i됂�����m��o����C�0�W����L�����%�ā�m��O]M�DHX��8E���DZ�HBIJ۸C�Z�M��6\��rV�eZ�i�5۫$%���t:ϻ �#�bk���p��C3˨��Ј�8�3��Ƞ�j��/�ݯ�>P{��0)�뎓��I��+����S���>\M�@3T�/%:!�8P����GL� ��9b���r������CW,gs%��F�g��{/�e��z܀�(��WlBΟ�T�Y�m��+���V"N-���r���o0~:�A��^�t�_'^���l�{R��}��.r"e�M�[j)�>�W¼"� ܚlQ�n,V�Ϸ��M�e+HLf)m�iX�F?>C���,�.(fK7AH[���r����OĹ�R���u3��-96�#�I�7XL�����$��G�$�ph��*��QII�[�-{E���"���']5W��X������/����BF��������s��tpC�k�6�<�|-��|f����7E�S�����\ IfM����Dkϥ�-�N�� L�����}y�1 P$�!]�!�&\�e<�T��4L��~YVDoKf�uG��v��6Vw������ݵޘ�!5X���:fM���%�����\{I�[/#������7�ǗϦY��`�Q� mX�H���YY9�bae ��������s��,oB�K�"���k�iE{LR�(3���1T�M��]�C�t�ʤ$>���J�uBP��3ݜ�i�p%M�����O���O�����nS�F��Ιt"��V�g2�4J�� ��ڲ�)�B,"2E���Q�$\`�1��ZV8�Z�:��Zz�L�i�d�a>�^�K�M�͜Z�Ċ#\&,��c~��Ͳ�iy��$O��T��8"uI��!�����-���S��z��S:�E�24�^���X'�j�!��O��2ə�Ww��q���g���o�d��t$��S��ٯk�3�1�`�k���W��K�V�G+��g�ڻj��EX��_D������E�\�����������j��9�;��0�H ]z�����;���.n�0W[SP���ޔ}w2[m�o�CoF��cӠUCr��(� B���M����OL��<p��S� !_� ��v'�A����o�=k���+�4��f����G*'j�5`Cf��c�M�U`�� ��U|��#f��,�s����_�wB[�U�F�]�80<a뛚��;��sv��,n!�dM�9Ad���2�qi�T��c=��� 3T��X�;Iu�F�D��upg�]�o%�m�:X�␝��� ���1W4��8�Y��3���R>�eOΞq�{i�G7qa�οﲝ�\pc8�����\#ښH����l�y����`D�H�!�ӎ�&n�"as����\��ߐ堢g���uT�b>H1���I�F�����h��5�e Ŋ�1/�6� ��0>�]�Ci��a`�$$J�Z����> ����,c�����C��2q����f�e�>��Ej�YF!ڵ���=�`/n�5^�T�?�J{\�O��/bʘ���g�b7*q�M�'V��F�����/��7,��µ��Ɇ"��K;�K贼� T�Ѵ��y�]y#&j���D�}�j5ӹ���5ode^�L��6�Q��f�x�U'ÿy�ZA��Pnɦo���<��H��-��I��b\%�t 3G�<<�M���jlM)\\;-�������`������#�t�/{�ʩ��K�<b��H +��B�[��#=O��*L�X�~�6q�A��l�2 2�u���c^���8�:ѡ#�0�{_�\_����M�+��r�71��S�z��q!�<�g,rV���`�}��A;���͗J?9���R$&*��\�H�}�����q�Za%��W�u���I_Pp��rQ=q���0��-pޢ�UK�����Ҝ��3cyVWz�[���̈H4��v���Օ(����a�44���6�xAw����|v;���F��چ@|r'�Iv�{8��Di'Ü.jť�d��|���[r-v4M���z`��bMe.�ٌ�}�ƭ�K&tl(���Џ!���:�y%k�(�� �;�Z/!�'��֧���D�L��#�\5�>�����pD��͇i�L�6YU�D�w��a�r�d �p�� H���բ�0;��s�~-IY]PBz�̲\\��_��fla�9-#f@�ٔ�3�\�< !cQ1 �4��/��}?,L�/r㓫#��\j�0��z�x��L�>p�����������l1�ݺ�C.��P^���Ss�xpwR}Qh��&ҥWp�xU�r�N�[�G��11�u�������רw�ǛgWb��)����c;��h����=W���i��8�Px�G�-5u��t<��@��(l��֥�A:d?�ǹ�u.���d8ǺyD�ڿ�(����{�> RD� |X�C��c:L��h;m����?�aV������"r�Gꅇ�?�.��)������s���a;��Y0�j�Hk��D��3f�"(�����©���}c�ٕ�Ď6 �u^o���3BK(�E������֚�t�B��Q&X���4�JC\K7������Gd�1s{�@AL=+pH��#�n��-[(\�j��2Ia��N�'���#J�d�GY���NS�[vⶪX��Iz��������^!'��RWa��F'����K�U�T;���M-��Y�����YhV|�Q�&16��L���i?��i��|ǔI�1���" ry����������� �SӢ~�'~�⬱zt$����ɋ"^��j�U��6�g�?������,)���/�6���^�m�sFe1�+�I�Tdp|�bD����Q�9z��4q{l��'���&�N0�-`�z�ԅ�U)��Dj�(�����A2F�/��>��Y��0�����~��^@���Àe�{�רd�������Ru����"%S:7�0�ח������\1+���V��f��Ɵ�@s���0��hQ�N�t��U�<).�3����
Static task
static1
Behavioral task
behavioral1
Sample
f40117b2802a34a498eceb4739797298.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f40117b2802a34a498eceb4739797298.exe
Resource
win10v2004-20231215-en
General
-
Target
f40117b2802a34a498eceb4739797298.exe
-
Size
6.3MB
-
MD5
7e1c64bd13fe017f0ef3dc1609125cf5
-
SHA1
58c5f89d862aba31d251c92eaeedaced81b12a32
-
SHA256
9370c96c32ba6d521fa8a41700b507b1953f81847940d997f8bc2f0163431656
-
SHA512
09e23c47a2d091d7d1f54f3a6d1e5a16e8753fa6df2a7f366d14b57c280f22a8980fecd015ae0bc27d17b673c0f6ff7877e6364c3f5eafd7ae3a97836f93f75b
-
SSDEEP
98304:LcgnUz2j3QDYTuLr0jk/Uw/PY6LKT9eaJd05FefMpdD9S:LcWgDYTMk+YRA5HD8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f40117b2802a34a498eceb4739797298.exe
Files
-
f40117b2802a34a498eceb4739797298.exe.exe windows:6 windows x64 arch:x64
eff1ed42631c719660195631799a5db2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowW
CharUpperBuffW
advapi32
RegCloseKey
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord301
ws2_32
getaddrinfo
rpcrt4
UuidCreate
userenv
UnloadUserProfile
winhttp
WinHttpSendRequest
ntdll
RtlLookupFunctionEntry
iphlpapi
GetAdaptersInfo
vcruntime140
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strpbrk
crypt32
CertFreeCertificateChain
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.j!a Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.!ng Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.98o Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ