K�;�Y�i<c#E� �t��$gfqQ���A�&�w��!�^{àj%>�^��W���z�'9!�TX�}�%����$"�m���<�� J�'�4�y�;� QZ��O�����3�v���=@���bk��Bր]� �P�g�y2yڮ�NC���r�[�*4�N���{N��@�a�������Ѣ@�vR���!����G�%�Irna� wk�|��6�� �N�M�R����r��5��tS��'��%�p��vY!t�����2ɬ�o���qP"+� �=��U�r_����C�Y9��nӏᵆy��$���춞Z[����M��� ��xJl`]�.<��Bz��Ko n�#`��ny�F����Q���������>i��lvi+3�#R���[����d�%?$ �kI��6�O;� ����ډf����P����;J�L�].AK�_ ��{�4 �i����|�ꔆ�J�,σQ���{a���s�m����a,3%!�)��Tsۨuz���7��0vX! ��Y�T g+9�:�h ˇ�BJ�f���-h� r5ۥ1(��`(���:� !�1m��?r�Fd>@S��#�a�Ѝ�Ô� �wK�B���fpE1)��k'b�8���91a��¦�K��`u�ۥkŬ}�����?ɯ��Oe5�P;�ѵ�)6�6�A�t�$�J�z �&`eO����8��^��3�w6P���qS鮪r�^��J���`9���y�����CP����j�����`�x;�kc�RPr��du�L!�k=�d"�M$qM�gb���� 'KWW�w_|�"��v�x�`���{kh��E���tex*��<����aJ��Ў�����'Y�ֳ�J��y�olO�g�����̆. �2��; �g5�m�4.n� (4]����ٕu';sc%U�y3����G~7w'�3��z�2��±�~ݴ�B�G�͈_h0������I����P�6 �<p�� �?֝�����L�%�dB�<�����c`�c���������aW\C]$1N�p>C'���6�^U�f$]]��8���w�ظ�:_�����a����8���x������d4����K-1zq�R�;�J���(��`8��Vdw] ��c��t��g[t(.���\�^܅j���O̭�������"��P���&�+9%���}��;��0��qhY�d���r3z����\�(�v�v�dQ�娺�h��c��W)Q��t�i��-.����GRқ`H��� U���cI���k�"�ʙ3���6Bƿ'�O��+w 5'������^���"G���_� �6��{���w�Q����ڮdf�Ul��R-��Me�l{���M��:�ع[���)�rbI^w�1$P�/Z��4\UM��]3ɯ�ď����5��9��� �I�/<�w�*�z���7�( yx.ɋq@~���R��?ߺ���L���ʃ��w|n�~��]g� �z�#]�h�# |Q��i�5�8p�D� ���xB�x�XѶe�8��_�Z���!�b�4P�`Y��bo��]y�m�GLb���'s�N����!��Ф��]��)���=D��v��t�t X�'?YP�?ү{�>G�]U��.���� �6�IЭt���P� �����?�X���\������/�3��̥;���c��_ L9*��Mț�&�0��Fs3n~���?N^����Kx����������P5�r�.*B��� �_��w=��#�hRw�9���⛭Q� �|Z���3RX"BgA�^���l��C��s��S���v���0=��Q�~c��q��@_�su�F�/k�Q���5N���,4��>̩�7Ġ�aF�%�y�s���Ǒ^C ���h�m)� ��_5�����"�B�A3pq%K����Q�X3zl��}j�J9�8��iL�?֗QMN`D���"v�w�^�8]?S�4h� $m��K�Q�p�����������6G2���w7�%V����@>�w�gd�*�$]H�b���x�D���[�]����et�r��x@�,ݦ�rIܻ��T�m���ߚ�W<�RI���߄{������O�(i}/�Z�x(뗞K�j��� M������^�����xY*_x��-�/[�~����L��^Q���^��yD�@{�t��@�:�S�6b��n����4cJd� �E��P_�~��^��t�qiĵB(vV�f_x-�-��~ւ���F�*�0�U��c^O�&�br�bM2���Ї�����8��W�>�7L������pbQ���[�^�u� ��XƁ4�ޢ�$�,�K0�`�#�e�WKe��\� �����{MW�#�=+�mN��@�uj�EL:꣓�\�莶�����ʾ�3)R�27�\k� �ގ]e�X�5wj�q��R}��nȹ�Q�r��Ѕ��ޜ�z�h k�� Ҫ��On(�#*�2���4ίB����o菱!ʏ"���j��U^����<���6��m4�1�yJ�G*̣@������ ��]��o4���\�A[��C��=F�^3l]��e��,�S|�����u�y���[BF3O���QY@�t����|\�8DR[H5���Dv�E��6?��z�'������,ۊF�k�1U�fڲ1Lȏ?,!˴uk!�¥Y˥���� �r��{ �V�)F������dd����ū�,���--�p8LKi�"v���K���r�|��I���8��Q�e�V�bY�6���R?)�����T�}u��ws�>���ý*��Y���d���� �$}�~�+G�U\O'��`Z�Cb��̊0#���/�,���]�M�di��p(z鶺�u�|���q�v}��{���m|�L-���~}�&�t�aANb�~>èv07��z�$��Z��{7ASI���['����r[L�@��=˘���Z��)�*�$p�;��a�I��y#�B�%�$YL��Zf������x������J���}sAÊׯ� �<H&f������!b�U������������qq������M������gD����"M�|&pSo}�����r;���ˣ!f
Static task
static1
Behavioral task
behavioral1
Sample
1bb2eb97e4faab9920562134264005ea.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1bb2eb97e4faab9920562134264005ea.exe
Resource
win10v2004-20231215-en
General
-
Target
1bb2eb97e4faab9920562134264005ea
-
Size
8.7MB
-
MD5
1bb2eb97e4faab9920562134264005ea
-
SHA1
574b0986a3fd12ca891a7ec39d4f52d9eeaa2512
-
SHA256
9d8fcd98b7f8bda1abe7246a3e0b3ffcf2c37d0af1c6b56903480f7fc483833e
-
SHA512
4193bbbeb00b9144da40a6484f936af4ab11deb7c6e78e8f28b284e237211cf686db4d678aba1f5d6afc34009b31ce32a2eec92251a44af499b178d67e8bc1b3
-
SSDEEP
196608:NpWXL04Z3rrElNKbDYl4jvhjfCzK8UxhqWClkANYbWTx/Ld:NpWXLLZb4DwNtf41UOWCJNDN/L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bb2eb97e4faab9920562134264005ea
Files
-
1bb2eb97e4faab9920562134264005ea.exe windows:6 windows x64 arch:x64
0926d2bfe087ccb072cec51342e00572
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcessHeap
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
CryptEncrypt
ole32
CoSetProxyBlanket
oleaut32
VariantClear
ntdll
NtQueryInformationProcess
iphlpapi
GetAdaptersInfo
ws2_32
ntohl
crypt32
CertFreeCertificateContext
wldap32
ord60
normaliz
IdnToAscii
shlwapi
StrStrIA
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 1018KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 648KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ