;����s���Q����EQ^�Q_n�� ���O>���2���<�l�D3G:gx�d��WVcWd�{3 �/m�$�$���%�1�܂Z�.l�k��!g ��uu��MA��p�� �fJ��u�/Z}����TYG���r�i�?��*��Ѝ��j71�)ʲsf�q���@Km��#@�m����2�|D3�"�����N�<����r��ts����@�99hK�}��Ǒ�EB���|��0dB\���;C�m��w�;���.~��z���8���;�Q$�p3����]�C�= ֽ`�#π��g�B�w�[�6�i?���0���"<{��k����~Z%���k��&����(0�-�w�8��3�J����#���Z��l�g��������[��Z�ឨL�v�l��? �{�3�ͱо[��vD²�y:<� ����K7x��{�Xϕ����yUjp��|�=Y&vX�� ��4[��Q�E��>�9���5Y�@�����.�U���MO&���P����⒰����T^�#F^��<r���I�d�H�1�5�IT^-W[4�D.�2���2�}l�ܞ*}�[PER��N�]��W���xڙ���g��m�n˲f�N�Gp�))�C�2D��.�m�� �I�̣l��s�����j���R�ӵF�k�`���b�o �/7=�xEv�%��K�aմ����E��d�rse�n�K�(��|o�-n��_�,�gΡ�mAW����o`F3�9O�?�D�pgН�������*.ct�{t?~_�5����#���`J��OP���7ZO�1����=��/2ߝ��S�����������O/��b��s���@xMC�6���Ҿ��[&c��ޮ4ZX������ϫ�V���:���^LTH�F�xT�����kh�kD���{�[Y&3��Ă�AӽO�ة%�<��p<z���� 5+s ���V>��!B����˂���m!�c]^ެ��$^b���Q��Oda�nhuiRE�S�G�\���Hd��[=���J�j;w�1�uZOD���I)�� ��cS����6�'��U; ��F@sz����3C|'��d%sA0����J[��O��Y����i~$Kq@�]i���#ߐ-�� ������B��nݬ�}x��b���g���-�e�TM��Uh{��qs~��GG���J`�n4����_�|2�ܒ�w5���"�Z܉ ���7�35�i���Q*k�Ñ�s�{���/0@�������=I�EY2r��j`����H(��p�i�ӽf���YŌ�M~3�/K��u�f�dFS ��>|1���y���<�N��i�,Mb�l���+���¾v��ѣ6�Nɮi��A�Z��KɆ���s鴎�A�zIq���/��FN �u��@��b�&��2�&�E�4�'��W�����hG_o�}e�nCp̔�ݩ�|��Z;)��O}[�YS1Ø v|�[6'.�/���M����U�H�R�dN��������K �[����r��@����D�a���&ù���T�^0qm�{P&f�ȟ�o���}N�I��?MVaU�+�����r����v ���~� Jϥ�"���G��<s���f�9i�F�����&�>s?:@�~�:�T<�����6��&���K�/=�K4J�vc�{gѻ���}���c���G���o �w�� ��@�=���O|��Plᙎq��j!*�f�D�v{������bO}�[j>����B���aC��_R/�o<�cӖb�w+N���i+������!:�� �; ﲹE���R�� S���ua�����I�6*(A���~�1>1P��Q� ӏbO�d{�w�s-���,��͛G��j�)}'١�|4e��zuwc�.��儌��xtwk��@1��������ҍ�ֻB�{6k�J�����5N��HE����$�r��#��cz�x� �e�;��{�*BK ��8K����^!2�d ԩ�ZҰ�����%h�ޖ�*�{�$�b3�s�;g�@��]��A���ê~&L���,�r�� O� �I���<����d'>�2[��9���Q}F��Y�a���o� }xc�����!#�˰��E���=G4t�?J78�O��m�U��Mk+�O�9/��ˏ�Ǯ�R��d���� f���T�^Z%(��MI��XyKD/C�������:i}�K�ߜ �>�@W<kn�=4�7^e&����W����L����q(%B��$ U��?m[���C�'����Ø2�~a~�tK�~�D��/hU���şΘE 3���h�U��l�0F����?����ڽeq^��!�4�̽m��"�����@��=������{��X~���Vv��㉖��`����<��x�H`��°�d%.6aJ^?�C��G �E_�,�jʢ�oh����%E������4<�nPF���<š�O��{��"|���n<X�,�rrC�����xh����1�8��<��^�R�mxq�@et8���q�EŤ���x��=m�|���w6�+��pEpS� n���X/���8��d)&N3o�M�v��n(���݃���b��!z��_����9�Z�B�EO#\;��*�[m*Z�or��+&h@~^Y���e�>n���K"2/������nJ��<�ݳa�φE8e���.�����EP�\���=�ݮj�g1?b�,`����D�+,�� B��U=j����n�d,�h�R��4ŀ���l=�hbk�j5�E��#���!�6^�aNaF��κ�f�N0 ��J5�"��|�m���|-`b�[J=���� � �W�u�P�T�!�_v(��a��/��/?͜g4��Ʋ^��@/�֟(XX"A(�f;�'@h���Ĭvgv�����g!� +��_�O��J�n�t a:ke����٧����v�p�S�ҳ+Okď��}�=�(O�2M+�8Lb�s�\G(��5�3c5\� D�x�s½$���������� ���$�Y�$����BH�{xl�t�=���+���țSL'�#�,�����
Static task
static1
Behavioral task
behavioral1
Sample
26a4971c8cb01d22274b4f455e9c90bd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
26a4971c8cb01d22274b4f455e9c90bd.exe
Resource
win10v2004-20231215-en
General
-
Target
26a4971c8cb01d22274b4f455e9c90bd
-
Size
5.0MB
-
MD5
26a4971c8cb01d22274b4f455e9c90bd
-
SHA1
afbb1de666ce52c1289b530ba115371c8f6631d8
-
SHA256
cfa0dc95d597b93e7325c4757876b981dd51439736d8ecb1a390adb20b34e8ac
-
SHA512
882a13406e79e395e35e7535395bd30994a6fbece4ed1fb56c2620ea3df99c2e92d3b4d57abbb459981be21bd18763951006a3a6cd43e4f5c16d5a3df33cc0de
-
SSDEEP
98304:KgvARodJPJP62PuUUPquwwneFOZc0ishTkzcL+huaOOxZaILFspfw+5WMwLY/:KqAyJPJCC7IewneF2FahuaO8ZaILFspR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26a4971c8cb01d22274b4f455e9c90bd
Files
-
26a4971c8cb01d22274b4f455e9c90bd.exe windows:6 windows x64 arch:x64
dcbc4378b97df23cd8aa567c9b884fac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
winmm
PlaySoundA
comdlg32
GetOpenFileNameA
kernel32
Process32First
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MapVirtualKeyW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
shell32
ShellExecuteA
ole32
CoSetProxyBlanket
oleaut32
SysAllocString
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
imm32
ImmSetCompositionWindow
ntdll
RtlVirtualUnwind
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-environment-l1-1-0
getenv
ws2_32
htons
wldap32
ord41
crypt32
CertCloseStore
normaliz
IdnToAscii
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 675KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 395KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ird0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ird1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 921B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ