�6����e�q�kb� �m���, ��I��^=�\pו+�T($���G�È>����Кت+(��=�:�W+`Q�ѻ�����C�?�K���[�^�>�c��]�%�fo����o�ck���~�r�]C����AIJ�⍳�@V��D�1�pO�7�n���Fz����F\`pez�xQ�܁Ȅ�P)<F�j�zG5�C~%+l,24{ً���x������[#�ѩ���U�)�fE������e����od�)��/2@#ˮ,S~e���6-��T�d�=^�aMp�t�92�E���}�m{�����$s�H�^��3��^��,kN�A�=je�R8S�J�g���C��g���Q�^}��ը�Pļh�=������zݸ���&�� jB�9q�h�SG-\�1�:_v�C3i��.��2�9K��B��L�n�Qb#xM��n f��������1�2�b컇��a'աi.���6�f+_���^�vd8D%qr^/��\y��J�����}�l��8�0�K��ئ5���#Y��O�d�w\��}�O�?���W0D�2Y-�7�'�f�\����B�4��i�y���+)8�?����^��R��(y���"\�?��Q�6V����α[8Z9<�t'�-;L� �[���>�BH�]I��l�7����}d`_��I� ����s�+�p'�@V��\��`�K���u����ٴz\/0��F�7����-0nw� 5"�6t����%����l���tP_}b�:cr�(���io?�baG*�5�41�F��%����2����-9D�7A��j��g�4?�˾�P00����5;s�.$��x��5/Y<D�`Zt�����q���zoݍ�o���x(5�����x�&i�)�\.�Z��+��*�0}s�R�8U�Q��x�g��N]���:&�C�g���8�x��ig$��JQ��� P��n2ӻ�3�8[�v�RnV���o�ܩ�γ�4�M�l��tB�S}��Xgm�?p�%7J1o�n"+M�IJ�˒E-�m*|�2U�\F��<�#e�@��ה�ς�GN����v�%�c'm�W[�����:�M��' Mk�E# q���8Z�©X���T������Q�*ȿc���Ջ���vY��LA���R6��=��T��8��BM/w]�O4� �]1-��t!1}̝+�_����R���D�4C%�A���$~@T��ϩs�߯���PH`�a�d����c���y�E��ϖ�"�T�Y``Lw�)v��W�����C�*0�^A`��i����^1��K�h�iJut��(}�H��٘~-a���O+n�̷�;BUI�ЂH�"Ũ��B�~�1����jM���"1a����a|���\PI��a{�@�����u�Ep�-ƪ���6���5j~����f<\����.��*g�< ��Ϥ����M%!3��U��zX�3�Qh7�:"� 3}�gU��2!���l����h���W�����9� �t��r3E�}H�$7����72eSJ��ҥ�!9=̟�|�]gB���w/([��O)�h� ��"�I6NB��Tx�k���(�ʬ���{�Je�A'��H2>�M�7-�b�],�T��\��,� �����` }��2`��7� �J(��k��0c���d�!�Af��8�1a=?�v��?m��GQ���:� Im���l��������)���=�$�U[���TNV�}� ��1v���`�+{�Ʃ��Gԑm�gj(6j[ �5;����)��{@=�A� @�֣AL�2�@�g���u���)��A�k��#��gݵө���������Q��Ptq����&��TA�T�B�$_��%c�1�����D��}.զ4��\9�7t|�d��a��±ղ�^U_-+��H,Ͷ�D��s\dY��duRz�Y#������f2\��t������|��LWE]�3q��2W���%�=)�n���5L��ay�Q�.��ِٮ�1�^=d�=����8�!�z�ڹz�����M6���@���$��tI����������B�%a?����#�����/���Mr2�%5A8�,c�S]�����ĭL�S"��t>f���pm���ٮGP���%`"���\������(h��ɪԳ��R\v�*t*���Mf4�f��aݳ}}q�r�d7�vQ��g�ɓ��Ʊ� ���K%��#��T��'KG]�����},�%x�������X�{Y`�-�S�K��`E��qꥐ��VCƣ�w+�;���|�� ��*����\uei�����m<ꅟE,{�vE?@E�қU�sL��;K6�2�(�A�s��i8�4D�i]��y+����`�l*p���j��2{�R[%��e�ٲ���7B�Ho(����'�&��,oߊN@Bĵ�Ţ�4���5��s���IQ�ê�}�����>\��5�:*s4����?���vB� �n����%g��C����.(�$8�����+�h�i�q#3 �U ǽʄ�w�D����N���z�b��u���2�3@o��Wُ,�]�0��ц'��^ĩ�@YY*�4Di_�#<z�JF4�y}ѡDy��#`@a^�*kg"VyX�(���n^9�@4$}��\5��] �Db�r�E>�J��P�1D��WsJ��ZE��]�� k���A�>;��sr9��{L]lH��iIѴ�G#���8B���=�vÿ��%@CK�� 01U2�_���7|� ��4f�}�+K�?k9ؙ�B��ZLձa�3�'oה��NY��M�� $B�̓/ )b>Kx�pP�m�� ���b��O�j�zAӊh6��ؖmi!1w�'����/&^�AQ%��/3�>{dh���sd�B��"L���ք�*�6�`�)~&��?�7�Y��'XG[%��c�A��e qx����{阙�;/�����)gp�zJ���q,�S��س �1�^�a�Ʊk���9��g�F��~�_�������3�ԋA<4��:!��L<���I�0��fߎ�o�pUa�I9ge@h� >�b��nV:9�h�cO��=���U����k?�Lo��3
Static task
static1
Behavioral task
behavioral1
Sample
1v34.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1v34.exe
Resource
win10v2004-20240221-en
General
-
Target
1v34.exe
-
Size
36.4MB
-
MD5
91a2756980ca8c82cae8ffb1d2d51557
-
SHA1
520ba8f87b9083ed88a9568fe4f78bbfada5363b
-
SHA256
2ac48c3a446a4d32c39e0158974c3a8ddecd942127a5d681027528bba5c88207
-
SHA512
7dd577bcdcf2ba64774d1649884f3edcbd05e3f1836380803017461036f3a3e8bbd22c135ea0e8f4730c1081efca80de88e2c4e431564b93f864515fac0e6965
-
SSDEEP
786432:KPJleStirIIvkpwlluStn/3+2cLPhuTRUlVWaFQZ1sY+0pfOR:ghi8IMpwlNtWtLZutU3cBQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1v34.exe
Files
-
1v34.exe.exe windows:6 windows x64 arch:x64
a0ce8edcd31ec78f6ebfc4ffa39ba334
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileA
kernel32
GetNativeSystemInfo
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
CreateRectRgn
advapi32
RegOpenKeyA
shell32
ShellExecuteExA
msvcp140d
?__ExceptionPtrRethrow@@YAXPEBX@Z
wtsapi32
WTSEnumerateProcessesW
normaliz
IdnToAscii
wldap32
ord200
crypt32
CertOpenStore
ws2_32
htons
imm32
ImmGetContext
dwmapi
DwmGetColorizationColor
httpapi
HttpCreateUrlGroup
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140d
__std_type_info_destroy_list
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
toupper
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 949KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 337B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.{j( Size: - Virtual size: 58.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Qzn Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.h:r Size: 36.2MB - Virtual size: 36.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ