��'��{G�K��?y��L~uB{K���5��\�>�j>t�9 2+m�?�D.+a�>U~?�IēS����?1�~~*�������Ŵa�LX�?}+�\�������V���m@�.�\T�?�X)�W�H������ߢ* �T�,i3r�RCy�>������.j�F��N��d���1����V�̰3NGW:Mz!��<��� ����S��g=��)W^�*�f�r���@�&�?�G4�f�iM1��<촌�/��{}���2'=AK#��,�{8�a��C;�U��ۿ}���Ș�A���qtƺf3y�b�Ezd�-$�� �9�a��%M�lE�}<���p��+�dž���KO�c�(�����B7����F��P2h�8�%�p�2\31[��Xj�3����v�uf��۰��u)��w�6���<k��N� \cD����~j�9b��4���{��C�-�4��ߢ$p\�ZHwB7��6�2pYZ���l�ز��Թb���R�n�U�|QRq�����Gv�t �<c�'C㓶̅E��jg�����wN��ӷ�>���N��%��rD��a�:9�9���P�h.��R+=[��g��C���u�Q0��4=�]�Zy����p�k�����0�Q�D��3Q��ł�c��!t���U���g��|�}�2�#fbxЎjnVꘉNh�ٟ GI� s2�-����/�^/��@>\�K���X��X:�2�L�О� �� >��<=�,9՝���z�<�w��UN�p�0���uqjDi=̃ݓ����?vQb�$�?V|�)�c�ă�ps�D}-0N�Y�型f�ͷS�d,�I;�I7�v���,]�L)A`+k�1�'λq&��;@��\Վ��b�s����,�3!J��E��v�p��U?<�jn����Ys�w�珒����K"i�gQ>E[l~s���5D���G�MK�'����@����y��#��^��(�r� @`=��� p6�\1xۯ��3&�%`�[�Ě����s���0 �f������4���L��*���z��hm����"5��D�ĩW��V�)�J4f89\E�*)R�_U�9��3�q3�x���L�����R&ӓpa(5 �����8�A^)�����E�7E(3���W��g.�1�8�S�����S�j�{Ӝ�K�j�[����KL��@�@~{���"s-����8g����?�"o vEQU��O�����"`�^�J �~�4k}�D:X��ʵ~�l2Xi�e�=�b��ڭ_�bd���0G�s�fU:6G5�'��Ӷ5���l��Ȣ������AZ��������J���FwM(\C�ږEf� u��]�]@�r�y���]@�c�#}�e�v�&f\4��z���Mu��>э���N]׳ק ���$�y���*Q1Hht�j�U�m��de�b.9q��oݚ_!��!� 'ҿ��f�\Y�pw�$��6k!Uq�H�~��K/����+܈#!�V`��Q:�p�}���k�����p���G�2T��ݳn�ց9TP\0<�_�Zah�C�8�7�;N�Ԟ�N�{���E@̅�~�!�����4��~ൕ���u0�����l����o��2]� lF�>��B�AUx��p���6I�|��u���s��ZPk��8�D�D��c��6Л͞��i4& J��~�T�@�<~ʜ��~E<��`�d{�zr!լlKOYƙ��w���Vz��G��-)W���g�����Y2%�ROd����>���)͑֫�oϗ�q��ğrx)K `�^y�����p��[��ږ)be��!j�� ���3�^���O��p}�.�r���b�i<�?���a�D�)�l�� [D,'�mX��E�A����\8)�%Z�3O5=����oO�B�Nt���=y/c���זܝ|�\ g�̺�U��跩㹽��\$�K��M�>b��?�[O�3/����Ե������?��A N:K�B+�c9����WdȪ�wBDB L�ZĹ���F_�|k�?o���Tg̷�< s��=GY�z0��a�w"���J�Ю��#��W���l?���o�z�]C:�DCw�ӕ��攎�dN1[�������71������W8L%}!bI��2oRZ\Έ|gT?��,���v}Bz?S-�(�FV{駲���6�N�)J��3�ֳ��j�˄��a���H͘����t�qؿm`�zP��G#}X57����fW3 98!��:� v���D������@#C�JA�ֵK PF�����F�jp�(������M&Ĭ(㩣�3 ^������j8<����!g�\^���U:*��%�H�,���)@>}��w�*'�q�������9���ѹ��>��� ��Y�>rG_��}NA�N�o����M����p�Y{�P��I���tCԽw[����4,A�2fo�����*���h�B� ?���I��)�1�x���ؒ���L[�gEEᛕa+�f"��% z�^�*d�����m�&��+C����1:?"~�=��s%�c��M�݃���ϕb!6�#����(J:2WNP�˛���3u�ԭ;����^��6�c��[p��5���F�9el�ނi:^� B`RUo-=,�8�$���f�Y�ߓй�Ӈ��k6.�&!�D�CѨ�"N��O����j6�~̹�B�0�ѭ$m �������a<�߶*������-��2G.bU//܇�9{=ނ���� j�<r��h��th��%��ؿ�Ǡ�ߎ���@iѓ&S"�F�LG��,�2�ͼ�����pm%#Y}d�o���d䈰�|)T�����Z+eX[����eBς�c �R ���C_�:��c��N ����+�K�� ����J�{��l�: ��A���y�,�d�����K�;��C=Vd,N��J��Sd���ͱ���℥Ιf��d��J[�z��->T9L�O[��&���(|0������id�� �̲����`���~ H O���qf��y?� > HmZ"�:B�)َ3�^ڲ}�55���]hP!���R�;��# �0�;S�P���E��e��6��S���*vP���8�� !v~Q_�
Static task
static1
Behavioral task
behavioral1
Sample
c9e771a81d11701e67d8135c8a33797f57e37807668c9790305a617f65caa1ad.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c9e771a81d11701e67d8135c8a33797f57e37807668c9790305a617f65caa1ad.exe
Resource
win10v2004-20231215-en
General
-
Target
c9e771a81d11701e67d8135c8a33797f57e37807668c9790305a617f65caa1ad
-
Size
32.7MB
-
MD5
7eef51fe32ad9a7d0dc8ef15ffcc8db4
-
SHA1
f03ada8ee0e29fcd3e9f37a0d4866041d06cd365
-
SHA256
c9e771a81d11701e67d8135c8a33797f57e37807668c9790305a617f65caa1ad
-
SHA512
a24848e4a010e31fa256cce4a2eeec7447ed0f2a6c3a4cff13b91e5233f3990f67ce9ba4d44831635fb63b675d7915864b1a26f6ce7aad1d9c87f88bb8c8e575
-
SSDEEP
786432:bHmHIwjW2HkkkSmRtBwateQFllmZi1DRb5:yHIwW2HkNV6ateQ7Rb5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9e771a81d11701e67d8135c8a33797f57e37807668c9790305a617f65caa1ad
Files
-
c9e771a81d11701e67d8135c8a33797f57e37807668c9790305a617f65caa1ad.exe windows:6 windows x64 arch:x64
b9a85b4d6afc612f3a0c3b561dfe0585
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
?get_id@thread@boost@@QEBA?AVid@12@XZ
ws2_32
recv
qmpdkdll
QmPdkQumaGetDeviceState
crypt32
CertGetCertificateContextProperty
kernel32
GetVersionExA
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClassW
CharUpperBuffW
advapi32
ConvertSidToStringSidW
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
bcrypt
BCryptGenRandom
shlwapi
PathFindFileNameW
imm32
ImmGetVirtualKey
msacm32
acmStreamPrepareHeader
concrt140
?PPLParallelForEventGuid@Concurrency@@3U_GUID@@B
vcruntime140
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-string-l1-1-0
strcat
api-ms-win-crt-math-l1-1-0
atanf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
localeconv
ailia
ord101
giflib
GifMakeMapObject
jpeg62
ord83
libpng16
png_set_filter
tiff
TIFFWriteEncodedStrip
comctl32
ord17
mscms
GetColorProfileHeader
rpcrt4
UuidFromStringW
avifil32
AVIMakeCompressedStream
iphlpapi
GetAdaptersAddresses
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
crc32
icuuc65
??4UnicodeString@icu_65@@QEAAAEAV01@$$QEAV01@@Z
gdiplus
GdipFillPath
mf
MFEnumDeviceSources
mfplat
MFShutdown
mfreadwrite
MFCreateSourceReaderFromMediaSource
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoUninitialize
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
timeBeginPeriod
wininet
HttpOpenRequestW
version
GetFileVersionInfoSizeW
boost_regex
?construct_init@?$perl_matcher@PEBDV?$allocator@U?$sub_match@PEBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@AEAAXAEBV?$basic_regex@DU?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@3@W4_match_flags@regex_constants@3@@Z
glu32
gluScaleImage
opengl32
glPushMatrix
gdi32
BitBlt
comdlg32
PageSetupDlgW
shell32
SHCreateItemInKnownFolder
ole32
StringFromGUID2
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 51.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 29.2MB - Virtual size: 29.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ