��[+W<��3��z�:Y��O� �P��z��!A�A����]��Q�ѣ�,�v�+�Y3��G)��n\�N��m��3���XH,��,T��~�q�����G�V��� �?0C�f�M��:�P����I �4���=մ�|�d������3��7:/��j(>�6dﻬKo�{"Niq`��*���y���v���_!Y>� Y�O�\7���Y�=�A�r�>qaĂbP�4��N��9;yx~�?_�R �������o�)��-JpƉTR9��&˟����̣������M�y�r!��)^.���}Vt�����vg������HpfJ�"��~����,1�-{�������m6���C��v^ӵ5�rv�Tan����r�u�7;oФ�Jk]���!�lA�0u�U����[��+������,��bD{���^�Q͕�=��2z�qe����E�cwX���g�k�{�FX��9����gR�j=���X.�*�Ҟnʱ�ߟ�+�w���R�j^V?�A���l�ɐ|���s'Hh����˪���Bc,��O-u������O���~�@wR�S:R4��nPK���Tx�%t.�7�wӔ����~�c�¯� �Lr<�B�6�Y���5(z�{KϏk�!T%n�9�[=e��U��Iub������G�w���J��@~��L��g��V'��!�w!x7X.A���rSޚP&�NU�s���}�]mvq;�4m�� "� � �c��x���w��E3���Y�2D}�ׄ� Mߋd:��[�-0���\Q)<;�Ǐ|}���X@x���sI��2ٱ�W���|�U����5��6�@^��e4d�d�d�&���L�t�����x��z���E�*5��"�G؝�ef��#_�)�ĕ���9=�䚗���) ��m� ���3���{�:����X2vE��gI�%����s���n����'�6��?=��i �{f5ۿS[�))HEP�2z^w/���h3�f��j�Ba�����6��d�,0?�x矕�MߛF�M��6��Dyǯ�q �?^0��c@�CM�7�1�B"����,bx~|�7��IX/ƃ�M���;�D�1�� ��d����ڤ4kd�X��2���. ~&��]7��^��!��i�Y�T>���P�8���. &SNs��ٯ�l�� I#ţx�,x�~\�:_q���}2Z�*���7����-��ێf��Ѐ� &�=�\�-�+���%�1��u��JB�ٞ��#��$�lʐJ���IZZIes;Ӛ|M�Vh��(�M�$�����.�?7~2�dI��4�L>�2J���˛�"�$�0ki�66X�Bp�ɕ�ʂ�T�b��Fj4�a��v�r:���戭�Ά�(�U�D݃?D&!#zm�F�]�B�k��ɢG���f�n�=�G�����75���D:���j6>l(�� q��$�|��r1GpM�{���,��T�I�P�����I�~9H H!a�PZc�a5=-cܝ=�}{��T�5m�x��� S�rRbv��N�w�<J��4���,Pm��gs� �d4���C'�ɂ�ya2]��]��@<�g� ���ԁ���a�\p������Ļܧ�$�6�3�f�7jM~7P 4��a⺋����P-4��̸����]Q���x�+����B���θk>X_��+�Y�P�9�6����rO�gc���T�v���r�e�l�$M1���f�0ݾ��ZV��EV솯`V������t��W�0��/L+��=��;3?�R�y��[���K8�*�Ck���Y�Q�n�#x'�p<�K.V)P�� �<�7��܅U��N�����l�q�8���L���o�nßNNl"KH.˜+�s8e�pL�4��Wa�p"�z'{R�7-Ű+���Aֲ)Y�2h�k�������u�$�� �z蕒��",<KË���c�:Hh�q&YfB����?7zv!/�@�I�5�_ࡕ�n��XGl$�R�Ja/�H�xĥ��@�٫Z� �i��]r�G�˛%YU���Kf����ⴤ�W��>�C�T�u������r���R�_{�K��Jz=n<�o�-� P���7B�\@hhK:{��gz���k6T��S�Ő�>ӂ���w�[�^�Vi�9֠*9(ZOy�y�J ASm�KΛU��(|�XL�ϓ@������f�ރB����o�MJF��3R8��'`M;�F ��+iyӫ��e��/o�<[�{��%������%IP�C��{��a[N'C��,��~��!)Ê���-��0m`{!��*����#�G,Fn��#���6�!=��K��� ��i+L�R�i�q.�x��וܫ�3�v��h�t���[�SBp�FHa\Qx���|�MLl�w�I��±;�LC��1�p�������:i�6'�i�m�7G#/��������$�z;�sy�M���ܔOIm-�>\F��-/�P|�pM��݄R>�!d䬺Ҵ����3ߠY��������e� ���=��$Εy���<�oG��DT�~)��[ر9�qb؏t����,/���������5\mVsL�157Rd��ixV�ٍL.�_z�����,��Ɛ�j=��m�<"��!Ǿ3�Ȼ<��-�m�!�Ơ2IhO�FA)������H�ٲ��S���8��4lWy��6�4!�3������<�h�.���IC~C�c���k6��*Uۊ���i�] p!l���+7lS���"\z�iB��l�|G3�So�.�џ�9��K"��U�g�&�;b�YW*ڦ]4������J b�Pu�z�b����ߕ�� �BS����Y ��WY*�P�آ��y���ӊ�A{r�=̯��x��Y��#&��F�k�ꉧ�+�Soz�<ړ��ME|���=TJL��������QE&��k_F�"Ӛ 2VU 7f5�ya���ͬ��<NtA�47đf��,� �� ��O�2���]��U��Ǜ'��.�n�y����ŶʜZ-����0���ج+���~����c�}%JL�3�E�;F/s�tx���ƶ��G/��BE������l(![H�-�K'�m� ����
Static task
static1
Behavioral task
behavioral1
Sample
NSF3E4rWbWpLZ7LX.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
NSF3E4rWbWpLZ7LX.exe
Resource
win10v2004-20231215-en
General
-
Target
NSF3E4rWbWpLZ7LX.rar
-
Size
16.4MB
-
MD5
b17c615dd04aaf2d004d76c997cd5477
-
SHA1
bef70f8bf1caeddafd0276dc7d707321075acbc4
-
SHA256
ad7de28ec6f6a9a827a3ade6a533e25e45576b52e117b6239e96641394bffe3a
-
SHA512
31e872d76973ea1646ba485b2a941e63737b3c90e52be4cc9bb89033805c9ec51982dfc9e1213dc0d858e186c2c69bbe08a339e8d4d91adca876f26ceda71c58
-
SSDEEP
393216:/tlFJfvhRcpgr2uE6hoKyZXR+R9v8Sm4Hbr5QnkSCZn4://FJfvUpC2x6hoKIR0vZjQE+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/NSF3E4rWbWpLZ7LX.exe
Files
-
NSF3E4rWbWpLZ7LX.rar.rar
-
NSF3E4rWbWpLZ7LX.exe.exe windows:5 windows x86 arch:x86
b15c610e5b983356413b09ba17ef6473
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindFileNameA
kernel32
LockResource
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExA
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.specix0 Size: - Virtual size: 13.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.specix1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.specix2 Size: 15.8MB - Virtual size: 15.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 903KB - Virtual size: 903KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE