��v �3�x�vp�Rx��ʫ���s���d�Tk�����c|g3��'��-R����>��8@d��� YL!R�n�fjg`x�ȂA� ��� ����q���GF2� 庹�t8� uC7dY��E����W w��;��t�{e(p�i.�/��|�'��4���a4AbX�N��tS8��>�v�N�w|@_F�#߸w4��}���)�C��㶸n�P2m����a^m���#� a��p�Z���r$��W��C��v�5���1"�kGa{P���������x�@z�7yl'5�i�`��"C ��Ҝ[��4���� l�z��U�����"'&K�p�j��K��gQ���=�3�zj��-��y=�gJ�����8�Ǽ+�>�w����xz��8��b%���dӽr��E��Ƹ��B����F i��)F����z���.�L�i+��H ݱE��vk�C��3C�����/���_�15lq�Ǽ�R%R�_a.���R`*XX��������/;5엥���)���8TPS�g�A1�G���=�O�e�^/�ղ�cq*P4y�G�&�ީA�UJ?��-1W+�����,X;����@R���u�^_ sM4���,�,����#���S �T�,��7��pOXjˢЗY�:&�p$Na����;��J�\����e)����<h {�ޔqT���;ӧ7�t_�$#���3�`�;��V9��}��'V( �\�=x�N�P�]K�pf���<=R����n�y��<��_4�8O�s�N��v�ZY��X�����P�4�~9���de��Ҳ�du�@?&��G���e�'r���Y!�y���4��S�@�].�����b̕�w���v}���@���#a���W�^���`��=�����sp>����vds�f�V,�]>��L��Hx9��)�����}����ǟ�|�(��|C��[��m�'O�_u��[�}����u����5�g\:~�p���������l�]�%�fh��?��ھ6_n�ZK�Hm|2\�e�ȀQ��A��iI��3�lxA�B��"�o�R��MD$��.�vC6��U�g8��V;K��M1-Yx�d)䈒fa�����8�D� �|��҄�� l<=|�A�8�O��"�G�x�!��@$�x߽EcsI�Du��hM��\V���ۚ�{�> z� 0�`"���#���(�Gp��Ƭ_m$6�6đ���"tۮ瀞�jR`~�^�J�B��G��&���z�������x�R3 �G����}���*�?A(��:���O�+�%{\�m�c<^�<غeW�f�c6g�r���Lk��<��7�X*�ٮ�v$�����Czz4�����FM+���,��Be�PA�P�L0�_�7�X�����q�*�v�بUS ��/=��R�8i$u�%��X�w�� �*��l7s�������6��$���քAa�3��f�鎝zH��rL���nML¾6�p5,:<o����^PbU�嵎�G!�G�������g_�^�х��0|i��U��s�"?��ĂC��"%,a��j�x��� ���<Ki�t���&���m1KSV|>|���x��)���-��}ȳ�Jָ�p(�m����Ӈ$�_����d�@��u1�mLn���/��h�U��+9�U^�o�Ĵ|.�Xˍ�w)oi�����U!�����Z�_��X`�e N��Y��/7�탷նg��9�^8f=��x/3:�_�',������w~,�NN~?*�%1�L��\�C���%[VdrQG[�$��G�%�|':�)����:�FX�b��t�h�y�}��v����yZ� n�����L����G���YlˉԢ3\Cُ��[ q-��SYxۺ�D�q�i�19%J������nL��/æ!��ҹ�GU"���1�O��=>-4l)�X?tOW?����(a���|�CQugQ ��e����_�,�E���LX]�����v-H�k^��r�M>j29cYޚ�Z���Ig,2E�n����2�a��m�7����5(S�pVk��ȝ��!�� M�@��@W�o+3�efa�[y��m^Ϳ�%9_=k�t��8�n�,�-t�si���� �R�c����^�����et��S�3[�>Me��'��Fh��eao���e�;jp�%��J�}��)��E��;����\& �q►X\�c3+�)o*-#��('�Ď��o�zF����P6�� �.I�6����U�B�F*���4D���d՞Z`�W�%#��A�k������g&F��� ��O�mv��3;��m%�5���u��:�H���r ���+�,�m���(^���Vy3����d �K��>R���V֔`ZM��������d��0�!D݉��W�>0�����b6��i8y�����#���(6�1'�0Ή SAii�H��W��W�KnΝx���s'���|����u��U�mG_�j�S���|��y =��9ٵ��b?�hv]���I��'��^�c�ȯ+��,�������7#�)�����;�g��7P��%$����9�dXxS�y*5 T�/O}T3��2��z��>�#Y��WKh���ˌKJ������U��?O�� ��}[�c�w��ov��������c��٪�z��匮Kg3*�K��{�p)�D��]g�D&%�?>�M�V̅I���$�=���5<p~�� "�v����.�J�d~�B3o��`�h�!��-^�U����ٽnG�-�:��&����1\>�VՋ�ju����ʲ(�������.|�!E�+>�n˷���/{� P�a��걷P�۰2��[~,�rq�ٷ�1��2ftKs�M-�e/�i����V?#����2�sl�~)��Q��,-��Q��ͧK:ˆ$��.w����2�����c7ec��"��N53�^�����DB��$M�>bn� ����9 I)������#/��&��1�@0�8��P�C�r%�%�QX��\�|b��cA0���}�$��2D�u�G!�⇪��R~A(u���6Ұ��
Static task
static1
Behavioral task
behavioral1
Sample
t.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
t.exe
Resource
win10v2004-20231215-en
General
-
Target
t.exe
-
Size
5.9MB
-
MD5
382e22ae53d2d22307e651c5bf5ef7ca
-
SHA1
0523e9741708c9e10b8cb8b02cd8bf8a5cd26107
-
SHA256
6aa566ad78bce901848f095a1a7e67928ea4bc2a7f8abe91be80daa1ac4e97d4
-
SHA512
4d26816b034cf699212c32e5293d10c9ade53368b34c9cfd582192c4d14541cb86d0aae00d22bf83c745a2bda77486901b4577ab98dd6410d6bd43fdd0a629b8
-
SSDEEP
98304:hnSS2ajth0SMZATe4y1pUWvBMZj9EL6wOYbgNe01lbvJbAq+PXlHd:lhh0MyDxvFwNe0P9aXD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource t.exe
Files
-
t.exe.exe windows:6 windows x64 arch:x64
1622b1a6d0f9e13654a81b4242134664
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTextAttribute
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ