�3n77ri%�a �"� eRt��_[�|E�Xf,W2��8l@���s�����5E�}r�}�q/��w�4<�W�㭎�R��ת�����9˱*�f��\�f'��?L�C���f[��G��V��}���?Y ���&�6�}�� "6QL�M^lW��u���3�US�Ph-���� D\� i�>���EZ�[HXIh;���ѽj=;�*��[N�˔ D�߱���ԵXDa���^盂'M�<_�0;�U��X�G�.HM����Ƚ5r+W�a�"e��RJ[Ef{A�L�=!�� Bp�LټS���7m'�E[��y[*F\b^D�a�?�v���u���I1RWxuC��6�}��N���:Hc���Z�C)�3b�1��O�/���4�]��j�qm')��L2~���[HZ�{�5@�;��FR������� ��o�9G��|���-� oOM$x[��E�Mw�Ε����YA�_���b�F=����a�S`'����|u��"�!�����f5`�)��'�Шil��;�F�Z����b���k�7��%�ު�������yg�J�l@l6�%d� a'��P�/�������?2l1�u�>1C�Yȵ2V: �nD{��D��M�Ҷna�����R������Y@�N�����E}t�˓�H�̩��z���@�!���n�/<W��U�����FӚ��3���}d�%9g%U�� +��.���:�����ͻW��,����~d>�[ק������Ըm�3�-\�ʈ{��H���B'�Q���t��3�+�������F�7���k�|�����e�H!:';���;���L����N����n�ɸg���Ql�D��&'�Yw��� 20O?Q���r�\�y��Z{V���!x<�X����b�g����>˙�C��(��Y���WCh�kI)�dN��v ���C� [���9�*�O��O�:���t5����[^�h�^LJܕR��Y}�|@6�/q+��%�T�H�s\兗艪���j냙蒪�ّb��ڗ�w�o���^?�=�!�N���������?&�,�m]> �W|Df���� �_?v4���f��M�U�nRw9-��j37t|�l�8��ա��a4`�UJ6u�y�W%6w��(J�.z�R��q���P7P���P� �"WE��̔��]�3A��]|�ܙ�ۘ�|�3�Ww�j����T���Κ�9>� =+Hd���Uj�:�u���Mo3K�T��K&z4R������ 4�o���ç%Yl$h֕>L�@�E��f�����t��t���Y�� �*�\��> ��#�z�A2<��Ғ�6���ᗱ���~�l. ٴ0�H�����[ *AVG�S��[!P��f�p��V�_��HF}/Қ`�S�� _3����/�qlj'��&Z�@��9|�;���ҙ7_'����I���@���!F� ֳ�7�j&^�vW3�����ʕ\l�'ƶ>R:��8��_?�ܹ�v��F^t����@�����y��-2�����뇁A�Ξ�z�?� �s���bq���Tͺ����2�s�4%n�������?����ダ�Dplޓ�^���tm\���e�� g^�1���~���3��C�����U�֛����_��Q�� ��f��C�:��2�N�N���X��$�;���ɂ ��P>����'N�q�t�qb{˺� #ruԊ`��ԇ��4��i~�~+^\P� �J�?��C���rj��`w�z �L��c��k��4�#�{L�V{���m� !�#6�������y:������.;s2�}=D𱬊�3#A-d�9�6�ԥ�hQKQb�C��m�Y[0�������'�Г���K�\h�l�+@����+e��&b;��*2��v��>��;�� ����R�����f��g�I-�+��r����`���>��B�=����u������i~��>�Kacr#l�@�H?<Ė��z���i���efP��Z*��-��+��i` ׄ�go}{i�W��I�a!6�^�G� q�n�X;\�?Z�����h�qs/K��J��>�K�<:5����� x�4K�=&7��J���Spq0�X�����C�9&f�dv�i�e\�A0��1����.E�GcP;8�J)�,��V����� )۩M��|ܨ1h�p1R �hm�����*�&i#����V�17�|��9�?S���\�G(9�Rtr���8쓖$������o�d��:�\\}��Rh�4A^���Z����?ܚ��Hi�� ���m��]RH��D�2�З�/�K���3Wc�uOy�D�\���˫0�xKb�B��M��yA�+�_�c�Rh0�"$��H��������G;����}eN�w��[�'��,і��u�V��C����g{���1�[��g�\��>`%S5���WwιL���r^�����PԻ7���ņ� -��蕴R����(S���9��|��rZ �3C���w���Y��D��ݩ[zru���C_]���ö���ԡ���sX@?��C��J��7>��cz<H�pZ�*�Eo�L���p��_+*�ds�+z|�v˽&�M:�z$qU�8��/�Ӄ���u����ʑ#IP~_��hr?��i;�� ��i�z9�4M%��5B:_B���W�D}�V:����v�r��:�ju�1�~�� �tu/+m�`�Wf��TA ���hY����π(%��r�ҩ�~��y�uE. n� �-�KW �m��P_@9���{���[@�Ϸ�ֆ5>�r|�m��%U�DUUZ�����V!������E*����0E<��5V� �����}��*���ű��E��;v.���e7C����������^tM�;�v�k�l�F�Շ�+����rh#)�;��]p�eQ}a�V��U���,^��uB+���*��&�XN+:�����o n���T�����C3�썍���2��y��<�,����9�Т`���B�ur�r��dcJ�BW�N;*��{@P(�oZ5F�6zzJ��Mj<�if���]�,���� Bk��)y}�]Y�~R�]���
Static task
static1
Behavioral task
behavioral1
Sample
d7f796b3ec37c4dd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d7f796b3ec37c4dd.exe
Resource
win10v2004-20240226-en
General
-
Target
d7f796b3ec37c4dd.zip
-
Size
47.2MB
-
MD5
f0f5e7ad369a206add7723be6284c64a
-
SHA1
1b7235f81bf7b61d227b32dfebc2f83635615872
-
SHA256
6dbfc941954d128e19b56cd948d48d6cc4224ef096d997a014dfe0d61a9c86d8
-
SHA512
a08543a9935af1b739cb4dd4127ecf18ba789ce6b5c7f2db79184e99a09eaba4bc6751b8235ebaabe6ff2087a79d15b3b6fa9194e260adc5457f578d3d607245
-
SSDEEP
786432:DxokJwfNhV8UH9+y0/ets42crVwgeDGQ/ce9qerabozXWlt8kXPi5KZxQ:DxokwLV8Uw/g24Sid+q70zGL815f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d7f796b3ec37c4dd.exe
Files
-
d7f796b3ec37c4dd.zip.zip
-
d7f796b3ec37c4dd.exe.exe windows:6 windows x64 arch:x64
56abeebc53b20f7fe5da45869224c879
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
SHGetFolderPathW
ole32
CoSetProxyBlanket
oleaut32
VariantClear
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertFreeCertificateChainEngine
ws2_32
WSAEnumNetworkEvents
shlwapi
StrStrW
wtsapi32
WTSSendMessageA
rpcrt4
UuidCreate
ntdll
NtQueryDirectoryObject
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
_fdopen
Exports
Exports
Sections
.text Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 939KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 43.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 47.2MB - Virtual size: 47.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ