Z<}�%�.�¯�� ����Ь� S�҅�R�G`�y}��`ǽ��4��P��)�UH���*k�ܫD P>}0�6|%���<b��{�:��|�xa���.S.ɋ�.��^9��,�j�I�u��5��x�MJjX�+���K\��>"��]跘���F�~Wk��!np���1ykKv �J��8i0������R���!i�7�%�j+c�cҰ�Z/D�*\�(�6�V/���"0X�V�Ds�T�������"mq�F��V�����3�du�����(u�������Uй-S�v��p<�`Q6z,b�sܵ��l]�m:#�W`L��W ٹT�H'̓N*���c�cb}jhg�A������S���l��ȃ-��6��f�b�l@�Lipc�H�)��S#�5� � Sc#x�JJ�1V5�zY�-m��&S?[&h̔��0���1ą�]�3�X&D|�iU�*�HZ�T���"7=�R���1�����}��w�z�T�,Ϗ վj[r`�*��1�`�Є�)e�x����j�Sn<v�[0b��~�ء����0�BP+��g �D+� 4}ʈ�A/-�Y r#��ɡ�3��FjF�5�視���r�h@��nɭC̔�M.���>��1��j����&�A*jx�4n�l��šgRJ�+�op��R���F�ija/�M0_<>'����䧮q�B�_�uy�$��;|�7��P��$�8�P����U94벌B-��N��/�,�����6mԛ��t�u���ݒ�����Sw$��D�;��G�b��Q�Q ��6p��ƚ�O�� ;�R�K ͕uh� �Ь�3�E�pO#;I�s�;Ɨ7��i�۱��]ŋ����b6F�`r[��PY��*����G���S0V����i�z�q�߲�x�/Н���``�O�������Iݟ�vyU��̐l�Z��9�=��Ɏg໑���?"N������Z�؇�Zo���|k���k�����2MzG&��p�t�Z�x]�|�DL?����@�q+I����1��B�WNn�#-���L��!QMV�?��T�^�ƝP��Eu�]!-<��˔ o b�XW*��w�.��6ٍ�``��3qν��^4o�9����:�؇���Xt�U����� )ё��6$�����E�}d�ج*&�~ۧp��+�����N`��ע-�@������Ib{�3����?"Q��H�2�����a������Q5J�ˡ���i��ѥ/�=�5B�X�7��,�u��T�q(շ��%붽bњ� �T�G��v�,���DBL��QE���|0jH]��/5��4m�� ��N���\�vn@�^�������;,w�<p�C��6uI؇�Q���D��2m� ~��yM%�NHn���_���7�g�1ˠc�6/����bf��l�C߬�b4�+���My�{�m$� N���P���)���'�S�Q�+Ĥs��ڋt�=�u�b�0�e����Xt���b��w�������g,)2C�h����V�/%�V �����+��9�;�s�lTC��z���VŹ".8UJ�t�q��O���W�"�·��k�L���Z��{4V�p�*B��q�!�����Nh�+m��Hb빀�K��r���q.��%ux�~��z��g,s� _�#E2>�yg ��8a6l������I��G/��ռ���7t�4.u^� ֙��ZD{5�Ir����g������n��.���D���V ���<a��cY~���N.w�J�a(�O��d���z�m�]�4�DhzhX�u�z��Jp�U��O�X���N��J��J������]�شH�����LȖ$ j�[Vْ����x����3 �q���߈pϝ\����V���H��:���i���e�����d�j�RlЏ���x:) E��B��w,u�\����+�P�d{��+�.q�3*�h�#�k�k_��(T=�Vl�-����W[/���nB���'N��U��2`��Թ+��5�\(-�v!���s�5�C�@y�����4nt�6X�U@+����ӓd��6�7�G�Ar�iaн�nV>5c�)��'Г���xD{����sl"���kZ�?��p[�Z�&+��Ȥ�x&��pq�/���!{'!�&��Up�� ��T.N�� k4����J��j��U�.�:��쥢�~�)}E�",(/oD�z·� �}����Ӂ���7�jx�ԟ��ri"`���/ F_]gH�i�0u�c-�ꯑم��|�5ݪ��@ef5�T�jc ��E��ha��^t��C��u]��X���v��uzr1 ��P���ַ�Nn��a�����I|&b�r���Ydٛ~d�=�B�;ffZ��t����@��B�@�[p���S�x���$'�C��"�����mÎ?X8_��g�6��7�BZ�j�3��g�2|��N<$ebڽ���1e�����}��|(���`w��X�����D��`f'���3h��X��:gzy���N+�խ��%��W�� 8^lD{����h�U��+�*��nIsW�d� ���LQ�E�!���S,�7�T#�Rϱx�O���K_痣~JN�C3&���ڟ��ޜ0��ߞ8�g����}.>���u�-N3j!�� 9ڂsY���QGL�`��F,��S�fx�wÙ�fr)=7L��`B,�M�l�4��{�n� �o��\��I�����(ʭ��������u��jTV���l���Wz����h���e��eU��D�o�Q\gI�]�.���8]�������q\8�G�)�%��fr���Ll��b�1<�L�m�O�l�E$?v�%����m��wȧ�0�}"}MLw������_�1��E��T ݷ��� ��E�s%W�`t�n��6�3���?r�������F�o���nEH5 b�L��c�t솭�?��M-O�?ܾ�e�v�68Ƣ�'�y��Vh�E���$�2yQNe�}Y[�3�Ϻ�~8�����6�������? �a&�(C�v|�;�wV�wm�]��/}%�C��#%�ۇx<�#���Y7�jiOջ 4�K((���
Static task
static1
Behavioral task
behavioral1
Sample
GASFAZ.exe
Resource
win10v2004-20231215-en
General
-
Target
GASFAZ.exe
-
Size
5.7MB
-
MD5
c568bb276ddb904922951274558cc906
-
SHA1
2e1d6439b929680d69ae18ea7e025f8804826dfa
-
SHA256
55a55b4827242798450f2d59a3fc6d35cefd4be561298f67dfc04f42f3552b98
-
SHA512
70345e9f97380bebe1b75b48016d8ec0f77b2ef576f15cdf3ffc453959c3efd589bb61b5dd804392151b9f071a57e5a9f6c36e6750d4d7ca0568d549e81cf7ff
-
SSDEEP
98304:qNXyh7d0mOLtQ25bdqqT4SbdgaD1t/6xSJueOsm8B49rt/mEHEh/Ma+JdlTiMZ:qNXyhxLOLt2s7Zgaxt/TuYNBEtnM+JDD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource GASFAZ.exe
Files
-
GASFAZ.exe.exe windows:6 windows x64 arch:x64
3171cd912f482f0ab4716975c9bd695b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
SetLastError
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CopySid
shell32
ShellExecuteA
ole32
CoInitialize
msvcp140
_Thrd_sleep
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
shlwapi
PathFileExistsA
ntdll
NtSuspendProcess
winmm
sndPlaySoundA
normaliz
IdnToAscii
wldap32
ord50
crypt32
CertFreeCertificateChain
ws2_32
ntohl
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ilzyffx0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ilzyffx1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ