��v�5J'|8=���u���8m��k�2#g�\?AΛ�GIm�����#gh��T8���Y!eT�Y�a�v��f�z7:�|RFp�(^���72��b)�d�7{����� �L��t�S���/w�-\F���=~̔+�5M&#�\�Dr�&���w��t�]��#����yWm���^v]^����bjvͮ%�!�s1��S���+�l��>ckl�R�4�����Y(6w���� =�nme�Rc�\~7#��Lq<,.�ݍ�q�ӂ'����J6��[cO��!�����}-A�'�������_�^3�� P����Z����Y^����/��t��c���[��c�`y�V�f{N��v�s�x �����Q+S}�<�$���|��mv�� ���2��@T]G�s�@�(�� �V+3'���K��3���4n� 5��L�]�{E�ҙl���0����x"������P�2҉�dKXf43�!l<�Aѡ�Ⱦ)J4���sC�/B�� e�<�e��q�#�4Lj�.oƝ-��c��`"�%����9��'�s�ܝ��^�k�ugn7,�$c��� ��S>^��:$WD���&P��d�ptL+��"�q��#��(4FP��"��5\B��H'���I|�,����Q�g��y),�nΡݩ��4���a��[��$�0�5�_���bP$g[�SQ���S�if܂G%�16YӜ�#W���U�,������TY'��v�Ae��t�Ċ`�>�̯X3q��i�I*WXT'�g����J�(A0~���$O�D[�m���Ж̸��㫮����APڅ�H�FZ$���%�u "�O�M:`����G�bD?��v�����!G���"��$lo���[�L�a��X�l��2��h�<��ZB�S�ש���j��-�x_�ͦ$!n�G��2��>2�n��Eď����e�}���Z�����(i�����?ns��`�q�о��u`2N(�Q_牳s��p�$A������ۛ��H�s��X��?p�$��b�����+T���4}���K�;x>e��Qf'���Ҽ�'UD{:D9���^2���1�x+,��[ȝ6 ,���ڴ"�a�nz�!�����Ym�Eڑ�R'�O��>w�J��o���s_�cn\p��u�k�ގy��2��S��m�Q����딻�gfM|����К��MF0D���_R����3D��ɲ��S��2�����D�S���ke�^�[x�=�=P_�K{�0:��N�����9H� ��Ӿ#�BMدC<�A��}���|���Ɨ������a ]�,���6R�Ĥ���q�̍_a��6���ep�Ra5v�X�z�����B������fJO\@���z��?n �&BB{8��:m��)m��[[xɕ�o����w��<cI��TӇs�J2�={���(l3y�aJmU�]U��% ��Og� AM�d���ieV?����(���*k*�S�Ax�$X�$��V���X�dq�TS�}�)c�=�ƎJ��L��'�:����� kg������?F���PlȪA��覔�q���Q������N�T��=�"����T��k��'��y�"�3_3&�� /���C�����3&�m�H��`�(�Zܲ�_�Fy�\�+�,����MAj�_�7��3z�����50 ��ȨV3٧K����3��1��O�DÎ h�!'���w�J����w���t _ncĢ|ɚ�R��|zFɏ���By�7�Z��� w���*0����v�$����?�����W4�J����Bp�X���K�Q�#���ۭ�������u9xY��v��y���d������_K.,��Uk=�����X�*�*y�L��[Vt�|�P)�su�fy��,��5=O�t�t��h�Lw/�Ӷ#�8#a�9$t���;8� ��xȧ;�[:R��(����)�P�ʕ7����$'�v(Ӊ^n��eX_�x�[wmi���l�<�J9�W��O�WB⏎���>-\��⭘-�r��K�� M�����]^-���<��c|֗`�����ybJ1_*Ź���:%Й�dtKEW� ��pDK��IS/ ��@&t�Ť�g+|ou28��N��`!q�A΄��Eq,�T�]!j�M�.�)ѭ���>R�u�z����bl��Y�)�Z ��1�5g�(�8b�T�T/�6d��_��oԌj�n����f1GUNG}���X)����������QYߺ7E�@y���+��]��}��ȹ?��3�.ڕ����V��.d��������r�H{c3�.k���VH"��v�=��� S!z@� ���\A�Ovj�n_)M���ĝ@��)�3>��-p���T�m���3�B�2�����5��P�K�k����HX�u�1c�R��D�l% <"�6'�#m|f��)X��5�g�����t@Bg"�T��p��ו��(���N� Y��:�\�ZbguƮ����(���0&�c1�zũ��+���u'SJ��\so����HF��M��Ftq&��~��5�]b8��� ���9�� ���,�9�����J�I���tf�v�ٚ�k�p#�@����&�'��"�!�7�7Gx*Aډ���=�0�3q�=�[�������w,p���XV�J��6h!6l���r��;*L��w�XC���:J���w��\|$�*�eXZ�٨+5�kDGr7����p���8*����Դ(Lra������M����1�I�&�~��$?���x���vj�]k;H'8}����U�٥��w�������̘���Tr��������0J����ʐD>��s�p�����Z��/�y�f��A��{��[0Lcf+��_���JH�"��v�F��T�33������~�����ž��,�� �/.[�D���M����d��\� ��]�'K������d����,��5;"i�eL�"n�}�q�hd�.`���s��I�鹮�DN��朞���Ȣb�H��K��=>�(��Q5����1|�`g]_f72�ZZd3*�
Static task
static1
Behavioral task
behavioral1
Sample
79df02e2e38e741d3807593a615e8b46a4234dcb0fb5307a348743aab7b72c52.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
79df02e2e38e741d3807593a615e8b46a4234dcb0fb5307a348743aab7b72c52.exe
Resource
win10v2004-20240221-en
General
-
Target
79df02e2e38e741d3807593a615e8b46a4234dcb0fb5307a348743aab7b72c52
-
Size
5.6MB
-
MD5
484ced06419d6797e5af5d11e3b6b62b
-
SHA1
0b01e75fbe5097ab142d7fdbe6206ea6b4a51e97
-
SHA256
79df02e2e38e741d3807593a615e8b46a4234dcb0fb5307a348743aab7b72c52
-
SHA512
7e941438194460b524bf8232036a2146e68b5663f74c309640aa01b6320c18fa988aeaed6053eca828599fb7c56e7d8756d83bbd02a45498e19c69184c426945
-
SSDEEP
98304:GANR2Moi6pdqPAV3rd6JI2BuQWssrK/qzw/juRarbm21nEUEJhv:FNB7at3AI2BRRsr2HwL2eJhv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79df02e2e38e741d3807593a615e8b46a4234dcb0fb5307a348743aab7b72c52
Files
-
79df02e2e38e741d3807593a615e8b46a4234dcb0fb5307a348743aab7b72c52.exe windows:5 windows x64 arch:x64
e8bdd864b56c11f82f3e097ae7f71e01
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AddVectoredExceptionHandler
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
___lc_codepage_func
user32
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 774KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE