��EFIi�}��'9R��2)k�J7ʀL�0�#�� gCA�-ɧ@6�����ў�L�ۏ_=�n�լe�y���R�9��k������5^Xm�2�ZhZ%�lȊ�舷�ߍ��ĵQ~��q��eo���m�r7��6䠮M�?���Ԉ|��[u��o��X�8�X&��AN`���S���JʼnsP{N�n�#0��U�ӴAހ�Q�C�xAQ�e��O'�F�g�� �f���L3��.����-�t�����_����$�{N��hCp9h�#{]VX���ޖ]��P(���X*)͂ ��E�&��!Ңф�A\�I0ZC�2�7�L�.l�L��kAW�p��R� �ny!�Z� � ��684G�C��M��\�͂��N�����y�~��{�Yqq�CN�3���&Os�x����g�6�6(�tU�Ej���vU�A�K��;m�܋�Z�/_g�\j��v�{Uk���ڸ��U����(p*�K�KG��c�:��%�KA���S��!�"=^H���2���_aȢ�?���:[s48��V�[��B�ݼ�%�|<G�{��Nn:s�?w=U ����O�%8;�R05c��I����!,wd2�{ǒ��I�m����@0Cq ��<��0f�鰗`��o��vOw�D���S�q���.���X���L� ғ�����k����]� ��!���a��x�]MtC1×X�E٣�a�ģeL�m:95��:bn"����B�n*�އ��[�����r��\F �Ekq�z�М����C�����"��UP!k��7O1v� �}�FS��`����r�[Z@�`�vh��)�7�����8�'�_<aw�wM c��l���&���'LUH��^b\�U7A�|2wW��0��T1����(o���_��P|��(ڑ�y��\w�ky����ח��1 ;���#%�E*�/��a�Y��.V��|7i�X( �a�!�.c���_�}�m ����3�SH|�NxM���;{Ź�u�e:�ta"O"�G�̲�.�#�y4��|F�.�����;�Y%G����H�.�T�,}-*q�{�KhȌ)��e���N�/ ٜ������VF����{���ūE6���O�H��k�L,[���%s)l[���/B8�=L����9����ۼb.���MT����Q먡���9X�0���=���%l9� ����bz�����y����Vy� ��FGc�ͷ}��?1��;�Tn5?�;�·���F��f�8��ΣR[ߝF��e K��)�Л�_��*���*2S��l��˘ry�#��)_�#�vGӣf�*��N�)�з���K�ի�-�i���N$������!�3�T���g����U`D���N���y=�X(���O_�}�S^GQ�\���ҡ�I�~�x_�J���4�w���/|o�&��*ub?E�\M����{���r9���|zx7<�a����Q��"a1s6� Ӛ�F��[+_��y�ja����a�)�Z����M�7%>[���[��?��%���4��E+���70�^���R��kO.��z ���ϰ6����&2_� ]��2W�<KŚJ����*R��������������� gXY�@���S:h��Ą/��Ʀ&^��*��Xa��C���g��$z!�4u�.��,-������>�����6�^E6���(:����ÃLHGI@�{�|��%����?1���Hb8{�Vv�y*����2�$Z�����6�c7/��`?ƣS�zr��:Y&������ԟ�-��Ww��n �.�Qd��Bn���̿j��y�<�V��BT-WRe�_���r�$����d�b��ݜd/8�����%?���;&�8A�({U�;��_���l��Q�M��S���\�-�<����"��U\,@��j��n��\/��iCnUm���f@M;�w���u� Ý�_���Sg��R��L��o���Q$�Cd6�Q�9�%T�5����g��P���}&ϣ�.���u !h ������4勉�*��l�&[%�%/w�+�*�F^Vn ޜYS�#� �ʈ��}$�����G�GXCF���Yy1U`.˙�-�Dᶟ�7�S�}η�j��_�+a�P��/���݉A 8�e��`Q�����(,�o���l�V�:yw`s7 1>��>�=�!�� �ԭ?�z�yD�V�=��&�6�^�gt�y̔���;���gXq2��F��J#J���D��(��R�!P��K��||n����>��-?F�8� ��L�qF0�J��]�A[���� ��zT�>K��f �F�zh<j <�.Q�f���m@�+��x�Y�Y���o�rI�mL_��_��q�����^W��|kqƊv����#�� �T�o�|d!!.oB�xy¬e1ę8D��ɻ�5��X��$����oH�;�KD�4��r� 7%uƼ�ڜ�țǬz���lZ���7�DV ��6�� o! !�B��)����3�T��������0b*Mxv�a�M����L��S��t|�.h_t���D���)=���������<��}�6��[�����\j]I���ED��N���p��ip�ʨ*<�D3+F���"��r�b����7 ��d�;ߡ�tTiᒨ�Ě�HM���o��f�?�7�O+�bR��p`}b�I�Z�@�>[ӟ��U�Z#��Ֆ���Ut )�����I��e&������- ue�Oð�3WdK+5�YvWK#Z&�Q�2�y˵��4��Yl�m�� �y[Ӳ��HVc��2�:Έ��Ա�U��%���QTH1F�����E��=g�\3��ES��R����[~a_�v{�|Q�,��t��&��Z ����S �RqQ��J�� ��.�*,���4�v�W��r�$>ΖX舒���6�*E���r�H1�4�B�� �W�"�-R���PY#�>���5�"�ĴJD'��bs ���8a!(���-[G�)T�,�!��$�3B\�^��PE��X�-�2K�*� �{����n�A�~�Z�6a����(e֫��`^�S�sÖ.��c��mx
Static task
static1
Behavioral task
behavioral1
Sample
5fd19beeb2337b8c37a8713de84555dbd1611c799a242ca94e8ca546fc8ff251.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5fd19beeb2337b8c37a8713de84555dbd1611c799a242ca94e8ca546fc8ff251.exe
Resource
win10v2004-20231215-en
General
-
Target
5fd19beeb2337b8c37a8713de84555dbd1611c799a242ca94e8ca546fc8ff251
-
Size
5.9MB
-
MD5
aa5240c19d6cd50d96e24dcb80d7c322
-
SHA1
6b3c80e5a883bba1803e28505cdd40630baf087b
-
SHA256
5fd19beeb2337b8c37a8713de84555dbd1611c799a242ca94e8ca546fc8ff251
-
SHA512
61793414373d116c0c9eb2b2228fc1c413152498f698566eda4d190e47db38f2b76b8d6b87b1935c8b962411487854b5d2f086b701c3c35b976da2b1a9b0315c
-
SSDEEP
98304:ntKaJLkpTwqK6OsUFwob6A/HY3zUB++8wTyXUtYOqKI+9y:ntf2pTe6OXbBvY3V+8JUe5KPy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5fd19beeb2337b8c37a8713de84555dbd1611c799a242ca94e8ca546fc8ff251
Files
-
5fd19beeb2337b8c37a8713de84555dbd1611c799a242ca94e8ca546fc8ff251.exe windows:6 windows x64 arch:x64
7056f84404b7a682d11f4bccab10a32d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32FirstW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowDisplayAffinity
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
msvcp140
_Query_perf_frequency
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
winmm
PlaySoundW
ntdll
RtlLookupFunctionEntry
imm32
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
log
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 993KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.01 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ