Oز���&{P��?�#:v�4i�-�o�h&���1�ݳO/7UC��E���C0��j��R�#į��R�]�9Kܓ(K�D�@�Jg�E7�Cܷ�*����а�����bxtS)��x/)үn >�EGd�����}�:H`���. �7GWN ���c�VWo�sG6i�6^)�a2��m7��6�0u�9�NI�&K������2�ѿw���7o��;���Վ8�].�۶!s�fv?��Ӊ���sN$�k�B~��V�'=�VM����]�Y��P�����\$ӌ�~��f�{xz)����e � t\K��=6aW�ƄQw����.���Y3���a���]��.7��8�.3�^G�����>Y!B��J�$S)\���?�D�i�R���������4��`�1˴U��bRG��ӥvj$�/�BK ��\]�1bh�gq V� ��S�I����U9�G]ijGF���?��d�K��"1u�� �GY~�ε5}6(�Z��-�)/8[����;fgl�����~�������/�����w��w��1���T�z�2�̾��%�j��,����N4h]Y��u�&�?�9�dW��c��U�u�U��n��gi����cQ�=~"T�»n����AǦ��S�d�V���g�nv��:H��g�()�nI��:�W��� ����?���݇���ʠ9����2��ME�m�4��;��,TCm�����1�h�]�+`��~��Bf#%�����E�%��`���ATl�px�������{�P����� �P!�8�X�̚3�hG�������En9�%���C��m�ܸu�1%�����4�]��~���D�[�/Y>� �#�U�ۧ�ݠaO��3Lҏ�ߘ���?Ne�d�dx;�f�X �:J���(��.��M�OS�Pډ���B,x�ۂ �a���3X܀JoR�N��诎���+�_q�q�g��c��v��������`���/�3Ve"�C�\p'm#�H��0@Ⅱbq� %���)`�[JoJy#ka���5��QG-Z _�AX��g������ou�� ҄qQ�������B5�念��bϚy���M�8�K�����q��� N�iϬh�������Ύ�� �Ft~���)��5Y��yO02��D�s1���N^Ϛ:�����Do���� S����k@>�G�w������Ő.�U���I�A :�G����uN0cP�Lrnfxfy���D9��I�[fiυ !��˒��S�xJ��!۲ב����d���{.�U�f�Z֨n�xE%9uN�.^Y��|�i!���&|��cKS�%͆0�3�.��I �@|�� ���&a�Y�œ8�-dcSUs@�o�Qw�����n`9���%���.��K��tO�j�����ЯB�h"�].�;H �j}�1T�!юL3��d�:8X81Bo%py*�� �b ��#�#��K�q� ��k��8\�a�Wen� �cx;�"�?���O��3&�tx�y��V!}XU=��/:��%����f��W�Suj���Clp�f9ڴr��:\�m�<g}��<�s&�� ���/�J�t��j�^JؿS�4�*������N�l7����|�"9TfȞ�u_����D2�O)2�t���N�Q�0}�GY�п�u_>�4 p��JM�#�ؿ�� Ǩ�ϫ�.{���QA;'�=���;>d�1������t�رs��H���q�5���}�4b���IBw�F�h�����ƿ���:T���]b�Z|�X�@t�n�9T*�RG��2Y��$gDk�b���9mH�I~�����3!t�pv�3������iaae�t!�^�z��|�$�u������pJ߅:���vo8��ݍgǜa�Q��s���^���zk[�>I�Q�`�뵲;c�y'����������_ss�2��P9�$��-�z�H#��1"�?�3�v ��J��3�\Ot���1��٩Th��8r+V��2�?T���6,�-Z�w֣���O0H�w�_�2�bv��S" 4~�o�0�$�[~�,M��xC�K��z���痴����A`F8s����4��KD�m�p�:�A�0�ɸ���+m�����V��"3~0�.�}�'�`��c�?J�l��7-Zɂ�Ѧ���%����65e��}���݁�5��WU�pJ'�9"�ej�cܘ�!��0�F�'�= ��<��L4���2B����(����J�mi�=?f$ �RN�Q���3�>'X���+�)c~�L 3״ɡA`�R8��yC���(Tm% �N�qښP�lAѨ�{���tʤ���_�J���҉��,��z_�ܵ�&G�۴(�˜:�CX{"�V� ��H�w��8�(� �U������/��$RW\`TT ��B\�V�n�<�ꍛ�X�o+ꜝ���r�_��q7_�,r�����4U�%(v�e��[X�z�� �L�~�����1g���#��MY�/�P��2���o�O|Q�Üc0�'\���B�du4<n��x,s�b�$C�G'�:���TD5��n,� ���FN~PK��}�����^�VX~� )�tB��L�z涑�d�5�K-4`BƔ�C/֚�����ٶ�`MߖL.����/u06bɲE��#rC���Q ��;����Zf�� uc���)<�S�v�$��� w��{������u���<���ca�C�m��N�����9 ��0GT[#����[�!* Z�O?l�z�9>�~%#��)i�?�L��ؒ* ����^O����"*L"������> ^�+�:H�T=�c�\������<T����a��� �|1$�j�oqۨ~c{BC�j��A�Dsrg����+��Ȥ��&G��e��|��B�y�!o����� J)�}d���֭Ón�Z0��|����f������ݩ�vw��Yw���*EHe+�m��JN��j�x�>�Y�C�q�>�gX�LY �Y%4u��~%+� S)01H�t,�sAg��״=�~A�:��v�n���V8x�9n�g�i�V.�]�0騑& �2]��<�U#l�
Static task
static1
Behavioral task
behavioral1
Sample
keygen.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
keygen.exe
Resource
win10v2004-20231215-en
General
-
Target
keygen.exe
-
Size
706KB
-
MD5
f4298599580215cf1af21da7d0e60834
-
SHA1
d8b1b873845a35c919237b93f72094ef4542b853
-
SHA256
f1bcd981a675f9a321e5c098c1f9c4744b290b0dcea9537354fdbffea181e43b
-
SHA512
48d3a39b148e165387917399ef3f4de5f7b0d7ec5d5b12f001665ee8b68071d7dbe94ebd4094dc7dd049d79ce58738bdfdb717c12d939df1cece16bc9261d281
-
SSDEEP
12288:1uWJx5pVyL2duMNDkY3Sv57aYATgfJalftjGgxT61Xm1gb4:JJbpVvRDNe5HATgf4lfggxelm8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource keygen.exe
Files
-
keygen.exe.exe windows:5 windows x86 arch:x86
b7bf9be654b96bc12d508dd520de1738
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageW
comctl32
ord17
Exports
Exports
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.RLD0 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.RLD1 Size: 426KB - Virtual size: 426KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RLD2 Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ