ק%���UU����o��$��ի���1/O���D��l��|D����N5E "ғ�����{��NO<������T��6�g 9*��S8zO����GMY.)��D�T]�N���2��}=SOR֥U��e1c����>6-]7�@<"ܹƑt��-�{�k4��M9阬��W�"!Y�ٽ5�b��B���\�"�[ ���.F�P*��K���a㩿����O���6\d�#蜆/P�Ht�h�;�m�盌�� ͝�`3~��@�TR������7��$}%����� ���K�����^�c4�&�iG.������6E��Pfxyqu�fnh%J�9�jBD�$�Hc�|%?|�e�~q{CXE솸�D����$9B�%�C��j��:�dzj@��^�~��9`������wupd�9[��J�,B��p3�-�* 7�F*��hX÷�:�gd~��KR�e�wZ+RG?�=�]�n�{�?���I��E������_]D�4�b}lH��4R������ߔ�&��r|$���J ��A�S�Y� �+fe��B�*@X��N��J������!�G7�{X�<�T��:U�����$��Mz��!M��kz�Cy����y(\"=�vҺ�#�<���עz�I0w������������u�M`\8����:�Y4p�� {s;��Y��#"�@{m%(UR�m��w��`��� E�4s�ԗ�(�v�71H��+I@܄xo+���h.$��:���-��/�m��ņs�!�s�s��j`���M�ұY�Le�E��ԞI�z$���Z��|.+cxw��Cq���w��'A�3?N�����r�[5"���Tj �x(y�G�|̧3�)�����ٗ���$A'K�Xy2V�W���7�}W��0��a� P]��<%��G�9��d�e��ߠ�� g��7У'�q�#���.�������١����a���#S�'1W�m"/�if���_1o�|�����B����g��Ryt@�y7�~N���a��0j�HL6IY�`L�$[��ڬ'�-��d�a }� ��'U>뭹ϡ��'�u��ֲ���n��n�p��5)�9~�,�KC��j"�=�{����-;�+�w��L0�f��sN\��o���+�۷� �Q���<Q��6)dž1�&������<��8��"1�L�g��E�5�ͦA4-J�d�p��^�N�E�t���Q�)2o�����M�+�[�:?s��;]d"g�^���iu��k�-��_�&[O? [�V�-I����8����+șj,�t�0�2���iԦ��j;��=�ADk0��*���3��|���f��t������4D��j� CU�-��0�X-��~Q��/��a���o�����5�RΝڡ�ۄ�P����B����C�;ɫ��l�(�3T�.�����ѳ#sE��B� �R��V�yi��D˚&��m�p�"r2h�L)�gŦ���f9h���*Es�J2(���Po��s���Mz��]�-�C�0�W�汧�5=j��\�2�i3x��ǖv�{|R�H��̳���X�M}ƴ@����ݔ�7{�1&Gvν�<Zp��:P�w>�L�����is F{�<�.'��]~9�������+'@e� -��N]��bݐ0���ɑD�|=�A��7����R=����j�m�ڈ"����Bd�r��Ps���q$����۴�Y{�&��(�8�z�z��؎i�ۃM��Y�"��H�I��,5@{���9 ���8� �9pO��.���6>&_�!���`�D%�L���?��8:�(d��o9�B�WP��Sn��v�@�z�t�����*g��M��������Vq���=���n�3�L �<I�����JB|JufڧiW'H\� !$N��\�O2B��G*�j�i��6PV,]��'X�}7��z4����yߓ�y������ɖ~�%χ���"ۃ��$�ȕ~��Uf4�W���ʁNJ��\��N�ɷ��3��>w����r�O�<u0������n~*�A�}��˔qy�6��H�Q�v״Z4��H��{f��w���hC��" k?_��~�rC��s8l_VK�i_�fN#m+���Ӎ����4(�m4)�ZG�����Pz���m�q{�)�j\�nV�G���A� ��n(�wq�e;�2�!le�!�r㉹�^�x�t�h�2E;�g��r^MB� T.%,J)ۓw�����^�x��r:��ɞIƜاBr� ?+t���61��2�ּ�FG)��K��"V��JڴE0} �����D�pFfg6�`DMW�����x��\�������>e�ݛvIםZt,�=/��R��*(U)�'���)��BJ�Xg���g�z�ʻ~��H����y�=L����X���b?�����������=z�`��~0�����.�`*y�A�+���[W���L>��5֥�+�Y��V����%D ��"�� �e�e0���<>�A�Z���ᄥշ����5���S��b��i�*�JGE�v)�P����i��1�-������b�J^���M͙�&La<~Q�E��ζ�n ��2��3�j�������ǘ��Y�y��B-�o����\ JD De�Oj��j-�8�*���KP�$�����KGg�4繿B 9q$���8�<u;�^+�E�=٩ ��"^�;gw�7n9��1�WC���5>�����(`��:"r���A�ƨ��r�-A)��2z�^��S���(��4fk����{�o���5{S?�����'n<���_�I���dd(�2ʞ�!��܍���k��X�k�)�a�.Թ�9}�(�8x?��m�ھk��,�wܥÊ0S��%7@�_P�CNY�:�@=�v/Z�Ǔ��ʐ����o7{,��܋w�F�*�R>qCqḡ�,�M~�M4���Nzb Ck�̮��c>YK��i�S)4�ah1�a��x^T��'{����<D�X�<�f�V�o����^�����������L��*��EZ ���-�-�+���S*_��n�U�t�m��Z�
Static task
static1
Behavioral task
behavioral1
Sample
49beb73557e9ec2bb45aba4b8a3cde11.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
49beb73557e9ec2bb45aba4b8a3cde11.exe
Resource
win10v2004-20231215-en
General
-
Target
49beb73557e9ec2bb45aba4b8a3cde11
-
Size
3.2MB
-
MD5
49beb73557e9ec2bb45aba4b8a3cde11
-
SHA1
f89bd061a4a5398f6a9088986dfce75c23b17589
-
SHA256
4bd76e26318a1f776fcb833dc607b18fa3c1c7fbebabcb4f3f678b429aee70f0
-
SHA512
c5e6161edb220efbc4517540a052c048e4e9f4d9376dfc6f65a60c2fd0afe68f3f88d5058242e9543747df20016b5dea9268c92322dec1d25f36172edd0df47f
-
SSDEEP
49152:vn+9MibFVh1EasF68UdW4JL9Jv4HW7O7PAI42xZtCmHlWTmU9B0ak2NSH:3ipVh1j+uW4hoHW7AAq3UmHlcBX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49beb73557e9ec2bb45aba4b8a3cde11
Files
-
49beb73557e9ec2bb45aba4b8a3cde11.exe windows:6 windows x64 arch:x64
cbce29ee8871adb41e9092f97ab30681
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCapture
CharUpperBuffW
advapi32
CryptReleaseContext
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHGetSpecialFolderPathA
wininet
HttpOpenRequestA
ntdll
RtlVirtualUnwind
imm32
ImmSetCompositionWindow
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
urlmon
URLDownloadToFileA
ws2_32
inet_ntoa
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 749KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 217KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ