Q�Z{Q��0.7��h��F�xWg�N,?�1E��D�����iK�5����J�n��g?�P��@�JW�����v�� c���������;&��*�mRr���D�ퟵq�<J%��p�[Hfl�j2^PY�̪k��|��NG��\ZZ �Lw7>tS6�;�Q�ݗ�g������$�mc����W�4H&�#�?����m��R�hiSoq|�����ۣ�t*g� Y�m�¡�� Y��Y��X���� �����9�ej�(�5#��r,����������=H�+���d���);l����h����@�ˁ$֍͝k5%�ѹ�K�����x��z���% �U��Y8�P�i�E��G��|� R�-*�o�g`��DX����ɟb4�t n��^y�����_�H �PP�$��J�]������߽���T�T��3���R��QyV�6�� �$"$�vhkw�� Ux�EYB('�\��xOjEKNG� @w�����~J� ��)jN����B��Q#B�o����n�����Մ�*���;��2���U*>K���P��m�q�h�M��T��D�����fc��'ʤv��]�ʆ0�a]����"�SZ� _\�+�}�YgWф���# ���x�8�F�����`�}�zg�/Qr��RCq2�F+Ã�?%�����ee��˕g���>�PlL}�^Ƣ#��Of��W֏�_Xh(E��%]��JM�C�K� ��ܖ8����6��c4rNA�\�R�Vw����f¥���ofI���@�]ֽ�LtC�}���ٿ)ժ!6�k=��E����c^�B8jM�Ì����7�́�� ���QH}�E�h4yH*V��G��L�nk#�;� �o>��,�d�e>�x�AF��E�g}��Yry ��WCr\�NF�i�m���c\y�[��C1x�؏��e�>����]*�ڐ�&�n�=�@"�"N�/ҏ0���k������7K�C>�*�HBo��ć��@#dɨ���B��L�0��2\��z�>C��P9g��R�P.��q땂X��M�� <}�' `�U�y�9���EXy�5�)��/V��_���9�o�hR���=4G0mz���:$�(1-DC��;C&���t��j�Vh:��F��$��1�z#UB�tw=d|m8)����|���W��#����_� �7���݉�!E��_�R�@��u�Zl}����4�m'I��7�DK�s&誽K1-ږ] s����4��#�wM����>N�(�z��N��NT-p[n�<1>�<Q��0t�\�Y��tዦ�%=F���l������r��T�7���d�d�iJ��6e�(�xL��s�0?�:���'$����ׅ�Y��A0/-�f�J:���OjY��:w���Qop�fNl�XC@��~�Z�9+�q]o�%����AԸ���|9��>�B2��Zl��r,�����?o�����]�=�/��SaC�=�П� �:�;��X__Ǔ�c[~�D�Y��3 ��`�A�D9ż��Fw����1�m�o��u(�0��鴓��u�Lm]���)�/� ��h������ ���K�m����!�R�Ē���z��I��}&�&A�;%H�AIz���b�ˇ S�Z7j�r�ы(4��s�+�P�V?(�c��F��q̤n1}3��!��z{U����ߚ[�l�ZI��ㆰ��d�th�d���1�������p��,ݹ�}&��j��5\ރ�*OQ؞���?��v��N�$v{@�m|���m��q~��������ԧ��"�%�w��~��5�'8��<��Jp�TP*�6�?�خ0�?61�B�^�����D2�]��T�� �C���f�Q�l5j�e�H��|����5E���<?;��1=�8%���db�pr�1B�u����XЧ�d',X�Xj�aO)_�/����O���Y��1�Z)G���"��B�9���:F�\/l���>��H��� �Ek���M%�� ���M5b˗G>JL�nfu���orj(��ъ���Y�Yթx��#�X�����6� )�k�����R��AG�A�=����܀iq��i�(��~����-�������#t������ⅾQ��F#���Q��@�ǫ�9��R���%[=\���$�Dxr�īrh͊��^�:��5_]�`\�i�[�f�� %1��r��`���U��`��Cc �r��ݍ&[{�W.�P�����rG�|��k��w ^5}����LUk� "N�]y.�.\�گ��\���3rI�sPKjJsd? ��H[��8����ɥ�*BW�L�����C���款�IG 3h���1~�}ixc�I8�W��.�<�|��Mם-�iq �Qt/hT���Qz���z�/���7�����,���9��W��:����ڭt� ��r��;�%��p|̴F͂��L�k�;�^�:M5 �`�ݛd�c �T������wa��xy�íZ"�=��:P�e����� w��3��l�&�h��.c�t.�΅��l��yE�r��� w�{�ftP((� ��I3��r�Y����y����!^*[R�<��(��NP�q6��:$�AD��V�U�`m������e�����,�KG����a� �����HO3)���@!�J��k��8K�����n�\��t~��:��!F�HR����[�U��0��2\��ܨ�����φO���Z1��Eq!��ĞB�d7Bb��ɻI����{N�H�����4F�E}��Y��\TH�Z���p����A���A�*�32|_����A�ޕ:��nNPK�i@�/lG��9s��r�I�c��e Z�� ��A�(�t�zU��jF��S���H�2[���ʺkry��e7}��`+��%�:���.�TE�դb� ���F���L�$� I~7~&~~<�³��O�d:<d~t�}��U��=�~9�s5��z/$�|�[��,�v��p���9]�sPO�ES�]��a��VAH�4��L��=�Y¹�������\�Qaz�7���Q�*�>
Static task
static1
Behavioral task
behavioral1
Sample
5413d560b70f10ebb3fe0a36eca14a36.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5413d560b70f10ebb3fe0a36eca14a36.exe
Resource
win10v2004-20231215-en
General
-
Target
5413d560b70f10ebb3fe0a36eca14a36
-
Size
2.7MB
-
MD5
5413d560b70f10ebb3fe0a36eca14a36
-
SHA1
659f2c3513d749945f8585646a89cfbee69c19d5
-
SHA256
ea1e7bb923ee5942c3012a3703b80d6ac84a14d711ad2c0804d4a51398b1bfbc
-
SHA512
615a9fb1b688651a163568773dd99027dba98ac9dab08845eccb08ea712630114088e4290e7045e6df0d74732036a41a2e020cd3c8aad3b28376ece626a71b6a
-
SSDEEP
49152:rCQjnUKRw3cQPSM9EREqUVoGSVR0zgYjUAICcgBwx3LBsfukAG:s3cQ6M9kEVVopVR0HjtICcgs3LBuuk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5413d560b70f10ebb3fe0a36eca14a36
Files
-
5413d560b70f10ebb3fe0a36eca14a36.exe windows:6 windows x64 arch:x64
d305a0df61fc54f839130a72d23ab6a8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
DeviceIoControl
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendMessageA
CharUpperBuffW
advapi32
IsValidSid
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
winhttp
WinHttpCloseHandle
ntdll
RtlAdjustPrivilege
d3d9
Direct3DCreate9Ex
imm32
ImmGetContext
vcruntime140
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 701KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.EasyAnt Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.EasyAnt Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ