��ha�bͬ"����:�"4^[_R�#��k�]��ղ�DG?�V�!K9I��ǩZ�LV`:�=����Q���x�<���0����s%|dH~d_����-�ك~�{z��l]��#aH�lƂ�"B�� ��B=��/v����^K�X6FF�*AH�ii�e2 �K�Z������H�gO�B�08�x�f���W&���z_�%�1z).� � �ر�j�4�#�z��FC+�pJ��7�x](�!�T�T�\�Ik� t���JĦT��)P1���M�!^��v�"S81��[�����c��@�z�������<9tOߨ�"{���d"� #�QKT�uH@����G3ȗ�S��#|�:���L���������,b������1��M�o�`*e:�a��7�1m��-ꌌ�)�e��%��A��8 ���f�bkجf�]]���EILƍ�Q{�?��A�}�b�B��,�J�-� �!�Ot>I� � Td�qȝ�YcF�8��б@x��b��E���n���1$�R&��X�[�@���]�khǪ=ݍ)u���;m�)�F@���<�ֱtB��On͇V�r���#/�l<��<��˒x�/��� ��z;�;Y~�v�a���[ڵ�����7U��6�z � |�?K��S���|�QF��P ��gra�����4�A��!��ͮ*k���t�7m5��探6w��y䨨�|��Ű��t�_������]�7T��J�d��>�ߣ��E� ͵�D��g�D��ޡ#r5��U�N��|�R3l\_���>����;�k�ػ�O ��Vs��dA�:��:@���lٲ'h�!@i�o��\���tw+2o�CSv�d#�A!]��Oc.���eF�����K�ttB(�{�f4�Cǘ�A�����M��' wsZa�6�:�D��Um�^X�ґ-�rH-��?�|h����k��!k^�H�o��u��z�)��� ~��QO�-��lz���3G��q#�A�y1~��A�V�܍�����Vn*S��jRpb��m��_5/1���9���E���D ��6&>����C��D���z`������/~�ܤ�i4���|�0��}����m!��> ��DNq���!=/;�A@`9������"[���8N�!�!;��1C������p�\��YDF%$Dg�K��*���~�CA�0X�� U�zzD����:��Ѳ�i��u���@�����j���� 𮘒LvP���X� �����T�c�����q)�Xb[s�˵�$!\�w8E���la �3�\���/�<��p�E3$�h���I~��da]����ҏs��kU�/�0/c>��� X��lpVx��8�x`A�o�y���;7\1�h𔑹7���t�O)-x��@��粜-<����9��F�xiv_ �#�r�t����;��� �s�T�5:�I����o�g.�&5YJ�8i����{��t>L���CN�8Wc�"���ɔ�?u��f��r�^h������m����i�]�`���|��Υ���C�������ƣt.L��ŭ%���v��\|�A<܉`�:'$���m��N�����,If�Ea�8o�Pv]��V6���Yʡ��W�*o�`z���p���8� ô�������i���cֶ�g���GW��~�#KI��ܕ����4��<�P����*�K���N�(}�������h����sdڍ��ج�t>�m�B������$�Q���#E���c!��|��{I�Z��Z�ۙ@�NVO� �C]&?5wQ�u�| �G����"t����˭z\;��l�ʦ��F����I��\\��/�"]jc��(�W6��p<Ք�IXx2n��҆��x9J0A�_g�����9Iy~�~�TL�9���Ұ����Ƌ�Y�-g�<5�T۲�2vW\x����u�?�r��Wl7(�ˎ*��5;�&���ݷ,��Y�J��Z�A?9� �U���]��<tVt(�O����S�=�Τm�f��e���aS���ܦ� �;\,ٔw:����>�P�֩c��&�G���o�E9�ނ��l k f���.�0�P����/�)L_�Y&h�����\�5� .�O�AVTC��(���(j_���t�9�\Mu��k�3�$ڒ���P�~�� l����<^r�2�J5Jm������c��nV�e}:=���m����\ɥ��AV!�~4�ũ 93~�9@gzr�Ȇ���/$��������)��S�M�=�����N�j^&�A`�wK(E�d#y�����82������t� ?��T5��=��x0.��+VȆ��5�:�f�Ok+���� ] ����Mw�nt� �ʂ��П�ou��k�D?8!�`�c�Y�ʤ�r_�H�L �!t�8/V��j��#�a����M#�ԤI�h�d��Kǐ�P#<tQA�-���L�H��i�[�Sʰh^Zj�5��QJk!�V��t�.����L!�����{�v��=�!A`�W��mҰj%��z��!5�2)~����y�<|h�V$C�������P�T(?묬i�P`�2�������G����o��jW�<�b1$2 ��rJw� 2���-A~�-���/EʥȖN0Z�^ie�=�Sx�� ].�ٸ�`~�����`F��إ�b8n!hq�Ȳ�B���k�C%��$,��_��1��@�>bT���V`��v'ׁ�ھ!�����1�|]@K~�����غ�+Ȟ�m���Kf�>#��{�p�(�}����2��&|�2��-�Frv eUm�U�=j��<�6��G���u���<�7�&܂"�}Ū�K�������6:�]X"�5�ĤO���t�;��tvV�&�Ɠ#��*����� j���M;ܧ��!��b����g�=F�(��e��l,)p�O�c�; �����n�����Β�{���{�R���_m��)7�]:� n������P��\?j�~��*�lO&UN1� e�s9}e N(�>�=���Ul}�^�"�:J蟊zw���} Ły�';��
Static task
static1
Behavioral task
behavioral1
Sample
f35fe6433105adc61c4aaeb121b96625.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f35fe6433105adc61c4aaeb121b96625.exe
Resource
win10v2004-20231215-en
General
-
Target
f35fe6433105adc61c4aaeb121b96625
-
Size
5.6MB
-
MD5
f35fe6433105adc61c4aaeb121b96625
-
SHA1
85ec5afd4c1fbaea6430cb2a6c772d70b74945e9
-
SHA256
6b1956bf3b30cd2a93e531a618c5163c84e0ee32210f87c43814aeeecdcc08c8
-
SHA512
8643b03bb141af5e7a31a66a6e71c44d8b74d72e3d29c9074c53859d28ed51f4ca40b60d1db31f84ca4d3f52b92e0b03ff1a5bbe84cafad5d35ff78793ccaada
-
SSDEEP
98304:2PteggvDZMqqhHDJ+6AgxfW5GfiptzF+EVuJAsPTA1PMwcF01AVsYDQ:wHgvDZ/+DUsx+5GfaF+uulreAVs0Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f35fe6433105adc61c4aaeb121b96625
Files
-
f35fe6433105adc61c4aaeb121b96625.exe windows:6 windows x64 arch:x64
90a6639a308e6d9861b53ae8bd2ef636
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
K32GetProcessImageFileNameW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MoveWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameW
oleaut32
VariantClear
shlwapi
PathFileExistsW
ws2_32
htons
urlmon
URLDownloadToFileW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 596KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dead0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dead1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ