�� �ϩ-�S��O"M����ge���-u�����tJ�z����M�Bf��6hBI�L��:�bf��Un��b!<��}�}��/B�i ec����n��y4;a���q����}M@���r� ���k[̾ʞ�F������s�KQPR�����p��s���Bps��z�r{űT�H3y���P��׆kH.�M��cAi�Y� X6��Lj��3�?��P�� ��W�C����kJE�*�z�_��+aX���'�P�|��Lb�����9��\�J% |P�k�(F@:���;t����Z ��гc�w����*�����q#�ţz�]�&�d��nS*CV�ze��\~�0�����αg�B�����M�x$ �=���j�7��濳�& �i��u�G*anw�҈I3��t����H�ߎ2�[������h�2�m��jܨe�}-Ȍ��_,�}[����y];�����v�� T�i�mr� ��n���gL�a hn�Q.�"c\v��P�H\!˛H}�c���� Z �}�I��8�"��X���r� -z����|���X�]�C�d�J�^�n듛3r�ڜ�_ۼ$W'ij�#��"+�9l����5�����9�w�0!�������V���O�g!9>.����^�q���/�4A������I.zi�s|[�o� ]��!�4���)���]z��0H�v�V4�|~��cBV�������3���B�GXu�*i�K�ڧ��aqWf��,$�09���k���ѧ+z����&�L�)�p��S!A!u<�#�w�%�y��ж����'n���2�������L�v랂��"�1 �������� _�4?��P�:�*���օ��5�jD��;9�잦��'�U/p����N�K�Mx1姌�8��&������;%l��FZE�FA�"q���.}���+P���� �Y�սEw�5<���e���������Z�41:S7hH�V�j���À ~7��7շ��LS���^� ��� ����!FM�C�s�!lJ�9wYCfY2��J���p����� ��>�lݷ��8ru��ڦ!.|����$��w����5��#���[o;�Lii4��3:7��`�\+ ����}�N��`��?2��wd>g�0c� �(��hqJvF�����4d���x�7'dˤ[�џ3Q���E�x���/��b�ƾ2����� ����Y�Hm.0�}A}w�!���p_�)١,'l�B�9�}u��l 9�-��f��6���fvC�t9ܸD���C�}n��Sֵ����[@�h^9�L�(&�ˉ��#���l�1�i�ٴ��BQH�������ɮ�(����?j��A0ET�(��P��v_��a�a�y������lL�3���I�bs�ء��;!"Ç?̈́r?M��a��ٕK*��~+�L�C� ����x��ҸY�fܩ7���k�Q�i^�����\拓��H�߯��l=%�!�G&����U8�Ҷ!`-R|��>q��z�f�'s�����N�\���t��>���luݧ՝EA㝅�J�p��_�m��/��[m<R��$� �k��H�@�=��r��0��� 98��z~�;���R�D���<��2b��H����WR�����ybE�H�$�:X�ك�������\P��`j �f%�}�"�q�>�K�� )G��O��#� ���e!�5�� ��k��|Q��\���� d�����I�j���X׳zC}��Vyf/ZNitg0G�3Χ٣'�McE#x��!��ʩ����xjW�nB-�-�e?��˛:! ����jLt<\��3����^�{� �Ъ�Ώ/!>9�N�L��i7S�+�D����c]6�)��mK�>`L �a� �7�9n��!zjc#�3F���]�S���riNR�B~O�q2����20Y�B�TU�O ���T�p��fAnw<[́�lVQf3@vj7��������G0b@���E/̯��?���^s�Õyf���{�L�hPh�v�[�de1��'�Jl��0��L:��rT�LL��*s���[�2U��;c��脠Π#������d��O�W�s��Ȉ`T���tJ��a��/��]kC��uT��J��e�v`ݬO߀�����sA����p$�:�ҙ0�KxN�-�~��W�|�u��d�e.�~�b���o�d�G�n7�(GI9��H��@� �)Z�O�8���]տ!x��]���A6�E;���b>F4��Ѱ2A9|-|#�T���@�#�/m���_��J���v�t ����\u��-w�!�1g<�oo��5�F�!w�@6�9�?�ȥ�x���:��1�1�������M&�P1� �Q�CL�,��4$LL�JA�2r6��ޭZ�h�ƕ;R9�^���_�nݜ�;���ފ(�X~\З�q;u��k�f[a�S6g�?W����sj#%��V�eS���.33�i��z`%$�R\L�~BqN>�I\S5dE��x��S|6'D �]�ȟ�|��!Ds��]0@���t��V���]��*E&��S�������a<��{�Bi��"�lq�e��Ћ�M��;�m-��"���|l~6�L�lξ��7`�N�0rZ�^������#V,6"�̏Ԏj�y]u�ڏ��r�Ѭ��M{�%���U��d߰[��zp�m�]�,������e�������V,����8�_g���l��+͌�O~|9��+"�:������i�[���5����q�m����)`�`]�s��,�Wf��s�G+@��{"�ؤ�M�{c�L����g�Xى�|N�t�0�]�,�V_��9�}��*��hor������>h�̶�SӴƒ :Fq�L)��6�go7,�C�ɬۙI���߆��)$k[����u�O��پ-���8mlM���c��߾xR�C��t�i�y����<I�NT�|�=��I� �#� R�W�)��]��VQk�T/��i���`N����SG��Y�[^Թ.��i�P��
Static task
static1
Behavioral task
behavioral1
Sample
hwid_get.exe
Resource
win11-20240221-en
General
-
Target
hwid_get.exe
-
Size
5.5MB
-
MD5
7621ea85028502c91a7554e9de65661d
-
SHA1
321684ad00246673cedb70ac06d07a06a7be8bf4
-
SHA256
c3cd814e24332499f4893f5ba58ff1c3f30be33fce9f8738d037395afc640581
-
SHA512
faeaa8dddeaf622307c61f82fc8f5602007babdb1b7b74014b8297257dced6473d17a0995c97d5fc96f9ce1ecb16571d2a6883ffe8a32302543eaea9e8df9a21
-
SSDEEP
98304:uenGwawmQUOP7NFX+jzPBPMrIUb+OPlkPjhsL:ulJOPpFuvPBmUOPMj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hwid_get.exe
Files
-
hwid_get.exe.exe windows:6 windows x64 arch:x64
8b4e3bfeb762d9073d97e5e1e0526213
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
imm32
ImmReleaseContext
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cocaine Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cocaine Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ