baa660e603b4b3a907
-
SHA1
f6cf0db1421145dd7c75af33bcef92753f77f86d
-
SHA256
4cf4ba2e083f3e88ae0d4e949142292f54e2ffe25c8fa0f55f63cdc7f677e263
-
SHA512
85ccf3e4262189fff0585277d06505a95d863087d62b339793595541e856f6e5e399e1690f21a8c636ea928e693c39cf7eb6acb7220d31ed6d93b906bd6339d8
-
SSDEEP
98304:s6Y46BLtEHeYb+zBLtZraBHLKvNh1yg0Oke2K+:vYbBJE+YutdGqNhMg0A
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8941770276d48baa660e603b4b3a907
Files
-
a8941770276d48baa660e603b4b3a907.exe windows:6 windows x64 arch:x64
e1ef2e487ad29e377fed544d7ec4073b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
inet_pton
__WSAFDIsSet
select
WSASetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
shutdown
ntohs
getnameinfo
gethostname
sendto
recvfrom
ntohl
freeaddrinfo
getaddrinfo
ioctlsocket
listen
htonl
socket
send
recv
closesocket
accept
WSACleanup
WSAStartup
WSAIoctl
setsockopt
WSAGetLastError
wldap32
ord41
ord50
ord211
ord46
ord143
ord45
ord60
ord22
ord26
ord27
ord32
ord33
ord301
ord200
ord30
ord79
ord35
crypt32
CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
advapi32
CryptAcquireContextA
GetLengthSid
OpenProcessToken
IsValidSid
CopySid
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
GetUserNameA
ConvertSidToStringSidA
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
dwmapi
DwmExtendFrameIntoClientArea
kernel32
VirtualAlloc
GetSystemInfo
LoadLibraryExW
RtlPcToFileHeader
VirtualProtect
VirtualQuery
ExitProcess
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
FreeLibraryAndExitThread
SetFilePointerEx
SetConsoleCtrlHandler
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
GetConsoleOutputCP
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetTimeZoneInformation
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
InterlockedPushEntrySList
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
HeapFree
SetConsoleTitleA
GetCurrentProcess
InitializeCriticalSectionEx
HeapSize
MultiByteToWideChar
Sleep
GetLastError
LoadLibraryA
HeapReAlloc
CloseHandle
RaiseException
SetEnvironmentVariableW
CreateThread
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
LocalFree
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
GetTempPathA
SetLastError
FormatMessageA
GetTickCount
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
VerifyVersionInfoA
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
FormatMessageW
WriteFile
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlVirtualUnwind
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryW
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
RtlUnwind
GetSystemTime
SystemTimeToFileTime
RtlUnwindEx
OutputDebugStringW
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
SetEndOfFile
WriteConsoleW
FreeConsole
FindNextFileW
RtlCaptureContext
InitializeSListHead
CreateEventW
ResetEvent
SetEvent
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
CreateFileA
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
LocalFree
ReadFile
WriteConsoleW
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
CloseClipboard
SetCapture
ClientToScreen
GetCapture
EmptyClipboard
GetClipboardData
SetClipboardData
GetActiveWindow
ScreenToClient
OpenClipboard
SetCursor
LoadCursorA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetWindowThreadProcessId
GetWindow
DispatchMessageA
GetWindowRect
DestroyWindow
SetWindowPos
ShowWindow
GetAsyncKeyState
SetWindowLongA
GetWindowLongA
MessageBoxA
GetForegroundWindow
MoveWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
mouse_event
PeekMessageA
UnregisterClassA
PostQuitMessage
FindWindowA
RegisterClassExA
UpdateWindow
SetForegroundWindow
GetKeyState
CharUpperBuffW
MessageBoxW
shell32
ShellExecuteA
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
d3d9
Direct3DCreate9Ex
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 824KB - Virtual size: 824KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xrt0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xrt1 Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ