\���Ɋ��BH��pb6���dp:C��U|ZL���%�ث�����Q�J���?|VX!��|7g��TK�a�K��ۍj�m�~����p��� �֯^��PBh᛫y�����F� j"yL���i���5ZdJ�:fM��������3���ͨ��;a�����ӌ7U�6sX[ֽ'��� 9���4�^9��"2�P�a4U����е�o.|� � ��<9�}$D��Gb���x��@��sA�O��B���'^�q�� �)�bFt�ug�V��1�b۳b���F���_ϋtM��r@=��y�*��E��t��#��%du�*�07�f�R���<?|V�^��瘩BćV�%(���R��>�$M�~x���P��,���_Nyq�=�?�`���v﨔2.�&.�_�F��o1ڭ%��J"�zgw��(%�BЊ�a�k�|� �5��@�KQ�����i��Ce>�M���>����+Za� ����ө���:���4����I]�[V�`���������Q�߲v+��$uZ�4�#�e:#,R� �^�bmq`�5�Q��n��+q���l���:�������^��g�g���v+$"��q�8� 4g�b�X?�jx.��2�Cf,` �� �I�o[5�G��'r�ri>��-Օ`ςN�vN9��XDԷ�s`�gzHj8bhZ|����#������~�|)��a�S�D����6�ML$v�����r ��1�����5�xy��1���״@J�6Zh����k��JF��:Ec���>�R�%���[ **�k�R�.�� �y��p�#Ht��2砝P�'��z�ޜ�y� ;���qQ'��!k�k=�̂��0{+ʓ����i�V����U�/>�%�ڧ �������N�;��ğ-%&F��)��Щq;�E4�q�>9}6��o_�~("I� ��h���a�2��B&�_4�aqJ���n���_[�qq#�����G��|��������e��q�=���;���yÉ� h/���u=������Z�9@Cs�r�,MS�Gaf�1}3H����, �'1 5��Z�pB��^��Ȣo~�U;���kk�g�k~�_Qcx�IM���a(� a��������Vڮ��F�V������$gsbnU|'> &���j��1 ��F��Ap�f�#߯��U�[�KS�������| �M-������54���,.�sf7�4�wM����i����xظ�3sE��#"]V�܄:��vh�W��K=f>2~XT1cl���\�_8�V,�d'J�������Dy6�ԣm��ڢ �V�^?T#h�Ƅ��b"ֳ�AК��}�K��i��y����io6}�r����x���Ƥ��5f��X96@�T-5�^�G��F���M���ܚ�~ �(>��%����Y�#���b�?MEVW�D�#�7��#�Y��W�G@r9'�7+þ]� �tې��`����fs����G:�0�*0�G�]J⣐ (���9�n��|J�p]wV�e�@NoR+W�ޛ��Nq��ť#;8X=^����� 薫��.��J���m-�0�������Z e�7l1˱�k�J�[����� �;�fc�c�64PF��^�х�K��s�9�3�j�\��})ǔ��J�T�?��Ғ�W�u��B�,����')Q�����nKgޝ � Č���RDb8����>�M(��mVA� ��[Aw���~�SV�|���g��7 ��O�%r��J��c��7�Q�dz1��7�F��,��kd�١uh4�·�QOaf�&�*�%�Tj����34�D����]�ޞ��Y�F���2]�-��[��I�Q�yb��i?�e���Ƀ�/�ŝh��r�����@�Zv�c I˺�j6KB��}���W�8X�����SÙr+���%np���SJ䗿�Qz�8������H���ԕ�q{�$�����$sS"#���4��J2�1� �nJ�@���/uH���q�����/�U_��!�eK��m�6�_�������Ţ�D<�� 3��B��2�w/�;�?&������Ƒ!���/�5n�����{�*�U�{K��G^��i�Z�-IP/c gQ�.�$]tL����?�h�ud�j b��+ ���;*��br�����B�$�㚆{�'I�-`���zB��I���9�Q`~��b���c`����T:�=>���u�?8���Ð��f���㏾��bϠ�b���xN���{��nf�O��������+��w�tg�������l`nO�1��Sz��b�T�Җ�0�lxٙ(�:p���;n��_�� 6�o�$i!����<;���W�F�����C4v����������8�?�4E�QKzx��3<h�,MNu1S�R����QF������)�����X���@�m6�o���2��7��䁸{ e�U�Pߞ�Yw�\_X �������ՙp�������\�Xki�2T�Z^�Yb�SĜl3B�{v�J�d�-&�=��W�P&?*����=�r��8�������Z{k1*v�=��ϝwĝ+h�2e.�#D�V��t�JLfx��ՈxТ��`��1ĉ�������r���%F�r�Do��8V(˅�.u���2[W���kԅ���� n��`|n�O�Y���{=+3��lp��eS�}\.03��6dCk`�iMIz� g!s�|o�^k������in�������V(��V�oo`���"��ty����1T������.��~jwnp�JJ����Rd��BM#ڠ�DV��OhTkfm2E[�*?{_m�����{��I`n6�D���6{R���%Ӛ���y�T/����h6_���EWSY�'�V��c7�5�'�!�\w�`����J���9u�Q�2>e�XR+���W�><�e� *NV�}X֯ϯ͗z���M��C�� ^��a�dYK����l�ۻ]����(*�x���[����)���(FS�����??e����!�؝i��O&��LW����s��g@!f2��Г�WHֽ^�=�%��#� _�4��c)7�h��Ӄ"Ձ��g�#
Static task
static1
Behavioral task
behavioral1
Sample
20cb47c63afe21846c9a53b18aac723fc93dacb049556c1d67b1b71da440f76a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
20cb47c63afe21846c9a53b18aac723fc93dacb049556c1d67b1b71da440f76a.exe
Resource
win10v2004-20231215-en
General
-
Target
20cb47c63afe21846c9a53b18aac723fc93dacb049556c1d67b1b71da440f76a
-
Size
6.0MB
-
MD5
f31bcb004488f64a692d0dceacf0a076
-
SHA1
b8b658b702316465dd10c9b0fbaaecf35fe8f105
-
SHA256
20cb47c63afe21846c9a53b18aac723fc93dacb049556c1d67b1b71da440f76a
-
SHA512
5438dee351bc1b401d60a6d64fdd60e399dcc98ff649b428c12b80e46dd15694a8298b7cf7e438bd13df3c811542b17f517e754a3486b1a25654d9babd34178e
-
SSDEEP
98304:ruR1Fd0kF4xc+S38OLCBFXwuEPDB64REOgMRCz/TF9r6rW0Ezb43:ruR1Fd4ijL0XwuEPS0GF2/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20cb47c63afe21846c9a53b18aac723fc93dacb049556c1d67b1b71da440f76a
Files
-
20cb47c63afe21846c9a53b18aac723fc93dacb049556c1d67b1b71da440f76a.exe windows:6 windows x86 arch:x86
94ba9a606bb66f07025e0b890312e1a0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DecodePointer
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sgwe0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sgwe1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ