^�"��0R��>�ZtH��`�߀6� �6V4�n�D���\��l�4�l���"E�����@7I��8��%,J�r4���:w�Ph{}�W�RCc.�����l�$2����DK�8�\��*'�p�����q�ʛ����Y��c|ȑ'�s*f�QD;jL$�5Z�&���k�#&�[�L�K&�u;&Ou��g&!n���>����!��B�.�$ͮ����=è�h3L����6�SI��u�Cc;иV�$�v�xm\�S���T�w�:f�ޭz�� �?��O/6�2������G�r�2NO6�w?��9� �8P7�)LZ?7�q�_}px��4F�G{�T?��p��� _�3߲�������^�"�Ty��,?�����d�d`G7"k�ߟ�ռ��������yu�N`�?W�i�[��R5�7�!ڿ0�ͦ����̢pU;(9��4Yn�(ID�6�o*X{ah�4��]/�e.���E`�*>�0 *AO�)���z(�wG=` mۇ����|��(�e�A-}Kl�Q���qѿ�����Q"!m�{���4]�C����xV�����'�I��D~`�l>ɮg�(s9� _�� �˛�4/�X��@�<�O�(a4b�Y�},���O����������|#�0�ȷ��0�Ƥ>pT&�=鯁����o]HY�[�����j���k��s�D���y-���7������t�L�ʴ��G#�w�5^��Y �+ֻܽ� zG�(������M��j�?Ci�fq��!��Ǽ�uy,��ir� �5)'��1���e��zJ���1�#}N��)��,���j��=�*���~��dHj�/��έ����2����h Z����4��z��2=c�N���F�o���dw�Q-4��Z+y���0}N�;�(|���@九�����=r��-VQ��L �"��on��)B�\ ?�BT�yD�P�`求Ž0�&=͑@}�-^s9�}�Z����ri�v�����0[R���W'P�k0XN�j'\fIj�dVg�V� ���K\�l���n�wV]�%��֦�&s�*����D�<�~n�"� 1>?Cߘg[:���zw�q�~a?��P;�������y����s'����N��y�U��2�.�t��+le�����R�vtSư,K/��Y.�A�p���t��$��h�� �w�B� ���=I�t/�Ê��ѯ6d�J�uF�DO�$$��qr��ff�w��0Z��G�W)�D_�.C��� ���Χ���J�0��g:��[�t���4$���|�|���W��6��^�p�\;A����C>���E�����]�Q�bp� ���܂�����28k8��b��E1��0�P��E�֬����v�=]d̴�h/�U'MKOt��;%ͩ:�ufm�H��?���u��i��^���p �eyE��I��v)���ˎłA�f�o����D��� �� �5��S�E�L���Xv\t"��?�V��@B���]D\D ��MH��Ƶ��Ħ>9Է����3m���ì+���?aH���<���t��UQ��)�S�^��ڎ�MW8��bikA�����fW�H�m�qE� N����f��qW? L�_;G���Ҳb����!F::W_Y����aZ�Y �4����h����A���4%�!F �6�Q�?�J���g�+���gϟ��o-�4���p��s_Ţɴ�L�mU�!�6�� L��Aq����!}�<`0�-���c�|ʢ(Ø=P��Ϯ������ItP�����)TijS���1��^�hťҌ��ګ�Fj�ς�Ƀ9A�G�M{�1$8B���a�g���}R0b��������[��ϋ��HA��~��h�=�,�T��Pɻ��X�JC�KT`5K��S��t}��Z)�4)�� �v ��� K��eE���K���R̟k��Jbm��!p�av!�'��"��;VW��q�6>{/�:o�[p�Q}5���',�p��j��&P%���d�snKXZf&����m%�^�����l�=��j����Z�>9�s/���~�<���z��E�g�p�)��l���N/Ch�tB���!Di�2t$�����|l��:?Xc�OmG�xjho�i��q_+�10Kl�vq¦fTo_�G����O{;x���s�ć��� C��3�U�"�ӦBY� ʋ����G~X�`�/m(�*�K�Zm���A��H/�)�X=m�k�c�\��8Y�)qFQ�9s1��y���� U+��[��D$@� ���J.�pX}pQ�\����SiT�3��y�T8f�B����1��AE����$M�֯��e�B~@ZnL�l�_^t�փ��߳,W�B��n!�GR'�F�c�9;�W�uE'2P�H��7��!�V�&�L"�-��K�іA>I��Y��W�&_Ob)���7�U�d�?��H��2ߗ{��+�-�����"D�)_� �J�J��+`�g`)�=c���2�s�)�U�~u>��T�Sc5����`��_(;�=/��&���xS�(�K�����m��1�\Weنb\k �'(��b�#Y�&K�m'2���v`��TyI`���Q�沅l�J ���url1�y'(Zs�@���,~�G�0��� ЕYߊꉉt�'�l�8uq���Xv�� fzB3T����.cJ����dOYp�����/@�F���C�e�чY㌟7R�� �L|~����*����<��>����#�J�q�:D��hݶy��-�V�R.|�O_`>cN�q���R��?�h��㳐r��\G��8N��{���Lѕ�����⠘�Y�s�����,��R�0Eb&�L�&Z��P�'�j�[NG��'ʓ �CU��D������8�N{Z�eP�6��v"G��>Im�g���8��O9���� ���o��/[^��p���K�M���{{���.M�����*U�lB�Уh�F�fN� ��������`g��j�����'����g�rD����a!��Z暰����U�6�Tͨ����7-�C��n�h��[7�'���">~�(�H��I�
Static task
static1
Behavioral task
behavioral1
Sample
TY9FY6JQC8Y.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
TY9FY6JQC8Y.exe
Resource
win10v2004-20231215-en
General
-
Target
TY9FY6JQC8Y.exe
-
Size
10.7MB
-
MD5
a3f57c92b2e6d70f71c98b4ba67dc5a1
-
SHA1
359f76117b5b0b12ed26a6be41d24cb1a67e34ed
-
SHA256
3121edb9585e36ac7df2acb6c1e45df76d46a91cdb44dd8888bd6a49f0d7db3e
-
SHA512
2c287b4f9e96ce551236d32f1adc740622cc4ea0ca3aea06f97e301898080aac68a9ffa392e26badf67913f442efee3d8e7b00081c1d2972e22af75d3e00fd4a
-
SSDEEP
196608:0q2RFPuKRxBO5SV0lVee3P4Hc60K9ma3wUNIQ3D3XmRkfqEp:0qmFPuKZkS3kP6vX9D3XmT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TY9FY6JQC8Y.exe
Files
-
TY9FY6JQC8Y.exe.exe windows:6 windows x64 arch:x64
107a8f1e2081c5a59df002f37405ebbe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
ResumeThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowRect
CharUpperBuffW
gdi32
GetStockObject
advapi32
CopySid
imm32
ImmReleaseContext
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
ws2_32
WSAGetLastError
d3d9
Direct3DCreate9Ex
ntdll
NtMapViewOfSection
shlwapi
SHDeleteKeyW
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertEnumCertificatesInStore
rpcrt4
UuidCreate
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
sinf
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 940KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.s5( Size: - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.4:l Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c$o Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ