U�z�h���g^4�����d$�L����QBi'FW����42>��:���N�A�h����{�ۋ�Ww���Di�[�g���|@(����=?,mx���c��� ����h�,zzs\SVR�ngq+�<}e��/Q���fQvm�G�I1-ȋ��.)�zj�5��X�/]hT������4E ���l�C�0B=��@�V��)�����S� #�)�])f#%-w���}��]��"�f����6I��e�z����>� �>d�|�3Q����P.؊%�y�~�i�蠼MoSb��\X�ų��3\�J<��T�>lF�����w�\2�/���eds������1 ��8�uU��"L�d��"�n��K����A^�~��Ȃ�d�56�Ԇ� �=�q�߷�'<-i�{�bE=k���%y)Md���o6;�,�S �:� g^�7u�I@���*. �rq��NF�G��������n��W�T�r+OQ�l+Z��r�,+������@��Kc�P�a��c���؊.K0z�y��S��+����~qM��FR�0F��t>ge�����~R89���Kc���o��{�n���ِ��쵝�?��v?��'������+��h�Қ*f���E����Bf�k+��؟�wX n)�$��s[z3J��aq"�(�!�%�+��+Mx� �B|�Btg���$M�W ��uy�J��M>���h"�j��=4B�Z��5G�R�O��dm�� �{`Ƈ��G����n�@SM0��#\ �K�b��U��U����ˆ�SW��������0�8v̅-?�Y����HN��i��4��e@ʇ�A�藐��=�������V�}Z��M�5��0�wH��|/Փ�cq:�8x@�P��9i*�i4��@o|����N�J�,�Dַ;�,|r ��&��&��^�6�3�O�ɸ {�X!��'�<0` F"�B��U���|y� ���]��o�DE�a�yY�d�G���M٧����n�}��k[I�#�a�e^���!�omͿ)|�V��H����'�������x$�� �ȗ;�ѯ��3J?��M_��� ����b*��.�7�D&���1����m;}�T{����8��=\��/���n�Ob�#w���nXI�K�/�YP6�ZM�����]'�h�x<�v(:<�{��)�r��� �{�R$��l��7w;f]���ԒEJ<|��e o���s�M��>g�"���e�A\��3����Q����:D�� 4Σ$ �s�BD�'��|�%e��x��-�gӗ)'���ޗJ0գjL/I�kk�!-��8�����C���êu}3iE�&��}X������ׁ�Y���d5����n��W��{�ިcX�9d���ugW%3h�QE�b0,x��zT����13+�����-֘�t����f�u<BI+VO�ތ���h�úa���n#.v�zH �.��(��AX-����'�8pV��O�e�����B���K�hS�8�I(��?��L�G��a����QB��R����2�� �`����,���z�#��s�JGS��^��"���{�U!"_|��g O�~���HH��E�������;u���_�����=2��I��9��8�u���,-�"��9[Ubv47�C��f�*��| ����!�>n���}iOU �'$s���\pc�a��,�n��V�V�A�u�f��nj)!�y5���'�1������b#�B2X��<�� 9](��<0��و����Z�Ab�|k��J��XJ9P xSv��VF�"�e���i����3���a�oP:h%:���b��[��a1�}u1���O���H��t[�>��sj�]��*^��2�������PI+p��~��/��Ɣ���� ����LL�&]�L����B �^�r�E�Z@p����%����ܡ��L|.�h�M����������Ww�������]D`+<��A�0�a���ʾ|91Fۻ&Gt>�M���t|w���"��b��ч*����s��U)Q����c��@VT�$;w�<�_�����ѻ >C*|E \<i�*�yOh�4��+����(�-�W���2v��}ku������ER ��g4���+�����j2�W<a� \���c�I"��E���*��V*��l��4����d�li�E6 �_A�^���j����)���%`97�+U���Oy��?t�Ce���]���c5y��=+4}<E�@K�7���cÉ`#b6��5Q¾*d�D4�Ə'$��Y��G*$4���}���+��![@j�6(�A�W��@`=�����g���e}�|��v�92�^n[��v���[����Ք�����O�t��|Z{�4�%9\�����PS�א�v��� �hC���{�-�a����P��m�W����6��qMn����� |!c*�D.�E�(�3��J�%M��[Ё��h�ԾG@�h�>�2�����?O��JTpI�`��-o����_���:-C��58���S����6����&u�i��ؾ�z�\t��nL��k��R�J�1���kN�R,�|{�E����O�Q�fj�Q�kڢ�+��'�YY�a���^�(�V�� +��L����҅���K�.�+7^!G�r���b}y�-���zKhgj��Ib�|u�X$s�1%�����W�YV���v<�P��Z��-J�����屃�"W����b��!\+<�ǸuA�\4W��S�� ��;T`f*^o��JڱP�1�z�z�'",�T#��&�X/�d_h� M�kF��b�y���%PoO?�G�� ����f<+�?� ��JN6�oɐ��Lh�s<��6>����o~���P*�w�UI,9c�I��Z�-� 8���v��Q��֛V�L�f11m"A�Qtba����0.�Rt��D_�r�7���G���h�f��-����GQҧ���n� ��x�F�5�����l=�Sf�B�kNԌ�驒� ͛�{�~�s�d���(����q gB���S�����䐿e7H 4p8{\m>���g�0�4�hC��꒪�{�>�"ku�פ
Static task
static1
Behavioral task
behavioral1
Sample
client.exe
Resource
win11-20231215-en
General
-
Target
client.exe
-
Size
4.3MB
-
MD5
3164551671b3ae3dba95f0e5b1ed5139
-
SHA1
66cfe4fd5a15afca4792d891a66b198d2ff4d97e
-
SHA256
dd3e760dcb5b3d96b7cae602f8c4d436cda6e314d4c1309e4d27471eed2a5cfd
-
SHA512
4392c5b6e60a7da92ea379e5f75cf61c49fda4de80c35ea9d039f08b1cfaa3c9466ad31482c9c4027b3e31493a6510f05a2d4b5012ab7f209e03a3697352e114
-
SSDEEP
98304:o5vth9xKIlDHK8sY6iwtlpID73TOnELX58AI8:IxKI5nL6i4n6HVXm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource client.exe
Files
-
client.exe.exe windows:4 windows x86 arch:x86
73666fb5979a067d2d5d1a7cee95c25a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetACP
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss0 Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss1 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss2 Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ