MD�_�.0�t��P|�����J5�J�߹rR�5 �:��R�u,a_��o�X� ��' �)U��Kj-8Ek�7�JB�~ �YoU�l�cA'ǽ�>��[ZA���fJ>g��������u3��[�|����~��4`�vUm1�����,1����˺��e�C�����Ԁq�ݙՠ'�R��o���/��O�wk�e�v�cʍ�3?�Ƨ�, b�ʬy��a�KjY, ���QK��>HCc���M�0�[S�HM��������kH��fȃ�NA ��t�mX)�Sq@�Q�.��� -"W��̺�t>\����i���U�)�����9Q`dA���Ѵ��tQ#pz�s���g���}����6�ngv���h���lre3��-CR�6zVW��"+A�c|Om���65�ȶ {(������-"�M��s��zjPN�F"��O�M�;x�NR�"J��1��y]�䜞O=E'sA�w��ĸ�����amEDx��ϼcѝd�]�80m$r��ެO���V�cԮ�"��{��a%PK(�z����ˠ����OI�㋪��jG��nR��h�ֹG�pt3�`I�D�e�$$����B{:�뉘QM���0����ZHk�`Z����[t=!��z�$�dOB> ���X��,%��tn��uV�;&�|�d臆nA��KQ}����U�^�gr�������:��n�{5��7���`���r��Y&m��:~�6G�np��T���Z��@��s�b��@E��y����F]^�gJ����-(��U�OD��Ȩ銚�;}g�L�Q��-���Y��)�%'�|�<:�:���<�Ro(Z�B�?Y�2����@(�Yq���5ԜcԒEȆ��=��"�C��PR(�o�\W9�%y\�ѹkMjk�� m�}T���h2q�z� ���kp�[!���b�st��*�����u8����G�i}㛖����$*�vW�����\*<F.Mx��+��w�TJ����ơ����'�v6R�0���SE���L��<l�Wv�EE2d_�$���G���#��4,�g.���Ҹ/�q�c�����������G톾UE��{rhlZ�"��n��� ����N�~�89�4X��,��x��2��� � 7������P���0V��$i�k�(�1b���#F4�h*S+��ݛ1���`_ �vr7L�.��tVl����=�۔��xɗ4�E��T��1e�V��U�ߐ�VV1�Y�M��n!�� �R`7s/���d�:Յ�џ��_3��1�J��X�gM���MZ���q_�~!�+�G��YS(tP���ORa��"a�����<��CgpV�� �c�n�0�eV����7�B�������#r+���O��@i��=���n[M.��yS����~�1�`��y��O�kFԷR7�ެ���M��jh����<l� ��rǼ���ׅt���|����,F��������h�^j�M�._�F�j=�a���O�N����Q��$1��-�ZjC�L\�r�� [cz ��[�235*��>u� �z�upu�$h�V�I�� ��(S���6(���X$�Zx�R�'��p(���K��+���x�c/�2_(�����=x����꒷�)<�����Y���}��;���6 5C!҄c��T}W7 �r6�Gn�|��p�-0�Ox Sҋ��28y�m�a�1���x2v�3���5�6ܜ?��ɗ��R:���0��EĞB���`�'�T��mOj������)�l��:�0����7^���F��f�<�6�>f�.��\�������+�n !�pZ�1_ۂk9+0sP1��_���%)'&�c�w�q�AR@K�HL�*�jD���ܗs݉�J�;ƢK;�=����'�A�-�A:I�l��'W�,=l�EY��^�h���1�;��\��_q���@�������H#7h?�d�IՋ�QP9���ℐ��ٰ����J� r����8B�����.�b;X�yQ������ vq�[��I���|ݢ5S�0� +^Wr�R<4���~v��:�[u��DP~]6y��kR�wϐ8���3�%�T��6Y/L7U�H���P����U�dC�J����j�J��h�,/%����a���<Z�k~G�� � ��� Q��k��M��-����8�C�Jb ��)TKh�c&B�/.������!� ��XRa dP�aʒ3<�Y��k��5K�Q~��v�@m�V�($��#�P�|�~D�� �Iikxnz��C[��f�v�'E�7�,l!�-b�������^�8�p�j:J��D����.��l���ڳ�vٴB�f��☸��:� ȼN�D$�Q'����o=�b}?(��*rpv��ӴV��;�V���j'��F)�>�����7X��*�PF�f�w�/Tݎ����6��M;��_�@���>����kVJ�`���5b�T�N�ݫp�8Ë_�<�qb1��@M�#|�o����o�Zb��(}�P�e{��_XD���+�2ʨ�8!���>�05�� ӂ0jgI�`��Θ�� h,Bz��Z�h��u����)'� �-q ᶴ�^�����W�'N�^����(��yG��HȬ|��U"sB^�����"FcL{]��JϮ���#/�B*�9�H��V3��9��y�>� G�V����*{a�v�g}���KCaV*���.ڏy�\;��x��=��[���'vp2^/� ��mTc�2�Mp��ԯ�3ko*���a�U��:�% �;j4�SZ���I����!�̞��b;�9�#̡��M8�]q�m,+�nN��!�`�)��%c[/�c��&Ҭuc���㞺r��ߡf{?5w���m��~�V�\qP��T^���^�UQ#�lj�V�ݳ�;�}�"]0g��4���w̪R� ŀY���0��ԯ���ȱ$�u�+9�J�#���.�_<��^�V��%�U\5U���]7��tPt�.H����]a`S�����v���0�n�����+v�O�šh֨�d�2��,xĺ�(j�Wz�o�HPgK7���[-��2L\tr
Static task
static1
Behavioral task
behavioral1
Sample
999438077f0df773ab4b13347d0c2186.exe
Resource
win7-20231215-en
General
-
Target
999438077f0df773ab4b13347d0c2186
-
Size
9.1MB
-
MD5
999438077f0df773ab4b13347d0c2186
-
SHA1
92f45f4321cfaf3a949a537238d5cd497af15f92
-
SHA256
424702838f33b8cdb596836c22ae06c21dbfd77309046abd690b7ebf5caf1928
-
SHA512
cfc9fca02b47baac196f0c3d4246ceb7ad289e87f933852880109b068bbe374d1711ffb9f23e797f4e5c13948abfbcbe1278c06849a9a103c7615166dfd55fba
-
SSDEEP
196608:RYVQ0+DZBIEFcNzvXosKbvBU495aZTRoL+Xitsz94TveO/8e4VHf6jfSh938WM:SVQ0SRcl4sCvqo5moL+XZJavb8bFf6jp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 999438077f0df773ab4b13347d0c2186
Files
-
999438077f0df773ab4b13347d0c2186.exe windows:5 windows x64 arch:x64
cbd86f41349c8d10f4a6a9f3a4b001a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
AdjustTokenPrivileges
crypt32
CertCloseStore
iphlpapi
ConvertInterfaceIndexToLuid
kernel32
GetVersion
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
___lc_codepage_func
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
userenv
GetUserProfileDirectoryW
ws2_32
FreeAddrInfoW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 723KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE