�v~�/�&U铩�LjM��߄[��OƳT{`og(߯��b����% }5(;Iz{�|=�E>Z�j �jB�u��R�6}(����E����O���!ץ��N��<"������r��qW������Ŝm64ϧ��rBz�P�n�;G�@����iE���ޥ��� ���åH^�[<��W�w����aIz6�{Mw�Z�L�%�DZ���7K"�w 8�s*�φ^�߀cy �^��-tY�ҁM4���2ȧ�i!|P�7^�i|�;����c����U�G4��(��Q7Yl%˻�h{2`2v�݁�T/��;���v2�$��mM�g�%5�W.>�c�A�w��65�y�{��K(��Ѯ� +������Mf6'� �F�bZP4aB���ۃI�0F��8y���Mő�!PŅ�2SB}𨁔��n{*�n���?#�1�mo��h��}� B >�������� ��J�W3K��%��__�k��<�^)��~��d�Bߐ�L G'��D+W��˦I�����?�����FΏ>�(/ �µ��^��(�f����N̥�N{���7&۴��xM�&�3h{��CMV�8�|�|�0Og�7zg��G�)���J*2ube���b��=;=�9�����ܮ:�Ob�f5>�ٔ����'�0&B�w�;�7�bH@����udDO������/��-�R#������쭠�Z�\>LDq|�7��Yv%���4�p��W^��ۻB$.��`�C)u6L{��$(�J��]n�e�b�=2H��xFH7w�Rí�� {i|Tճ���*�4�$4'�m�����gE�/�_�:�z�v����.��� u!���Wv.��c�t��ǚ,�P��2DR��N��m�?���~����m��=v��~�[z����q����X��=��q�� ��O��l�;n�`����$;H:($sB7���y��'¢�j.|�)`�%���Ŵ �6�9�N�Qz�&��6����cc�����b�֓��#����h*qz��ϼ�l�El����X[y[9�&�i�_r��Fwi�n8�P`V��ٯ��fkxcn�U��N{H���y�h�ȕwG�~��M�� /٘~�e5� h��#�y��a��.@�K$�#�WA¸[,aO�V��B��eJt'/��k�K�"F�$4�8�,Ա*������CoB���t���|_���[�-��cy�Q�1_^�a��@ ���|��M�����Bsc�� ��Nf|��R<��T�;*��֭�*��LN� ���̓�M#����.��O�y'�)�=*����h����]��P!�א�b�pQ��}ՠY�n�˴ec��߉�]D��\�W��>q.b�m�0�ϸkβ&H w���Ӊ������L����t��P_i?ֿǩ�1�u[N����*�g���%�a{ލ����VYml���8i�o(Z��S��d�إ�j�%P��(Zc��\1R+�2GA28���Y���d���$�|пkΝ��%k�!�F��+��w���(H @�:��K8u\���;���k!�QY�෮LX�����>�&S��/��yYY:b7��#�p��I��d:�E�ڞ����K�����A{Y��{��BR] GN��,����<-��oc{���1��>�B0�� +D���pؚŎ<��\���K��-��T��Ϭ�R�����=����?������]�#K�Kh���*�����DN��������54�<��G,�X���T�+��@����B8��J�^1��Kd%�L�w�~z-� � � �Jwa%��?/ґ�a�~�&pU�E����p���ӿ5�4D���D�Yx� /�Vӊ� �R��4ln���R�n?Oyy��ܻ 㮕�k�[��*��ޓ�ۡ�N�"#�?ow���ˊ1,�܁h)۞]��7Z˲&�6 ���Ѷ'eI��Tm4l:J��=$�/�[�^��������4 L5:���b���u;�:� :�nQFhr�SK�+�h�aqP¿�~@]�Acv q{��zs�Wl�uu���s��nH�������*%e�"`7��ce��k���N�����i��v"�܌�;H��ϚJNݡe���a�+�$v��f;����D��2DK]��+j� �m��>-ٳ��7��{@No҉Z�J5m7�`>�F��K,�=�i.ퟫ~N�xh��2���Ɩf��������#a�X�f�[s\�~҃�y��u��FY��Z���l�I"����\:�2�ٍ����A���)K*�V��U�� ;M���"6*�F��t���˘�y���Q���Z>l ֬���hԕ>�f�Ļ����-�/��< �C����u��絁�y��,`KÄ�D �Qsr��2[���V%gcЊ�f��W�c {P�`�B�����X㉖K�wh�e�Z����8�#!.{gS@tr5H��w��ל�Ӌ��V��pKE)5�5�B8|���I�B'�,MHjovb�Yb�r�� ���2� x�ނ:��d���� I L�)��=�*��"��LA�и'�C��Y�����n�_��������H�67�tE���ť u~�M�y�$�Ѐ�H�%���a3���记?j�EXK�d%z~�a-�[�w=���E���G�H�/�����yK�u1Wb����9/�@V�u� �(B�Q�H���lߘ 'l���[�J T��#G����F�����AV�����\6nnA�X�u��iS$g���۽��B�A� 0O�������]F��#r �s�[d��ð�1y^�:0��cL�z��>i3���#"M}����I�%������U!E���.�����ԟQ���c c'�����U�z��A�3��/R���l���a7�Q�)�����t�Mz�R�J��ʙ�5 P�B�����Q7lO$c�� ��BQ���E.n��kTu�W�H�1����˂��)X��� ٌ>�Jn&����l,?!����$B���Q�ӬSA ���cU�;���r�4��l�����������!IF��xT��e�+g\S �cwe� 7
Static task
static1
Behavioral task
behavioral1
Sample
578d9df4be814f4a361ed6fd665c0fc9.exe
Resource
win7-20231215-en
General
-
Target
578d9df4be814f4a361ed6fd665c0fc9
-
Size
6.3MB
-
MD5
578d9df4be814f4a361ed6fd665c0fc9
-
SHA1
f6996c6d74b0406de4b004c253627913bb3653a5
-
SHA256
114ba2c2a6367115a4a86486e34afe6eae406a23d9005af5115610887b8c8bce
-
SHA512
285142320a34e2582442756c72289d578ed69b188df6ab6e3bceb8eac589cb81eea6a1647d8c5f030bf3d3fbabfa817403c3d74603a48197a199d6a4d74ab97e
-
SSDEEP
196608:h88F81wdrVwvVsf2h5PBQZ2eiQpo5THrrB:PF81iO2f6BQxiQCprr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 578d9df4be814f4a361ed6fd665c0fc9
Files
-
578d9df4be814f4a361ed6fd665c0fc9.exe windows:6 windows x64 arch:x64
25dda2db45c169fd91626a5db407a3c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAStartup
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertFreeCertificateContext
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetSpecialFolderPathA
advapi32
OpenProcessToken
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
bcrypt
BCryptGenRandom
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-math-l1-1-0
nan
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-utility-l1-1-0
_byteswap_uint64
api-ms-win-crt-filesystem-l1-1-0
_mkdir
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_SHA3_25 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vpm0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vpm1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ