��{�R�T Ar~���禡�)�/�? }7X�rP�-��,n�Z@��8w(�E��]8}9���qeCSP��_��<.�}��23����;)r���K�&/'^��$᳜�$��5��zE�{խω�I��}h����Q�Ǖ�v���U�!��Z%��`��2&���nf��Q�#��ޮ��\I뷡�v�}�@�tý$�Uܪ��(�8��ݫ�,����v1�6`���5j"�Q�i��6h7[�,�$$@ؼ��+v$������[Ԋ�#��5m��bw߭�X��7Z]�́�i�g����_����a���W���l�!��Y��qυ��d�[� 2��u��2��O�X��.��siǪ�3�����:���۸�7��Jj�i6.O�֙��,�չ�k�`�1�aHK����X��:�-����ؙ��<�]֠�G�?�������mky+e]�"Q/tewR�Eڮ�]ZT�ri[h��P!� k�*3+Vc�@��#:��'\Ԧ�to�����>ЃN+toW��F#���YeL�T��f�N^���������+���\*����J����6�w�VmeH�D� 1L��`��bzV^!���ϫgL�����Z�NW�睭�0���� �jp)9O����(�#�(������:����7\o�kd����f$��u�Q�l�H�3N�0�"}�*��@l�p�|ʚ�(l���|1~V��j�x��s6��"��E�I��\���y���{J/��.zwM?��O (�_/Ǵ�q��̎��`�BH�y�|ykn�_P#����ifR���;}��t$�j��eG�֕{�C����$�ӕ����6{����}p+�gj���`��_q�%�yڀX�|����UItk�h�O��c�u&=��'z��\H5F�ߠ%��C5K�X�=nH�"msT��^�!����.��+ ��`�ק��rJ�V�C���6g���`g���n>UE��3�)#��4�����,��8��(W\Ǽ�8$.���s�E6����mP���u��ʆ�ex��}B�͡�,V���[E��.���� ��e*����������9q�+��vu˛���~kA0p������8��(BL��(��M��if�K<h8���t��_�"�Nb��"�l�Vvc���Q�}���F��]�}�xn&[�ʶ���S<!6~aQ��g���_�U9�ʟ�hՁ-�ÇD¬�^�9��������E��Mi��� �(9������wڹɌ<b�*�r4h/U-�f�����n�qo��(2e������%,�3��*?�\A���ӟQ�EV�:6��M� ;JnmV�(.'�ӯ~��\�Cv�6���-�M���(E $���Le�Je��C���e�IU�`��}�$�?o8��{�V�N�:���C^��2��J]���\��ܑ�p���ˇ";� ��b������ ]v��_;f�.c��*� ����ɼM�`���Y@�"��g0s/{n�'��L@m&�4m>�nk�����G)q��.*�6��w�w�bzjzʾ6���l��G��U�G��YUԔ�����N�Yʡ��g���n�����cB�c�I�c�j<��]�����%ă�($�ˇ���Y�u$X/p�Hq�@RՂQ�W�+�WC�HM�㖪��P�O6d7����]B�ѡx_P��9�B��":��P�'�ڣWXj���]z��Y_�F� ٠Lꏨ��.1�K�O>��}`�3 j� ��*F�A(=巢2���]4�Zְ"�/{~\�Ý梍���8�Fԗ�]��ۇ1����:�мd|ڣW�˂ � [�UZ ��Ό`���j�J$P�����Y�RI��,�r���&���r�p8��E��g#$�$�����U��$Z�+�^��md}��T2��3� 7�'���� ������}�q��%������ ��,c�YPI'd�ׯ!8x$#}�������ɲ��|͠+�5�g��(a��x=�G>�4�5�����,L��Q d�WA�DĹ �4W36��'��oa"�������f��ن�\,��4/g��"_�8�Y=�]���Ǻ���8 [���)5���Z�3z��"g�ДՉ��U��x���W��GR4&pƝ��K�6�CHpJ8l�����%�������R�X���;WC)wZ��ם)pAڶ�lo����^]�̖IGk5�����,�x�J/�K$d�D�f}Σ�[1؝/��WmX_�^_��I�3ĹS��'-��!0[B�.����D������g,!�f���(~��(� �CM��M��S��c�dxi�%��Ҥ����]w��������Z%���ؿ썘A�4$[��P~J�=_M�_��sەJ��r,ĖH�>����<k�\�U��L ���PhE{��aL���:Q�#"YJ�[���#��ެ|�Ü-q�ֶ_>3x�#���ț��Oz���D��W%���o2h����?��@���B�8�|F��K�r��H%��9cvZU�yS�0n�Y���_~-��O*Fxq<Ӗ� �:�1��9��L�'�\��B���-�0T��m����=�������4A�;S�ܕO��M%�5Y*��Bȥ�&��QS����O��(��g���豆���֔��:�R��0i7֩�')��f1e����H_S�j����?5���%m��4�_H[����Z��dU/廉�B�/�b��v<r�q^mCX2���F@��KE��@��Ҫ����Q��{�.�T�gw�5���w��b�<���dd�g�7:��$c�:��d��J��|��ʵe���\�-�|�S>�4�:���f}���$�H����6���\͡&w]d//� Uы6�����34�F�Y�)`�b|�.�L}y2?�iI�?�w�3�JRV4V��r����MB�x���39!L�Eהs��lc��<���Ǐ�hY<;(��a�P�Չ�\�"��_��G�Y^���j���o�&�Q�@SO����P��5����1�,����[�Z�\��?�e%��v�kj��垅 ��ϗ������$VW3ؑ6�A.�|\",
Static task
static1
Behavioral task
behavioral1
Sample
017d6f58a7b549dfc8163843ac823006.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
017d6f58a7b549dfc8163843ac823006.exe
Resource
win10v2004-20231215-en
General
-
Target
017d6f58a7b549dfc8163843ac823006
-
Size
6.7MB
-
MD5
017d6f58a7b549dfc8163843ac823006
-
SHA1
3b1b95c0200c7d018ed4ae27c9f4b72cce6e00b0
-
SHA256
daa054259a79f437dabd76aa018930339ea236573514db6d67ac0e46c039bfff
-
SHA512
309bb569714537725f447d835048ee55ba5b6b951d76db31b58e96eafe4af1329090d0e79f4f1e5107269a9b665060420a99b4f1d8e74c0d9a64ddce909ddd81
-
SSDEEP
98304:MQCEhw3N09zL99szCLbjQaAg5dFKsWorcQomRKMcNcg86RGKYwTfAXVSfvS:ct3C93IOJAg9ZWorcQ1Y0gVRJhf2VJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 017d6f58a7b549dfc8163843ac823006
Files
-
017d6f58a7b549dfc8163843ac823006.exe windows:6 windows x64 arch:x64
e2f96df1175ccefc575f9724291cff80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
_LDATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 522KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ER8b+1eR Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ER8b+1eR Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ