8U"x��$?�`�9�}� ��P��S�( j?+a�)��|��oA�U`j�G�����B�ipط�:��8����'����̙�qm�d\8��*��f����z��3�W��"M(��5U�֘��i+�0������� ��BcQ#:����R�ä�G����1�y�mvڼB1�tx�9Sn��H�^��G*�|�*;��ue�0;~��O��k�v�PT�& 8���6���P�.�g{Bd�����+_q�ӯ^���i��T#G�g$t��.�����ԃG��H�'���r '�+�*��*�MϾ�"� jH��9�5f%���e_���^���:���t��B�����&���M��1�x*=�_�ÍA��366��X���}���ꨭ�yX#� M秆~/��Į�Y.��f�x��/]"j+�ܟMָ� ���eS��\���݁�H�5�J���SSp8�����= �NA)F�Ku� 3r���}�x��u*fq�Hk��bt��]�8�Ơ��<�9VWl�L�R�/�X[|`��a��Uf$'��M�~p��_��Ժ7EH�o�]�&�C��� I�ns�5d�����J� �:��牯�М�%>+Wrm?�Tx��C���>7��Z�O��"wc�.T�����2g)��0�%��jN2��=��� p�r��;)�3��( wG�m�wJ\�������ь����B�8����d,Iv�yc������@J�o��+{�d�������גua�ҋ�@S�Sy�QP�C���2$���A�TJD N_L=wx1QU�S�5���L��Ǐ.�;վo���2.m����r��O�w�!�~[��Rj}p�O��F^.xx��c+�:*�~� �m��%g� ��Ax6�;��B�˛�������/�ݿu����2o��ZnI�zt���.�-:�.��`+k�v�h��[��Q|^$�TŮS2w���iL�q���bb�\ e�sM�6�uk���4�,7���M��)�ƶ�觙��1@,�c�F��h�O�~7��>�[n���������������ċЦ����fraB���*9�o��Z XUW��eX�%飾����}B�͎��g�5���"7��o;��5����Li��l��k��g�d|� -���r ^��kW\��q����A���v���Q�j���&���=�[�5�U@�ҘV0Q Oګ2`(�-,E����T�N% ؕ�� *�G�2����EÍ8��+�Z���0:����bR�&ی�4����J>�r���27�xeåV��Xfo�fE_q-ʶ�5�!����i� ��.��4���đ�XC�~﮻�.2:��Jt�|M}��� ҹ��Ӹ?�"��^:�cR���E��&���((�Ts�A�q�����L��mX�p")w�u�n;1k�m���C���15�]����z�[Q>�y�B=R��#V�թ�W�[�Y��v^8�x�v�"���eT�[�?6g����ʾ�״�Jm4|��ޚn=�&<[jK���A+��&2@��bͽ�R���X�S��LH�����^}*����W�j�Y�0��י��kt�<�Rd�����]�f�S( |nU��M�xԾ/������ʗ�>�}0q�����N�s�s-�>E�t;GB�-:$�D����� �5��+G�Ӛ�%�3�RS�a�:�d��\ٳ���������X�8[AW��IHJ�&o���s\%y�f���//J�:f+�)�ο���PRƕP�'/��}݃dbE&+�:��0ޝ��f;�?�q��VJ/<�m�� F�e�d�U�+W��]C�[]�����06 `�h�|:���I"t�pX�'>�Z�<� ҭS�R'�����*��%���R��@�߰�D�t+����ƻjD�e�&��6��5�&��P�L(B�nD�� ��fq������G�+����`~G�M$3p���cK<���Q{�A�Je-i�i_:�:+L/bE�ϡP���A}�W�t �M�O<�k'Upt�2l���L���"^bW[Ǚ����ie�s+��H�n&Wu6����F���g�r��mb���`y��P�h�+I@�1p��;��5� G}(�찃J�C�x��?�RQG&^�k���cb8nj3�X�ď-@z�d� ��,�G��dťj��0������ϦL��N��<%��+J/Qt���9 [��/�x���ͳCS��E����D�'G����~�6.bږ�z7s(d��W1�ޱ��̆� D<���h�Y[-o��N�Ӹ%3:��U���!�؆0�2�;�zs��nF��D�k��=���S�U��t7�l�����v90Sja��-���h� �:׳w�#I�/$���l���Бo!�����3��#.R�W Mo���ѐҜA�>Q�P�������c���s���ؔ�6\�A8(w^)��� k���� dB��df͗HT =�\d�}+�%9��a��=�>���w��03���&��ǒJW�?��֗� �!�mY�f�)�<���T�+Y[�V��� w�T?�T� ��5S;�E��Wŋ�V~4B�`��L��Ca�k�)�H�pC�@�$���~���ؼ��f�����?]��"�!�m�8s�����Ϊ���QO>ה_ի�m��K�4���X��D�2�H���7�ƞ(�IY+���u��\ �ʫ�G㧙�E�M��ʮ{���]��k� �>khV�^���[�� �J/̇�z{2���f\�s:�_hӑ�c�B\��7ot��=�.$�C����f��p��|��tF��ގ�e1/p�r5�L�w|��@칢COl�n;����t'1I�8e�}L]v�R��[�����$0Ƚ��lK}Wr�2]��%2�m�} ���z��"%���1��L6'!�������jq~�\7����YNi��Sv�$����X ���4{nЪ>��c�9w�=R�SI�����#-Wn�v�$t�Z��:�)Et%˝-z�8S]�7��p�5�KI�-XV�g3��ش0%�:N��y ���ȥt��� ��03Cvn\EvQ���X����5�a��Xs��n̐I<Pƨ���w�ir��
Static task
static1
Behavioral task
behavioral1
Sample
DI+25TR-LinGon/DI+25Tr-LinGon.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
DI+25TR-LinGon/DI+25Tr-LinGon.exe
Resource
win10v2004-20231215-en
General
-
Target
5b7c4b40e973f4947f82982fa9de6e56
-
Size
2.4MB
-
MD5
5b7c4b40e973f4947f82982fa9de6e56
-
SHA1
73ff176179577ccc53f5e823d55bd117dc47a3e7
-
SHA256
6ed7de037f9df23d80df97cc30f51e9823b168edab5ebdb2bcc29155d18babf8
-
SHA512
b723313cbcba7e55094a1ed1315b2f65244a2ba308c1c2f76b2ba6ddec4c97117159f1d660633653d5169c367b211a32acdc77bda1d368c76b806f7091dd3864
-
SSDEEP
49152:tkJ99OF0W/0j3jh7bJfhODSXgi/bzHa7fSfviHXrgTukby/uM/8lGVYW1X0FWN:0buNe3jh7bHOcgi/L4WuZ/8lFMN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DI+25TR-LinGon/DI+25Tr-LinGon.exe
Files
-
5b7c4b40e973f4947f82982fa9de6e56.rar
-
DI+25TR-LinGon/DI+25Tr-LinGon - I.N.F.O.txt
-
DI+25TR-LinGon/DI+25Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
9f9776f01b8f57ab5ac328ecd8fbede6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fpatan
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
DI+25TR-LinGon/VERY IMPORTANT!.txt