���ncV�Z����`����������Z��������$�X^��V�'�+�ey�þS���e:(������L��`/VU15J�o>E��"�XGfH��F ���6�KK�>�g������4���xň#D�eU&~�n�`��d''i>�Ac*}V��A��D�lp�2`�ʘ�TW�����;DWo� !���.[����܃s��N;m�o��O!�}�l�ꐰ�Bq��م.J�'���F�W��}�%G���qhd��{ ��"��`"\D����e��l������ً��9<a�33̸�r�U��ϊ��f�����mZ�dW똄����U�[��C��k��/<�R�����2{d� �oy���s6X<Yzu���oA U*�Bn̊)!m�k�)��y�d��/N�J�Fo��[(��=��^�="�_@�n=ⶭ�B�:�����wdaRs�W���x|J���krBY�%�z ��|>RB���SVJ=pV�r��i���5�Y�l~����?�� �a<���te�+E�X�ͭ���}�Ű���l�ڡ8"U���C �G+GMɖ{i���^d:r����W>S�m�z��������>��R��j������[Y3�Gf�ㅓ��(C���T��$U�#�����h��!����A@m��ӹ��);���=� �j�V�=I=.�P�8_C����X����{�������HJ�l��r���hꍊ�ѯ�"���7��W���X,���|/�_�'�tMD;։�Ԡ�bLk�;S�,�L>�����ы����_s/�s���*l�J�m��Ċ�)���tD���_����V�Ia͎��Ls�N�������Dt.+���~(r�&��O���%F ��4ϓج��"� &BG�{Ăqv�#d�@��������(�/B��.H�2ҽ��瘝�3]����)}�߆�FW:���Ue�I\x���[��}�&�^y^0D>��3z��x�wv�����LM�x:��&�1�EK/��~��m[bXz'4迂��=��`�� p\`/��5�L����ck��e����R�!��@ >kұ�&!R��:h�qX����(�m������b��J��x�g_'+�`�*"WA\C�2çg�jB���g��6�[7��Yr��SVc�6��TO�<Aڤ"���9Q�`5��A: w.�Kh[�p맘��j�!��YPj;���I]rO��.�k�N�6v�C���W��r�3���[������R��Om��?�0������+~[�<1�_}�N�2���y,���U,����$����xDfƋ��k����<�D����&�s����]0~�c���ꜹ80ɦ����������T����ʨ_�l�ږ�����W�0�����2�F�(z��mt���ɡ@�'Թd-D�dٮ�q�_8&�`���Z.t� �BdC�cQK���9 �������5���_�`�� ��T��{1���ERɧ�_J_�����D� �#������?�� T4n���x����j�9CĞ���B��K���v�ǭ�a}��Vb�Ί�s֑v���@��Z\8��ˉ�*"����+r���J?�uP���7M��,��3|O���#���^Eٕ?��^Y�B����|�W3� ���M\�]Z��� E_1ûԌےΙ1wG����O�r�Y]�l������,�F�mS�S`*�*$����kS'�$���ugM�L!uY��M�ʮ띑����� ����q�+Ф[��u�H-�6�+�%���w�:��� sA��t����-�����w�a>_� 6����>C�m��'WZ:�<�M��"]_.��h~`�"X8��@���i��.�X���M��A�N��Aډ�}�^�F�/�W�q��&��"����E�7�{E6DV�ۂ��˯�O�aƍD��$/�%�V�a�s��NJl |U�1�L�<Fgkv`J� ��O N���!�m���Lp ~,n ���0��;lO�$�mP� �/d������=�n�Ĕ����T ə�JG��<����a������qɌ�߆:���?���+�0+�� �E}Jp� ���+�G���3�>�A�z����]�>��t\�M�z���ۉ5yb����ض�}���Q�8UòS���G��oV����"�G���O��D�ft��e{j9����m�!u$�2� ���٩���d7����#�ۤ=�>H�D�"�~f�e�3��Nպ��ȱ���[T�YC�!���u�h8䝦����`�Zi�!�\w����А�CkO}h��F�FA,g��k���+���z����N���O�1��%-tSP;����ۉ-<��<Մ_U�W��eI����KX,//:>�-�`��K����QY�����)����y�������0�VK_(��<O0"3��ܭ#%黸���R<Suc@��y�Id�j���0Gt�V�W�`d����=����W�dn��0��)h�PJH�H��.�����Eb�k�M5?�� ���������$Ɩ���얩�ȓlu#�~p!5���}����ͮ&J�6�Ђ���'�TJ"ԛ2a������J!�"X!����b�m��R ��t[��Ӱ���������m��H`</ ��& @#�D0+w� ͯJs�J���?��)6����^R1�D3RRĘ�D���r�s�5;�,=��O�[�~�s���O�u@�RXo����x�8��I���&A6�_���l�����H�Ĭ(\��;��^��◪�p `����_{U����a�^�OWl BDѯ��u.�$��&�ߋ�� ��Z��1�S���4&9ir>��FF��f�����~\Ha�ւ��Nn�%�� ڀ����q��O͛�~�i���^y�����uE��ۖT�o ��f3�H@ZE{O�^)��s����R�~ڼ��״e�;ת~!�띷�vG,��M̥�B�����w�H�va���f�p����&��Q ?ץ���\��ľ�I>�@p����B�jLhfx�H����Rx��W|<��O��'��ll�
Static task
static1
Behavioral task
behavioral1
Sample
4cf480720637a245799e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4cf480720637a245799e.exe
Resource
win10v2004-20240221-en
General
-
Target
4cf480720637a245799e.exe
-
Size
8.2MB
-
MD5
06272cc92549b6cea1aefb60bde796d6
-
SHA1
9cd0beb989ffcc1eafb7d7354a94d8ec3d105696
-
SHA256
5c760b1dc03d1ac7664fbf66547b18296a53b71b0b652f4aedb01dd0971a2643
-
SHA512
0d098866390bfc5128214a587c00209ae74b8ddc7c33dae9ee983e2f561f43f110406ee30b7bbe0383b0392f3167c92048762483666e4911ec738015af7f5b9e
-
SSDEEP
196608:v0SGEOeixN4I447tph6jzQDnLN2sAdc0/n0oH:eHxuI4m+on5odcmNH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cf480720637a245799e.exe
Files
-
4cf480720637a245799e.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 997KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 529KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.@,M Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sMc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WTE Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ