��r#\�F�9�ͽl�7E#k�Z��CZ���j��`(<p*��CE�X�!��D]k�uo��zV�ơ�M��z=O*=6 �9�|�j�0p��q����\L�y�@�����><��fGJP�ی�CR?�] ����Jv��g�����am}Ð�w~�i*Q�� ����V�Yp W�\e�6:������HB��P_��ם��p;���ҵB�;f)zP{�؇�z1gL���N�e����E{��n��A���0��ڰȭ���Ϸ�=\c�%�:�DŽ��/#��V� (*s ��K0��>�����ι* �$�����1�V�~�[�Z�.���9Y�5dŔ�rX�u�����@)�L`4�4hu��yԝ'��~p���b<���-kǖ���i�sq;�4L�(wp�|7�\��G���/gg��``(/����N�r�r?\K��U3;Fhr���w"w�T���|� ê�z�j�9֮crc���oP���ND�OO�:vj!��çn�j�Ţ��4�Lp�m��1����� ���Ͼ�gЅ$"3�:�;�$h���VA'�A�)<�҅���:L��9�OlL@��,��/�yrJ}|�^cV;Y��UD���N��*F����~a7r�l��s����b�����rښ�cGU��x�q�9��z���" �8�]�X��F���0_n!���Fٝi?K#v�H89�K{�A� ���Eq����E���נ���B��7.L�s�����ʛ�!r79�ݙ�J�P��=<o_{hhTDq��5����|����c�f3{�]W&�Ѿ��\I1ۧE�)�!���v�me��G�Q_��2\��5qh����}�UGCX����,]�ģ�qT]���q���KӢ���ap�É(��� ���J{��%M���QXy�,�5q��2�qcdݝ���Zd��O�ir��Q��e7y���&��%�l�e{�|wD3��er�ƪ�����eXT�J���Xx�:h.�S`m��� ��!�f�8>R�����y��Vu$?N�$d��xԴ�S�ʄ#��:Q��v�ۃ��ӻ�P2��7�[ܹ5��$��r/��{z��菜�M�����AA�| w���������>�ϗ��t��U�9S�j�b�'���.6^���#V�V�n��̉d��Q�9���vU��m1�pE��v�|Z�|AvR}�7�����d������M���;��w�]]~K"HuzME�����ߒ������z�\�sz�L:r�����T���? ��c�Ł̏2F���rۛ]�_���N���x.S�w��|o4��kXIri���e)p9����E����2rV���yx(���n����Nb��з��U�>�]?R~�fZ�pӰ�Dͧ�M�"�Z��ް.���Z8)Os�Ĕl9f�g;U��2;�weF��hNJt̴\`�&a'B����UQL=n�*�:����$�ش��N�#>���6W�d�nE�NJ>��h��o���]j� N�՞�X�!P9B5kB��8W���F�����j�Aջ���u���>v�H ��g^��� �YK�S�Vb~q�xp@�x�@��� �_�6\�L ��_��X*�����I�+�l?/+��6�ח�6�#������:�6#�zg�=�� ~80>B9��E�x�DLR�A�wh(ngjuD�=o9�_Vs�'~�3Z���y�/<b3�����I�\���A����aװ�}=4�09p���š��\��!~hG������R����VDS�ˊ�Q{�CQ��`l�0�g1���T�4���$��<)��x,���Ќ��cj�H���o]��_����hN'��^3�Թ�7��� C������h�M�'?���$�Id�|z�a!5��PY:ή3��"��,�5�s!$Q��Ǵ�d"�wv� L��l�D�[�FG�z���j&??��X��}�҈� d[�/v1�����N"�\�r� >���:�}K���."�h�_��� �(�wf�"�<i�����O��-bq�/��a�X���B����--@~�n!�Yo|F�.r]GU�qA@eӽ���/�L?j��f���Q�*c�Ou�_&>��6�̢CQ����G> ��w=�g��K ,���S��I��/\o����ٖK٣��M͗�1��Ź,�5ž�\ުaِ����*ju2��> �+�zÆ��Ik���l�k�T��܍6$�������D���I�(f�����{9tm��1���r�ý�}l�Y��i��p� ��g%;�R�>s�(&�d���P7��Yu��>��8�C�*��K��Oйϒ��ɴ�%�-k���x��� ���ˋ��`�L\�ؼ�0Ry��"�W]˚�\{��W������������3��5��8��>���0t^q����sq.�`��%ʡ�^��4F�sS�U����at�Za$L��8����8zn _�@��7~����~� yt|��M\�s:��j�]�r�ֺ�b�iu�����Q#��kk���j��,�5���)[��D��j�Ї���$��8��삢K��lK�b|iJ��VTB^E�� T�0��cJ�r�`?-^<��Շ���Sp���~��f���H��<v�\(wx�Z}5���IBC�r�̂94��f*��@�@$g�L$*����-��_rx����)Q��� �g���=[�>�7���Ȫ�l�"�%��}!~����ei�0X.i�!�`9�#�F����O�� wEc"���=?"7��|ߗ�`�uB��W��mD�Wx�P\���x$��c���-��a�����k��u+L/��/gK�/!]Fs���|���.H��Es��#�q�� 2��-� ���|�s���[R���Y�<rU����<@��w*��J=SEӾ�U|eHg�����v u�T��ן��wo�'��������A�W"3q�_���s���IG�$�@K':�eIc����|U-��I̲tN+2c`Z��L ȋW#���h�A����=���� e��5��� ��x��w�pV�2zU���0i��J��-�в,��L�Ln W�2��{���
Static task
static1
Behavioral task
behavioral1
Sample
ba986390adb3e2a07e4722ad7301782a.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ba986390adb3e2a07e4722ad7301782a.exe
Resource
win10v2004-20240226-en
General
-
Target
ba986390adb3e2a07e4722ad7301782a
-
Size
4.3MB
-
MD5
ba986390adb3e2a07e4722ad7301782a
-
SHA1
5c8e25257cbca207e901dfb28078e19c90dab375
-
SHA256
ff14ac60b2151d239f15f021a1e6cf0420afc815bfce3bf7dc6eeb9a63d66077
-
SHA512
bdc7984c906c9639febf0347cae2c179559a8c91d6e75a9ba455ecb8fb8eed85c6bcb1b07f07c4f3205c2bc510038976904e284089a17b6796c73d6ab099823d
-
SSDEEP
98304:R1jKU5ta2BciHyjNzKhmEQPF0qGkcA+TKZgKAA:RlSMyjNzKhmEO0qGkc7KZHAA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba986390adb3e2a07e4722ad7301782a
Files
-
ba986390adb3e2a07e4722ad7301782a.exe windows:6 windows x86 arch:x86
03d4f4723dfa9a980bd62aedbdc6ed3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowExW
CharUpperBuffW
advapi32
CryptGenRandom
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
dwmapi
DwmExtendFrameIntoClientArea
shlwapi
PathFileExistsA
urlmon
URLDownloadToFileA
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
d3dx11_43
D3DX11CompileFromMemory
ws2_32
gethostname
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertEnumCertificatesInStore
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 906KB - Virtual size: 905KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ