աV)e0��q�uK��=�� A�%�W���T��6��0�I�M"�D|�;�\�B�Z����l�Eu��F���3��� �+ڌ�9�I�����O�z�KH����]�k�)t�V�@�9�0�ƙ@$�j���V��G��936�xf��w��F��*�W�^����9j�(6����V�(ω���8/�-B��@A���F��T�AI>��"��^�ב�cO��}My.b�R"�bw���[�K��@?�^���#+�A���9^DyjB@�x���]�vq�LԸ|�Kü:q0c� ~S��;Y{�Lx�p��7V������5�T6K�Y"2DxDu����W���Z��l��3Xt�m���hIޟ��l�ϝ�7�ߧ�g������5W���GB� G�G=a�\ەN!�x��MۚN�� ��R(iD�B��s�"M]��a�2mmj9C���W��K�~6���rpd���3� �_Z���A���.�8�y }ٓ�����):"�Z��r��3h�;�Җl�kX�eN�Ռ��߾����fv�V���&�'�zB Ew�h� 'ת�O��9}�3��I��o�����Jx�Y�`%.��Wh�a�:z��8%S��@�H�q�k�;�{t��X��x9���dK��$Fw�\]��� �c�q��[Kb�� �\�s�>A9G���.��8k��!V����=|�{in;�]P�F� �^�05�����r�+��s�\��ʿt>�Q?���t������i?K'k4��e J�Rƛ���eG��Zt�$ˍ� ��H����F��c���������(�%�J�Ҝ]L�$�\O�mRI�k�x�&�#/�5��)��k#�v�evgӔ?��?���)rf�z-��Qy�h)��%� �� A�Ɍv�_�R�{���0C�~cN��R�Ssm%6$Tg/�f�?�x���p�C��-먀j��cm6Z�nO��^ɛQĝT+L�e~S���,1��$C?����d���w�E�����nWe y���o� �����a���Eңl-��ę�гh3J~�2�\1�QX���39ͥ�$cҐ�GhG��T��5's'�/�|��կ9r3&��N���y���Bq��]� <~�*7KȤ̶���B'����?�8�O�3��'��j��;���-C��2�X_[����!���߬� K�C��w� �����$�JhG�!��3>OB�0�@�ql����9S ����z}��E���?�,��F�� ����H8�HIT�ܙ���/y��[a�a`+ן��PI�-b�w�0��aǣ[�"���:�tJ�hA��6sĖY��%�K�[F[.um٨!lu��Cm{{�;�҃��q��m�l�W=��4�R�L�LW������6����W���W^"ۭR D�v����ɤ������v��ASwgA���]p C1��>_�|��'׃�^~��d�k�K�"�FK&ꭟ��KWy�X�5������ty�q�ϔ�Cs/k�� �"pt��P�>�a�t�<Jc�#]�5��$�T���]6���m���"��x��Q,��-\ˏ<V�8b/�M�Ѧz��))�C*�/ۂ�(���~��vc�/�b�;I�O���QR�C�FY��8��@�D/6^�F$���������끕�Q��|+�vU6R�6i<�rɿn䦨��(�5>�!m�V���� &y�pCWF9�H,��fWI���d���E?u��|p/ �y'�7����to�NP}S�|8 ��HgW�>M�R2�"(��E�%R㝾�ij �]o��ы?m�Ԛ��W51@h��~ m�7"�v!k{��y���3tmBm���s�6@ ��N����<��A:����6���VQ���'�4��0Ek��.��t�VB� �ݩňT�:J��7�v�9WE����� >cG��1IR��q���qz��]�#E�xAb�7OT���ʈ��(S�ٔ����_�9#œ�=癯ٜ�G����b�C����#�+��3���.�#6ns��l��֕��M��b_����[ �� ��4(�G����c�3���o��=?#!�q"|6�;T���c�H2�c0�e���(��8��h.`<!O"�s��Ļf�^Mб�e��w'0:2�W`op��[�ZS�����&�@>כ��=�>��*���B�\�X���J��f9ʖP4Mz��������� n���S�CjbN�������/K��kk&���Uv�j@�/:h�������4v��`�q�M�'��#��>�L��XzF(�a�sv>߄��)IL1@��@���`7F�7�Iz���h��.��"K4,H�������#��ưp��q[M�A�O�f9 EȲ���რd&Hǖ���|[�/u��ONx�J*}���2?I���ú?n��d��XB��L�/H3YXhI��3��]ɿ�{f�/|7�CZ��gs��%�����N�׳�"Wh�#�:�J#@�\��.�^�n��jn0�^�_V6���Hc�zQ��E��Ƒ�3k�IN����4����4J�������<ߜ�H2 �t��;�����x��`g� ������ن�j���#�%`�P<����x5��/��&�'s;��U�PJT��?�N�K��D�0�v&ln����jx��.C�p��r{̴��w��Ħ�%�(�k�����W�A�?�ڜ����J����_B��ؤk�l#�Tu�\k�|?ߞ3r�.FY�@FK8� ma��=��R���WY7��4�D��0K.���k�[���Sw��Fi�_�h0�J>6�q�o��zN�n�Nk�)#]��](�M�w��9�_�"���TyBˋܐ���C�X��ȓ�Ǡ��W��}?ʷ <��w�h�`�Kx����\��@�!~���&�!+�B\��4ח��� �ӓ"g���m����+��H��� �xh����C�(Z%f*\a�x(]X��9P���HD�xSq��u�{���2 ���U��V<'q�epAy�E����t���e�SzĠ��њ�����'~���!�V��O(���;
Static task
static1
Behavioral task
behavioral1
Sample
ad29423965704aa9ac4ee87971e26bfe.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ad29423965704aa9ac4ee87971e26bfe.exe
Resource
win10v2004-20240226-en
General
-
Target
ad29423965704aa9ac4ee87971e26bfe
-
Size
5.2MB
-
MD5
ad29423965704aa9ac4ee87971e26bfe
-
SHA1
6ba9ae5144b0633eab4a99bc8939f2cfff4c16f2
-
SHA256
fec6fe79dc743e17fbe57b13dcabba1ce67951a6f14a6dc28ae783b248344dc9
-
SHA512
fdacba31641ff2acc931fa6bc27853bb4059925038685e392eb65ca659e0f95e3bf24c44a7d3d0cd12b3174c84a7344167534177d99d684555c63bec9877196b
-
SSDEEP
98304:6wQT3LK+QWLYVIJtD3JDqftKTM3Cnm7qhIdS4lqr/eRHIufDZPFTFNM:6wkLTQWLYVk3Qsdm2hdeRo4ZNR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad29423965704aa9ac4ee87971e26bfe
Files
-
ad29423965704aa9ac4ee87971e26bfe.exe windows:6 windows x64 arch:x64
7b4ec9898c07dd9ad1e645ec28b8e4c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleWindow
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
DeleteService
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
d3dx11_43
D3DX11CompileFromMemory
imm32
ImmReleaseContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 327KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MONSTER Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MONSTER Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 225KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ