����j�}�:�˴�p��Δ���/4���f⽰��T�VE�1��� ��4Ff��_��p�n|�(�SN��k�������j0�;�$?�&������+�Q�hscMK6�u��3�~�����p�+-��V�#�4�>�X��@?6�F���[��(���T\"�P#���j*�B��P�Z�A��.~��P��J���ƃ��5�NgO�� P����%3�}��Y���j�;��ܯ��[�]oƜX5G;=P�~�&���Ycd}��%9�ƻ���,LK^�3�A�F��������4�w��� \B�Yt�/��o��a���8A�J���p�2~�/qr;��Y5oU,x�zP����(�sL�`�i_�5�� �Q��$��/'�U�� �������+=�z���E& H%��Z����H����^����Um�;+����ܿ!��>�g�A��l�������t���Z�O%��L�+���,n���Z� ;��T��0��:Z��=�����yp_�ܚY��-�e|{�qpE���ő��Y9�t2*������晞a�x�\�Ҙj�A�"��{f�KH4�́i"}��>h�ף��� �-e��bJU��J��xRIH�Aw�':2�n��f��BQa1��ڝ�8$bki��LÊ5o.��M-�7+p�+�)�L�s���Ӟa͟ � EFt 3N�`���8�=��0�!�T3<�.��H��7�LX�O&�>`f�fi��Vä�cݮN�ܦ@i����������:c���l��秅�x-{u�ո����y�K�.w�֦��6�Ж ���l�>����.�H�������愇�wK9��Й桀�˻��M9!�:E�T4�t���x�Ӎ����p�ҽh[�Jݣ��e����;HY=��}��wpx��I\���4�cl''�X15�N��qX0�]0@��H�hx��E)��A.sm���M�h�3?5$6.�_�[����� ��Q�N�<�F�D,P�^Yh�4�Z��P��5���aVsO�8��6�k(���zwv�>Q|�7l�}�T���Z����9D���]e,&Q�rӨ�(�ty�a�JÖ�-�:2UO�{�M��ّ]�W�������=��{L���(=S�nх���@T�wӜ&�q���MB�>f��v�ɖV����O����c�:@*�>�K���X}��y�L�NJ���1��Y\^ٽjH���EO�ut��dɝ@O��}���co��r�[;ο�/����z yB|��h�⣱���J���g���2��Lz ���,��/[���pK�B��gM�J�";�n��b'�K }��d��� -���G&z'fگ����.L%B���JTw>:�>�� ��zb���� �@.��.W����:���bYp���)Q0�fOɞ��B���O�jd���-���(�nT��L 8I��E�ͣ�i��MK1��@�]��K�Z��+� }&-/MBG�-��Hy�\���m�Eop�3�%�}�R������=�o�t)�E#�)m�e�Z2RL� �9�>Sl%��5�5�ڃSC��i��D�ÍD�N!� O���~�.D��^�`�����}���"�~_Zh;tp���6�fSY�� �7ӯnY��q�;8�� �Z����$~b��%D-�B����` ۛ���C�"a_~<���!J��Ռ�Ѵ<�> _J�<����q2�>R]%�ְ�G��$��M�:]�6������儻?�0f��j��ې���ؕ��Y9����*?�A("6�ю�j�������S���)hµ9��F@�l]��P��5�ݐ���?��>G4��A��(Ȟw(I^T��������@�i���?��IÇ&�2�y�z"�tY��x�\�w��2�<�ƨS���К ��S���[ �L=l�������✦ɢ��#gy�4TB��b��P�����ux�����oԐ���A��"��5��8`���i?Jq��[�E�����} ڝ+�B���Mm4�wb��s�ŽŊw�䅧'�d���9��2�A>e�G/s��>؛H.��U� �G�#��x�4�B��Y!-L�<=�2�˶�R���'��Tq{`��M��#�%7E���k&� ��H��� | �Qֵ_�D��uS#Z�o�T$0\^�厔����w�Bf�jm�����肽<��Qa��[�e!��)) tdP����x\X���ֵ������B��A���֘%m߱�������7�����{TO:�E�kUϪr2ہ�#2s�bm!'!�K� �^*�z4�F֡����Ny-�F��s�'���T�/g��v� �`��cs� ���i��I�5�6 �G�YvI�!�X�Xy�n���n�=��i�y$.@�B��U����Q��:{:G��������]��J�� ��Y�xK�vu1�������EI��q����(�����Bw[7����=-@ A\Q�J��q���\"AeS��S9��l5�8l��B���VVdèɺkNV���9H�Y��F��6���:��۱%+ 8OY_e�2�.�a&7���~�^�x�ʆ�(^'���-@��n���U>�,����84�� �,9"NV�K_!]���0Ȩ�W#�f����?%Ca1?� �>����,��w�ix��������W~Ǭ����G���3au�:B�o��k��%Ciց���n�n�-�' �<k7R(��y)*���}ų��ʦ50g.�R�P�������G����o�e��v ��t���� ���l�!�W��S�C��Kb!����b���z=ض��X"�f��c0/T�y���H�eW��| �V�X<F%�+���7��"�ɑ1z�|!�v�挨�a���D��8'�N�%�,@�i9P��/n3��h�@�k����<����r�)Z��d�nJ�F�r��P���E��D\ _2Ņ;��vW�Ib�����������B�g��D����=����C�$=��b(�� ��% ����l��F�3�}�9Z(�z�*��c���.�u� KbO������6&�B����[�, ˘C�U
Static task
static1
Behavioral task
behavioral1
Sample
c53800fa37717c999d7d0f6d6543d83c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c53800fa37717c999d7d0f6d6543d83c.exe
Resource
win10v2004-20240226-en
General
-
Target
c53800fa37717c999d7d0f6d6543d83c
-
Size
4.3MB
-
MD5
c53800fa37717c999d7d0f6d6543d83c
-
SHA1
192f7d461e31b2c1f0e9d345ed542d6671080141
-
SHA256
94f252d72e2d3b78c1a8d93ce3d2736160d4821ea6ae0396ac0348eb50c0de1e
-
SHA512
11a6cd3264aa57faebc63978c51123bafc8a5eac0428c15a8c7a39e65d83a7e72e4c225b63395bf0c38dfa7d55b260e4379004f4befcf07b5027e267a1112128
-
SSDEEP
98304:518oLRpVy/TSZ0BFIZMe20JYMQgSgoxotAA:5cC0BFg1qMDSgvAA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c53800fa37717c999d7d0f6d6543d83c
Files
-
c53800fa37717c999d7d0f6d6543d83c.exe windows:6 windows x86 arch:x86
03d4f4723dfa9a980bd62aedbdc6ed3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowExW
CharUpperBuffW
advapi32
CryptGenRandom
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
dwmapi
DwmExtendFrameIntoClientArea
shlwapi
PathFileExistsA
urlmon
URLDownloadToFileA
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
d3dx11_43
D3DX11CompileFromMemory
ws2_32
gethostname
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertEnumCertificatesInStore
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 906KB - Virtual size: 905KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ