��~tB*�<m�X<���0�g?���S�+$���N��(�h -d�96�D�GNvuJ���~&-���E�k�k�pP�����;�������aW^�?$VT�� �p8��U�jHt�����/�nU���"A@�4:İ��~k�d�_�����i��7���q|P�+�=f`˪���7zm(�C ۺ,�?�Sγ��@���?[Ё�V��m�|lR����o�[E� �1#�ݫ(�~��x ��<&��0�)�oRX2!E=�|���j}(�\rq��-1=A\�-���<O]B�9�!"z8�^.�m VPU�o�D ����jT��1��#�F�ʶu�;y��=�����C�ٛ�Dg�Zk�컪��:e|G��y�m@g2 c�4��4<��>6��}��H�{��ؤ�VK��1*j�eɒ[��}쉟Vp���E��:��'�UP�6AZ�i��:��fL����[ u"�Y�Rl'�m8��G@y��' �/BH�����m���ֵ���C�m�ܺ*ׯ,Ok��F���ܺ�GmE�l�;k���Gk��"�?װȧAc_)2 �� �2���kq)$�Y�S�{�N%B;CT����� ������a`&�� �E�]!R�}��O������lK�)2�>C`K��:�5�_�V�T����l]1���q��X bXM�ܩ����tz��+��w�����ێ��>j�Wj�18�ۧMV�+�ʝ��zj\�w�U���a|��us5/�#����2���+7@��O�!=[�0�o4_2�5�n�YF��)>�q���/bu�!X�J�n��=�D@m�7`�����0�pe/�h��y����O�e����JE������{��}�X�Q�����s��9RT!L���+��0�r��Q��`s";��$|=P��>�2�k���f���^��X��y`F��Gc�hI�>�[OZ�C#�� �~P�v � `�o"����R�er���R?�q�X~����7��=n�.��Ʌ��JbO�J����fH���x��%'7�9S�����C]���.gns�X5o��x�b<z��\P#5K:����6g)oMH)�E�䕢�}%i�1��zU��P#2Oϱ{*�m�,6?�u��L ,d5�y߽ f�U!Ys����>�JBnZ_]�J�' #(v7BFv�������TF��� yM�𠆎���֣�������ŋ�,4��s�5�9�B(�1W���Y*��>����w7D�Q\�� ���H햑eK�ۛ -��2�Z���l�������}w�w{�����X��̍��:��JX��ϫ�*N^� �v�����������\�c{Y �$�m�k�E�U����.��A1,�/�lJ��Š�����-Ф��.<)�z�v$�۷�:��6��R ��>x�02���XR��+s���LjP�D�����<ς��0D��G�Ӡ�1���b4��l�8Y�X������x_��Éd��E;fr���� ���7���~38�E�6������h�WL��Y"�9~x˟��9�:8p'x�� �`�k�L��� �{��b�f�67�˷�3x�S���P��4C:3��%��Q��%`AXAԚQKA���۽�� l����0>��I��a�p|[��x���e��䭉m5��7݊���Y�����1�#���I�Ϣ��&!� �_F�%^8�;��8S�Yf7)Q@��� I:� J���L�I6� �M0?��^*��oK��0�bb"O>�U<`��HN8|8����F��<L�@����B���Hn��<� �?3})J��g�4\��y�L��"-���4�?� ��ɭ��:�U���_3G��,QQ���,�ec~�e�Kc���A�ؒ�pj���3�v[��o�جh�⮲&��7N�y/F�G[�^wGc���քm n��0�*�j�U���ޜqzu�7$�ˣ�$g����]`-Վ����S����0ɀ����fd�na<��2��R�g�K�%��z���� ��jZ�,FW@+�H4�FN��)4��Ή���&����>��Ƨ˒l�iX[<-�[����3R�#�����U#�d�C�j��X8��aK���+����D��2sΫ&Q\�Ri�X_����ܸ��� L�=�����uЉ�NO�i�@ �>2Q�(�w�Z�.�S����4�E�Y ���%tn{��a���s�z]`[�����Mw�k@���i������2$F�����G�( ���!Y� i����E�M盾�2��t��c>o ����/䀼��ѐ�bĿP�'���&� _�o`f����1��r��`ܗ4e���Gil��0Cy�;r��?��:uW� �t��rkfS�,ˎ�����"�M��ˎw~�LO^��m�V�kh�h�������=������`l�X%�u��ҡ�d��%�*O��ͭq�$�wj$�%�.��y/�#bl�R:L��x��l�-{剈�����������64fpg܇ �~n�?B��_�\��ZXx�rQܐF���v����'%ZbA+�n�z�0�E�V�A�7�l/��h�����DkaS�G���,^[P9�E��{}��D ���\ɓ��iw�%X��Kyo�_ �'f��@N3IR�ǂ;�8ă��QF��PV� Z�Χ�hW��t��������U�=�q�� c+���?�m����]�%�J{��=�$���uKY������3��@�|m�� ��pG${r&*���ݳٕ��SP�L��,�Y%���dn%�z�'�\g���G����E�hȸ@>����� v��N.Kq���jL��h���G׆8�f�m�9}�)M� $���z��ǥ�\R�'�g=3�sLz����T�8;�K�$բ�ϯ�E���uó�����~z���3���~Ag2ll"e��TXZy��^y�����ϗt�.2a.dm\�{��4͗���K$�S'�J�;��:F�\���D�DS��I�yw�ìVe�s����缗T樝�<|E�ub�HGW�v��b�������p�D
Static task
static1
Behavioral task
behavioral1
Sample
NFSTR+10Tr-LNG.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
NFSTR+10Tr-LNG.exe
Resource
win10v2004-20231215-en
General
-
Target
1fddbe05006e6e3a81bd0ce3433b8bb2
-
Size
2.0MB
-
MD5
1fddbe05006e6e3a81bd0ce3433b8bb2
-
SHA1
d62eac0433375470573f2c5e03911120f7c84534
-
SHA256
74e205a50e3f421404b38f4f1c5b51f59d73cf301d1720749d452831ec03bb84
-
SHA512
8bd1233f73bc8eca0242736c1827bee17a3c182a6aae340c5ba1093658c3ebfad1f346731bf272a74f7861c2eef573af151afa421af380511be7f98cc3ce662d
-
SSDEEP
49152:pYXmE03XR+k26nA9y2oJ1deliMj2Vo251wDyn1:+XmEQXR+H7ybJ1E2d5G+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/NFSTR+10Tr-LNG.exe
Files
-
1fddbe05006e6e3a81bd0ce3433b8bb2.zip
-
NFSTR+10Tr-LNG - INFO.txt
-
NFSTR+10Tr-LNG.exe.exe windows:4 windows x86 arch:x86
903eb71458f417f6f932865d083cdafe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarDiv
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 956KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt