���T<��*MT��V@ZgE�!*|b{g�~֙�5���������w�o&W�at�ў�?ƌ'e���禴%䅊���/*��t��I4o�0��%���N�r>B�|+�r�V��xz�O6�����+/X��5��3�"�}����xS�$�}�4]Q�̪�,h���k�������u+�9F�����v<M�F����]����H���Wk�/������|�~�F��T�N��@�\�����v��ũ�|�-ݾ�\x=�����x%���GU��ݡ��*! #d.����贋=�0�Mڨrg��T����)� ����lՐ�c3.�䋤E4��ra�KIq`�����OR��87������U�BKB ����^N����,��F�]*�!���P>p�JV�g��=Ue�+*���OW���&j���0����P���wZW�~�;m �D�1K,0��s��o�\c��жlF��+�Y.D��0p�)�`�� ���: ��:. ��?�ܤ�*�#?D�v{>����0�'�~�gPO� �7v���n�3���r��#�A �q��i�)�I~� !��"�/��L9=�iJ�S ���=��9f�sG<�^F��Yez�^�lM�T����:#�6ef�g�B[;�h���Ɛ6���*m��u�=,8�0�_��`~����r��m� p��Z�* @���m��*1g� ��:K��e��Y;��W�6Ck�6+k���4 �,�[��u;?���#�jU<ky���[�����-���{�k4���Ke&��|�"X�{�p�Ec�����8�TR�D���dqj8%�ג�&(�R�3ה�-h_Sn���%���z��$���U�B�����0���C��\P��λ�u3c=%������`:x��NͿL�%��f[�� %���f^[��@�X��[ "���Ğ�_�!"o��d��$�K��I$���c�`�� +�W��n�K���?G���}��ӓɏ��������Ɍ���2�!��l�� �Ԗ$lPo�˳ne�>qv���Aַ�<��*�Oy?�| +8 ��£��a�8h��e�f�7V��yv�i#�u3 �I��{�]��A��5����� ��a�i= �p8w��~g��~��?mxѴ��X*|MȂ���X\�f��S� xM%lmȨRh�aw�G�˥�W-��#�},�}u��H0�A�,�0�t��J#ߨÀ�L��'� �oh�9��Á���nr��`���^>�����#憈m���<�}���j�������\$⊭`j�l�� ���C�CW?��n.�^��f��c�֩��x�������є!�L}�����R~5W�fM �*ʫH���o��K�Pʺ�*����6>��H��p���G� �û2���>�4<�\�*�R;O�eO��5_��\5����I����s�64����3ſ�W�J��g�*_����)Sx�#�R������բ.�3�j�D�j�މ�c�ٯn����tu��p-<_�K:2��"��C���`��$���D.b�,��x�,e>��J4��7�#�M}rk�v��ˎ�b�W��w����<�<u+8@�h�R���Hȁ���Nj�� �W!?�5�6���Rd�@h�=d�_,Ev"���>a�%|t�Y�{ �U6=��#V!V�cQ^ !���H:����H�}R�mD��H� �}X��Ȟ��v���D�n�)B_J�J�M���+�†�;Z�h�1��y�0��W�]cp��2�]�5m����,ʎ�%�,���+�p��������[O��V4��6W\g,�D&h�!u4JůFt1r{*��C�����Ɋ+Hé=��%���Cgi��������H�⾡�y�y8�v��)�j��� �Ⱦ��z7��,dר`��pS������������g����=#�t��Y���1o��ǚ3*�0����u���i��������w��AStx��:�-�T*8ho]y��$�F�R(����$A.lqlN��ک1AW��Jo�F�~K�J7/k����`������5wyI�,��HH�:� �?�} ����n����=/o��������x��;ǑL��'���VX3�u�ۓ����Pڡ���a .�Z0Wl5���N������N���w��wx��K����m��APE���V����>�s�P?�O��ag��#�x鵏�������}B��T��(4B57��>Y>됇Ⴡ5P�f��������$h�q�b�1�Pf�bt7{��X$�����όI)�ɂbU��pi��~X=6N�kh =eU�f9B�K��\����$!�C���p� R�� ��lT��{X��S��t\�B� R����!Ԋ��J��:�ض%�b$xfjT�6Ô�d<�w���A��4�3��=�ᆖ�{�Ԅ�1-Ji�SL��Rۑ;��#�H��V�x��E�Ya����H���q����7hW�C�G�'g�9�_T�硽@pM�Q��3�|��1r�y''8\��X�,����-U�J�^�m,��o����0~D�����X�,i��Q�R3����� ̦�sij|I`GS�]1���&8� �����*�@Tcy�cva���X��3>��s���S�eL ��P�hzn�u|��U>��q�EX�l0�!�5�ҿ�ɳ��V�cgw>n����$��)O'�N�Pþ�"��:v5���R�Sw��� �_�כIv䮯��d���Eы����{ODl�U�FF���#s+X:�Q���vS��Ű_[������42��ۣ=iY�����ߪT2ݭ�*[j��f�ꀇccE��ą�3f~oz�ru�%o�����ޡ������ �K��L��6��p�lk�|������a�0��U��P����{�E ���ʴe�G٬w6�>�}ʓiԊ�1� ��;%���v�*oN�~u���9��vF0L���K����vu�<�i/���\8Rq��dZ��>��^{�'V�^��_!Xd�$�I�.�Yd)=꼺���W1�S��j�̠�7��K$
Static task
static1
Behavioral task
behavioral1
Sample
05988228f3269c248770032202ec079a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05988228f3269c248770032202ec079a.exe
Resource
win10v2004-20240226-en
General
-
Target
05988228f3269c248770032202ec079a.bin
-
Size
8.2MB
-
MD5
05988228f3269c248770032202ec079a
-
SHA1
02f8935c93bcbbbf5e601b4e59d69dc7f2f508ea
-
SHA256
9a155deed91118b73180f0294630d427d1e03d03a1421c8f6c47e413332753d4
-
SHA512
a23608c773ebe64f786484e5022fdbb57168620d9e499b9f3a8160614fdf037766194a1fa5d6a5715de5abe2d44859def5ef2d4aba7ec10a1e02f25eb1fe401a
-
SSDEEP
196608:TbdWZ0KhWN6z0ROSsHHEmV8w6rwRvqYb8erb/8JUnUmwQ:AZXhW8E0Hi0RS+8eEJUnUm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05988228f3269c248770032202ec079a.bin
Files
-
05988228f3269c248770032202ec079a.bin.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
. S% Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.'&f Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.D#C Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ