��R� �r�w�M�d/��)!�]X�a�ϰ� X�9F�_�������i@��*7\�N���}P��$E1a��P���bF����`�H� wq�L�����6��b����`��5��@��vt밫����i孕v@���'�5��9�Ձ������ٯCkhK�m�L'3��@�����W#~��j�k_�@8om���@@II�ϮR���dAa�$v*��fY%K1D"�8q� �lk�K��:���u�y4y�Va�-�ԛ �p���ܫ�ߝ��Z��vɗ�?da�,U����wp]�/ ��]��p�\u�M�9��8�����ʘ�n>B�;ure7K�Z����sW�x@~��jO�p�._�N��)A���o��dW.v�=�E���W0�$����BO�ct�E}������}�?녺�]�[9�Oւ����^���{۲�=E&&e��ٮ`��H0������]��ݮ��:�K|����v�i�+I�ǍBN�y�ڦ$����M�o������,�o^��5�A �w�E!�e�G��#�ΰe�>�&A+~�T���c�O1���Xw��kA&kѷ��� j@.@��@ĥ�xA�/L_�Gq�����P�˩� g���X`��N�'Պt��e-T]$�\�# ��|C-/AtF�ȟ${,N_V�� s��3��x���Q>!��2�v-ɧ�m7-L��5`� �X�6�:~�=��s�2��lZ+�5�0~�}�S�3~t��ӽm �>'��ۼ�� �0oq��v�".ު�����J�D�l��h �{:'H�`.�[N�wn*d T��]*c��|!��ĕ�%�k�ay'�7�WBfo���Nj��Nj;������]�ko�'�rBNt"������ս��{DQR����x�kY��H�������ǣ�w'��W5�a�ɔ���WZ���=�W ��<�8L˝���{�=GĠɷ�������.��{\m�L��e�Ԙ��7�)��a��-�K�xyi�K�&T�?��nw*J#v��Ȍ⎚��MJ9��0�ls �5��wpr~h��a!\�BD�n��pmyL��1m5J����@�5,~W���5��̸�\�Q-O �=5&�����{�[2LhG��C1;Q� ����S�� " ���ǩB�L�$�Jl�غ&�~NitWt�]�qc{���@����e˟�N��Di�F��HRξ��k8Dljճ9�.��e|�Ɏ��AF"��D��B��m�C(���hr.�� ��c��qn!0�,B��ڮ�\Ƅ���|��M!<���J��P�w����wA a ���1{r�}\��� ;�(� �-n��8�Y�n�<����:�qs�S=6�� ��'E���?�"B���X[����U����;G���`��T�U/44Z;����C^�!�#%䕰�W��fNK*��:�=���Oi�u�L����HaA'�һ9�G��gC���r�����l@@2��{�*A}$�y?�w=�1��[ �>�H����mu�� �U�R"۵���ط�!��̏���:���ϗ�͆���z��X��c^� ߦl������PJ&$j"3��C^��c��� m&�F���O��67*5���sî�(R������͓久�������Y1D3���}��U)B���%p��H��_��ڋ�Ϝ�^�]��ɨ�{aHq�E��rt/$�7]���跗@M��Ą�|���&�ќx���s>��Buf?f���{��������#X+Pg2e�:r��(k��5�̂�? ��NM��z���I>L0(����������zR��3=���W& �|��l��+t\�j95�!�X���]y �ݥ�K-|4Ko��<π�Ĥp�Z��t,Inxވ�Y~_XTGjl���X<E-@~��q�ު;�:ی>�c^zQ�qm�m��k�L%����[@�L���r6��J�E�$hsI�k��� �����?�s�[������_��_Ѷ�JC)b��_�����$����_�pa |ܽ� � w>��)�U�{��jǿI��/��OI��U>��z��\��L�d�!��5�9x�D�A��-�L�=��j눨�x���Jtȫ����X(��a�|;{���t{;=%�j�d�ۅ#�$v*���������m7�с4Ո�X��2���f�}%�AN�H��i#�ǀq#:�#O���9A�Q��~PR��m[������ ö' ����B-�݀UEz�p]\J54�������Y�1�|Ŋ`��Ύ��UrqMƕ �¬!mt��5��P����$��|�����S��_�vM��V�gΜ?�tX���l}ؼn��n6+�]�t~g�h���a��Yw�%�s���}IK�Tc��b�-�#�T������phC/A�c$���E���UJ�}��ف�IS���qf�jڶK�bQ�N�2Y?P���Ki�lj8����<�0F9_��M�%���;v�M�:?D��2�2$� ���S P��4���ܐP�ߔO#��Y�B�~��8�ܠ�i ��d��q�$2�?��ՠ�\d�ȵx$Nk�u�9V��>e���cp��z�Em��K�Ҧ&/����ϣ��(qVF�3c����+' n����N��R�D��)�&�r�:ٲi�T*2��|䵁���.q��9دއ/�7wAGӳ�Ch!xa\�|kk���"P�)e���p�ܾ#�i��Y���e�[,��Z~1q҄m��N���p�o C4�_ ������Y��*jl�갱l�ŠG�}��Ŗ7?�Z��}&뵣[Ue���U�~�XշFh��4���d�R�o������*[7���C �cgRr��+}Ѫ��c���IS��%��v!lu�4�̜��ȗ���M,�8]Y��w�0��N焕�v*�A?�i�.�J{���X'w%}V� �x4�4�w �<�Xng(��A��Deo�/F%�X8:��[ ۿ<�4�����9��-���6��(<����~��ʑFT�=�,е�u���w���Y��UӅ�q�|���j��V �0��+��m��r���ϸ���ZK�|�_�������,y'��p!*|����A��.��
Static task
static1
Behavioral task
behavioral1
Sample
gbl.exe
Resource
win10v2004-20231215-en
General
-
Target
gbl.exe
-
Size
41.3MB
-
MD5
97c3785125aba1b7a92b04a2559da604
-
SHA1
e4862487c3a552cadac570d25987860a07a84ae0
-
SHA256
65c24a28f40c061f8ff11d7ffd706f1c0dee330aa07d8a04ca23a467330505ea
-
SHA512
4c2573f41db2655c4e88b57c2c3b226f3b3d54a746648c453832c0007ee62e7fb7b75107138832e0440ea6ed500deca51e2a944604e653a626be67781f499377
-
SSDEEP
786432:NDDSvzNOaBjTU6VElyk9CyUxZlqZZygni3CKh0osWIC7JE7zfZspKxNSWog:NDkBdjTRVEly0NOzh1sWIqJsy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gbl.exe
Files
-
gbl.exe.exe windows:6 windows x64 arch:x64
8f753530ee5f46a1c5e06a5aa42a3278
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
ws2_32
closesocket
user32
ScreenToClient
CharUpperBuffW
advapi32
RegOpenKeyW
crypt32
CryptProtectData
wintrust
WinVerifyTrust
winhttp
WinHttpGetDefaultProxyConfiguration
kernel32
UnhandledExceptionFilter
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
SHFileOperationW
shlwapi
SHDeleteKeyW
mswsock
AcceptEx
bcrypt
BCryptOpenAlgorithmProvider
ntdll
RtlCaptureContext
imm32
ImmReleaseContext
xinput1_4
ord4
Exports
Exports
Sections
.text Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gbl0 Size: - Virtual size: 35.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.gbl1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gbl2 Size: 41.2MB - Virtual size: 41.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ