�`�ӤeE,�zM(-���C@S���V����d��g��3��U��%@�E������+���>OT#����C�6o�t�D����NG��51��p��j�Zj`��q���,'�0D��N�FWOr)i_-E�k���kF��B(���q��b�ٳ�����)[��έ!�wwO��M�8}HA�t�?��-Y97H�zL�"�nR��e�W�S�ֿ��a�E57�a��[}:���X����7��G�;���r���p&%�<�@ӌ�� tƷQ�kv�3��Ə8��۲Ol�qVx}H�{ ���ܺ뻅{�#`-b�f�$6#�u'x����D��;i�πB˟��[+$�_`��.�Fϕ��bى�pWkt;1�������]n�C\�$t d��}� � Mu\�K��E#D9p��W�C�k�u�BHT�ޞ����O9Owʡ��j7A��k��=f������r5��_����#��&���}����qvZ���I�Y�mC��(t��?�E7g�h�DY7��_UN�),�g���n�*y;���ٍ�<s[����B`:V�Q��*�u�t�t���_:��?N�Ǜ��,�Ö�������h�N��>4ϣ�ZO�ԶΝ�m��"H��y`��ܴ|M�ބ��9�2�-�<�_��*!�4�ɣ�l�Xo,��ӡ�׆(!*7!�*��[}n�&�1*ߩ�X3 �>H�e���I�L�4b� M��X���u�X�j��,�=;�{.��*��rk{���0(���N����i ��LJ�Y��������}�9W4�<�����0�����MZ?l�W_�I7�}| �k~ǜ.��~�Z<2��������^�w�)�9�'�����4 ���FYy:�4i�u�z���������5X !_�8����N� g�] �jX��K�t&6�ۯ�����-��D��9����P}Py�=?����f/ވH���s����l��埧"�4�d6����c\?7��g_�O�8�;>��,���6|� ^�� ��n:a�P��j{�cg�+#� ��n����[�����L~>��S���PX�����7�X���G�~��r��*�ݓc.������A�l��ҿ����@7[��)I�xɯS�W5��OnV�����G}�X�Qu�/[�!�,��� d�Ս����HƐ;�A��3'�`�'e�o�S�w�B̳�k�h:�U6?��'fƇK�3(��a��f����~�d���V�ǺN�V>U�-�.$��UF �H�wB�!����*DN"�B=?ddؤ����u�㤑}#��a�;TwR��`��P33� ���ҙdG�%1������lEGӱC�,�5�A'��AJ��nn|rG^ ���-<�������>��(�^�A0�����Q�gYS��[K�R�N�����H�oߍ����A1��p@p*k��YsUC� __'vЩG���;��i8�Pߦ{��:U1�N��#,�TIK���U=������us����&�l�g��Û?9��g{���)j"�������� ���j��~�H��Fn���d��8'�1%�]n r�d@��q��������N��X��F86u��\��L���<�F���ޡ�z�_��R2��kP>S�ƅ0��(X&�S̟��C���_�:z��~YV}�� ԴVꞴL��s���A��� .��)&x��$��+�U*{�fs�R,r�������3��7p���2� ���鉥\\��W���<��R6��[t�N�^�{a ��R�flV��\~%���)~�:�����\�2��V��B���a��u�A䓧����096"���^`qu�`�O�^ ƒ��Sk.�^�Y���Ɖ�V�y+T�.��g=q$��{QwW7� ֛z�f����D�V��G��-2��a��-:-������'��^���l�$Uڵ����NH���Tθ�S_4ޗ{j_� |�L,@��^&���{ot���I38=L�o�>3J���e5��^�Z6�up�̪hw�B�$�[5���9� �pӁ�o�c���.-�to�aOx���� "�b���������RìZ�w� W9��p#���\�D(A�����[A��! "J�998Њ ��͟խ���\tx���a�x�g�|���i�s�\��@�[�y8�cY����%B:��9I�M����t����� :�A��:a��jGE��3C���۔�0 �����3��ӕ��,������EX�������cQ�9��]���Y!�u���!���� vźG�Za���>T��q���n ��ܤ/!Z�d���A�9P<���u�hG��W�8���5�^���鸥#_:�o�+�Z����4�ˈf�ù�T������4(��?�2����@���&4w�LAb&���r�[email protected]�,�j��B�,�M��d^�_���H�4N!�ɿ����{B�z�@�iC� ^&ow푑ʃj/���D��1���b��A���|��4��k)�ꈴ2���D���3P$�H�}�S' fs� �@�s�n��9S?²s��1�]�r�\�5#����I~nD�����m\��!��r"��k���� ۫�B�G� ��ư��c��� o/����N����"��c�A��i��r)X�Df���E��t��8������͗��_ N�Kn��m�G�k�V/�Yx��%�w�$%!��oѼ��(�*iL<1�4Zo.��o?^��U�����;�_f����������T��*����~F�f�k��۞�%��ȳz���S����V�9�߸��%��qȤ߸de`��`2�̝�g8|���}��Q[�j&To�[���סN�=-�V?��N�o-,�i>�K�_�>0$�vT���vfy߭t��)�^���Ļ|��$ɕ0�|���]X�i!k3r��)�ƁZ$��P��"C֨���1ӲS3A7MM��|���EF<t'���u���¦+��S�n"��*��W��6Ix���:d��g\ ��+�At7�K���tU�z�~ɉ�S�髰��HfNr2���5V�ϼp��
Static task
static1
Behavioral task
behavioral1
Sample
keygen.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
keygen.exe
Resource
win10v2004-20231215-en
General
-
Target
4f35a5335ea85839d4c803aaa8f664b7
-
Size
292KB
-
MD5
4f35a5335ea85839d4c803aaa8f664b7
-
SHA1
09572bab5c1a7255b4c245630a4d6a1ce79f3acc
-
SHA256
ecaeef411c46781e2c9a8bb2e79bc03b4fbec0d691c8f4b1b111f6e6537240a7
-
SHA512
fbb064fb92d4d1b276692054f5978188c0ec26797a603751ab0cde6b1540ecfa41f22b355f7c6331699f40897f63374db41919166b26fb2499ac93117433a6c2
-
SSDEEP
6144:Mfdd3dHTEoLoM0KErnaxvzFTgxzYelUtNzxFjaNU5cxatJ0s8q:MVJ5wkoMwrax7FkxzYiUjzx5cyjV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/keygen.exe
Files
-
4f35a5335ea85839d4c803aaa8f664b7.rar
-
keygen.exe.exe windows:4 windows x86 arch:x86
e0f48a407c46080ec8ba6c55991c4308
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
EndDialog
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
Exports
Exports
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 273KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE