д�" �j�p<$�<�г�HK���:��S���Í�i8 UU_W1�|��: ��$����t����)�G���A����~f�ݳ�klR$��W࣒\@��Eެ-�lآIqg������ք�g�.�Խȉ:C9�=���L�F`����jJfT����B���������&�,��,��c2&p�dT��� e�V��`q�~g�)�r��qPM��!��Z�w$�$��;����;&a�[$vVE[A�4fFz�O;�f� X��������fum�U���GI��Ӏk���e��?IBB?[b�DF%͒i��3`�q�x�D�,L��ןmd1�H�L����t_�m�ߺ�'��z�N�`;��]�� �\�u��؆]=�?���c���5=�̥��'��S.l�"k�`��납]Bc͵���N`?WWCÕx�^�_0�������K������E�Z�,\�9`��%9�`A���!c3�8�L!C�Py ���e3��5]E�������ck߅��<�6�}�����#��I̼�d���i��F��a�p2�3:�!)Oe�v�i{��g�o�*Q���fbYb�j&��g�!H��R,��S�dM��W�%=^�SLa�����SO���G��lVI�����틭�̭IN�����B�Dx%AG�9Đ���V�O5��j���}�!��*����nnA���8�Gt��8���� d%BmD��-B~�3����7'��f�`��2�^��H����C�~�����W}�.S"_<i[�a�����F���exI���bj�*hg�9 r��Î��9IK�)��"e��2���D���C���a-F1��m(���C�K������"ܠ�����4��5��ﻵ@�L��{#~��MMG7�V� ���A¹���F�G��#�*�v�$��?�M��V)��c{����Mj��8��h�3���D��M7J���yvb�h����li��k?�aU�e�w��a[#u]!�B��ưa��� �c�fZDD��?�������")S��qm\��/�4Q ��4qA�%s��-�\�#�#~�ѣ��7c��3�A�q_!@��B*��+��)�\6��<R���6ί�4Ρ����ܝ�+No���Z;��K��A���(�8�Si�v���z�2wj�}�7�~��p�5!���m���'������k�_�aDK�2b�e@q��s;�1Կ��x"�>AƊ~l���=* u�W�tU.�^]�P��*��s`��ewlA;� �;����I��=��50e��Ǧ�A+��Ǟ�M�����[-S�<BC�;~�� ����j���6)+d�8��!!!���zHc,ԫc2,z7�S����R�nD�1�rp`ޚ2��$����?����q�u�JI{ةh��kgХH9W�f�)2�ڱ��4P��#I�BȗE�-����G�`�- KJ�,�쟾�ЬU�4� ���{@�*y��֪�z�E�ԃ�AQt����qA�Z6�}o�>hԴFJ۵�g����א��\D���?������5S��O���.��0n��O��D*0�Z"�ߙ�HMzB+Ҁ�0[�2>��%�t��v���g�� 䇿HW��L�=ۊ�\y�_E-�vp�5����*�h �=��ޭLA�B|�3��t��,�{x��d��P2ru������|b@y��ɰ�k���<���7�*>�Eu0���@f/P�M�����C�C�~��������?�9��=>5ϋ_�(��Y!�j��7�H��qiA!�O�6.�O���O5�s�+��b;���o��|��/4��+�*��?�xπ�WO�����Fk����H���`���I!��i�ߠ�����qGaC������ Ɵƺ笆�<(�,%���J|h�D�,(���ȍR9]@d�w�����,��vrp�Ep"�㷝н���N������9k�^W��y׳%G*j_5E� \[u�̪x��@L�4��=[�ՓA�����\;�3��4"�XR��+�ӛ�S��+4��b(q%��T|�W�`=��0y�>� k1�0k�X9}fB���Q���+}�l8JBi��y�5Y~ �3�]�,��4�M}���jӻlP5DF��(��9f1Z��p�a�R��)dz�����A\n��#������.����d*1�tz����|� ����oQе�QϮu^���6@���{P7`eG?]���q-����v�u�P���~�R#���85q�Ď������� u�5���*�*'y���X���G��7z��8��J0g��9�9����2�� ���zf|��5Oڕ�ש��';���9�s����zF����NY�o�W�s0�}�<�a1%�;�H����s]�Ѣ�_�֘nۭ�e/u�>�����>>���!Z;�(?9�#�2a��͋�����H�������k���KD]{���sf0Qm��5��F��m���.%¨+f�?�E/�ߌ� �=<�����-��j�i1>�KGwީi��$"^X����n>l0�Vu�9�u�c�{�1".*���uv���d=/�|��[rS�w������Q�Ôw����@��o��Q)����KG=�$N�*n%�2� Ѩ$�z?n�Kb����G@�v-? �3.�]��X%E���I�M-,ʬ5�Zn ����ofzo[Q���PJgl#���6�SO.Ӡ3>��� �Şr�L������fK��_oQ������1C�$������3V��&�>)�R����VP+��C�)4֮��F���Lʞ����kwP��F ��z���1���$u's-�-1c����o�|������_�8i��4b#uC��T���c�,�z?��� ~/�p{��zx�D���_M}�9ظTH�<(^����P����Zғ� �b�|��Egj�Ù����dW�8�]"��Y���T �/���K�7�VO��}3����s���x��e�7F���ܛ�����*���t ���~+��/�̪�iPpv��8������mQ��P��e�Cgt�Rsii ����\vM��R���m��{��A�DR
Static task
static1
Behavioral task
behavioral1
Sample
38f044a8996edbb456120ef269fa1b64.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
38f044a8996edbb456120ef269fa1b64.exe
Resource
win10v2004-20240221-en
General
-
Target
38f044a8996edbb456120ef269fa1b64.bin
-
Size
5.6MB
-
MD5
38f044a8996edbb456120ef269fa1b64
-
SHA1
5332e35cd1ffb401ad6c21b26fa28a6a0290a8d7
-
SHA256
3618a0cbfedabd4176e7f7d03d55a58311be734471312dac076c838d909de8bd
-
SHA512
adc1510d560992e6b0775d0b29dc4e4787756769cf4859eea175c9d8445553231f2c301f8a2d30a67ac598849674d141a4dceff2e1dbc00f9205ec6e0a812be9
-
SSDEEP
98304:d3fPFBkmpUXCLtLDAsBCB5sLhm8MHgrYHNowaB/beeknIwRivvyxy8MeQX:dnrkmuXCp1BK8hm8MHV+hTBMiXyoNe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38f044a8996edbb456120ef269fa1b64.bin
Files
-
38f044a8996edbb456120ef269fa1b64.bin.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ