��N#df��6\GV8������ �S���fg�}��{�A�a�|�`N��Q����(v�%j�~i�Ҝ���I��J�rz>P���Z�[�\��N�ʏ��"�(�\�!�[�J�|3��>HY��&w�p�?�y��Hv<�r<�u�B���Pv�6ƦJ���R�M����DT����cΡ�>!��P���])�!�� �{���<�nl��h��C�YT�p)pb����z0�,��8��� ,���y��Ð��/�}*v4�;w�W�a8�5�^��1$K�!D,�7�b��ׂ*]���Ѽ��>�n�_ =�]�Dj��cEds¢'�ev��K{މ,#J��?��A�N��T=l�2yvFzQ%:?H�o��K$\�4|�Z�FT1;�Wj��G�43��-l ok_�#n��4�В�2\�jYC��p�E��Z�䶃A���O��t�E<D_8/kWo#X��T�uƣ%|3�v,Q=Z��|��=-�;�X��ĕ��8%��E�a���-��z�\*Y���J1W��v�W����ɻ2Y;�N'Cy���N:��3�T�e��h�-�e�6}��)���� ei��hk̇���1�]ˇ)O� *��'O��)��YFb���I���ioJ ��폱���ިWp�2���_<�|����XD)�7*�^�O�[#M� �T�0�t�Ng�5�U�}�W/���6?���?`[(� ��꿄�B���a�����"��n�y1�*��)�MH� �x�+ �I4���]����]Q, =��<Ҡ-��Zy)ȏ��v�G�k9��%�.�թS�tD���Lk��^�� ��-V !%���{��ʻ�֊1���Np�P3���2��r�D�6�_��m7V+���^Z�e�v>��eN����9OZ� �'F�����q��Ș�EJ���O҂X���e{<�e~8Y�/�� )b�:�q7���JO�<���{�5�o��p�U�^N���*�����1�~��m��ٖх� �:�F�sa�m�7����ҙ���lf�P�v�o-Vpn�Q�|�i�ʇ��d�ح!x�sԦ��1*�T���2Ciq������f� ��Z4�a��(W6\Q��[%3m.��nq>�z!��.�e� _�\K ������}3��������0 ��ŷ#��!�c{��У�����L��}���O`��(q�@�c��X2G����CVuo-,k�[��c��J���v;A}�Ls�����&-RN�z+&���;s��ڦ\�ӧW%K|8�����#���ȴBe�L�e��\}z;�f�"Xf�h'���7�1��<���b��2a�a����*�kk�Ο ���H�T�+����ں˃�fy�2=�as�Lݬ.�h����Xe8P�*zo9!�7.�4�����������.ӲI@�G̜�b"�_�IJ�p��V= �C�ώ>��>g3<̜�l��eh����=FN�5l��/�Xs��p1{Kj��h��'��3WF!�E[��@(m�,�ԃ@�0���8Ev&V��C��N �Na��|�A��T2)������iT+ӄ���A���:���\��@g5;|�h!�W����C�Et��s�I�T��&���ާ���+��2N����g I3db�7�GK1�w�!���9�r|�;6�,��6�?.��U�{�sԆ��b�:l+��q�0V��v7B���� �)N��,9Ei�@ tw��,O��R��b+Y�D�2�>�#$2�����rg�E�O,�{rW"�V Nh����ɡ���Gzw�N3���Xd8k�Ƈ*�������_u=t�b����Xخ���Rc/.��-W�'��<c3��j���C5��eX�5����jy�--�'E��� �\JY���,���CvP9U2!=��&N�C惧a�ئ�vXU�����YgM����s<�Ҧ%�ʦ���E�v�T��M�����{Ȭ-B����e@Ǵ`�h_��ҍ�,dsE�'�1�kX,�|�P`�������h10Y�W�!pD��������^��eJ��D��(��2�;2ԄbW]���u�6�]�%G��z��ь��}g��j�u�,�����)?�zF����6/�� ,8��e���ޏS'�[[$�\FfJ��;�WW%���E�`�;�p�?'�[W����k14l� �=*&�o|�L�`��U�b+���Q��Npnś���N�Zʼn����Z��%!���ϝlQ+Lj����@n������u-�_5��������a$�R+m/D������@o�L_.�ä�g�tfŵ����g�7�XVR(��I'l$�c@QV6qo�*'�<m>��H��:D�:C��7pITÇ�������B9�{'�z��˨�֙/�(�G���L���L���Z���.��9=��S���Զrͼ�f�Lb� V�`dp�� p����0ޯ<�Üz)��N�V�~8?���H���f.f��1;Na=��U+�%����ӊ���"+�J���æ�65�I�.�ę��.=���$X�������b^r}�-c����� �p�y�BɈI{ڦ�_�@֩���T�{��df[�a���������FH��=m����d$c���N~_W�Mވ�F�$�>�Ŭ$;��WFߐ t�mz�5���H�\� .#��H� R֞.��x8�Ǣ�,�<*1���p��{���}V���z����R�:���9�2,t��<g!�d��L�6�H��;��n���1 �ֶ`��n#UZ����y`�t.� �����d1�Q��KrG?1�cO0o�����L̶5�� ���mm�l�ʋ�ZN�a41Xiɮe��VMK(�>�������Ûjc�釐36Gh�4#���#! u, rb|PS�@�ڨL�P2ŕ�4j�!�����C�DYBGy���{ڇ �\F���UrB�qm��D��Q�@?�`����&�u��ԫ]$C���������.vi�����s6ȏ��u49$p�\�/^�a^���w ,���]^����*Ҋ����K�@.3��Q! c��Ĥ�1���}��) ���Wא2<
Static task
static1
Behavioral task
behavioral1
Sample
H&M - External.exe
Resource
win10v2004-20231222-en
General
-
Target
H&M - External.exe
-
Size
8.1MB
-
MD5
e187834cda073c53088ef37a9ba78846
-
SHA1
7b01f2c68dbb092496f635bcc6a8a9e7c7c5f193
-
SHA256
77da74554778a4825929caf4260c6dc59135f9b7bfa0aea5ee9676c91b4ebaa4
-
SHA512
20c681ed4bda6b1236bd8793c373e86ab58570e99d4747a4f84b133293c040012974b89b5a50477897bbc04a7cefcdad5f573994ba04bbfac651f9bb1b8019ac
-
SSDEEP
196608:zYfP1r/+068wbr5l/AbxB7kU95lUkhCQ8oAWU6g+:EfPtm8whNAbjrPK1/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource H&M - External.exe
Files
-
H&M - External.exe.exe windows:6 windows x64 arch:x64
9bd1027ea550a2c326a29c55723aeda4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GlobalLock
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 393KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.(L7 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.g|` Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pup Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ