a<�I�<]����`���;L��Lji�����9��xm��� �һ���<��{e��������p4S'��'8 9��VڔA���#����r[��JBP���4_�/+Q��ⅩcG��l�}��xzR���-�SW�ܬtO��L���#��-^��&�j��[���$��sp�DJ؆�A�%��Vs�o���%=�3b�=��&����I����R�{�^�KD~Ɨ�p�"�~���.�)E\���9�"������j"�dDB�h^z��tRq�/�K��^W������R|Q�j��9�N=��(4�V�����%�/,L)�⯍tUM����0�GrpKn��O�/�7�ᰬ���(!g���lC�L�������@�[��Ϩy?���h��&�s��S�^ψΉ�.RL*�t�t:�2_,�5i1f�742t���3�V����R��Y����߁���tL�W�G��m�������hY(�_�������X�e���\�@��gH��v�ORY]VD��!؟��c���)��>�Y�L�7�,�4#���?�.��e������O��d�dxu��� ���[��� '�6��7*v-2�=�#�^/� /v"}������_��͠��W��?�T����|P��������P$���A ��]�������.vgu�Q4��P,Na=����_w�x�L#V#pH'.���t�I��k_��2�t���yjF�I�Y� �������!�V�q�����1�L���1"�;A:_֗���@_%$V�O���W�/�(�İ�`gzk O���@���ť�����,8��xC�Z�(P���C��}���E ���*E����;�9+(E�� �&;kTQ� ����nDQJGڣ�|L"�VY�l����bü`(rf���sF��'$�3c���V���vjX4�A{g^la*8q̝*����i�i)��Y�+B*�yl�m�'V���G*�c�:Qbo�1s�yq�^�݊\:��@�uE���o��b�H#�l�������,�'��lЅ��H)I�Lr�Ǯn� �x�21�H����y��\#��^O*|P�'���߇���A�CB����_��c��E�:���n�o�<���X� �����}&d�������ět����w�:��E^|q {a;�����E\bcqwg�������,�������,�կ���-���yow4'��������F�0�w�os��9�33_xfK�z���ge3 ��l��\7fvA��*Q���ZĔd��+��]j��������y��r�xjvT|&m����=K7])��^M�������Jc.�|�}�8��aaԟ�C�9����Pf��6�����6�1Vy>˙��1ݫ2n[\�vt�Z�*�:�o�����!|hP��6��;�-����oX�`k����h(�ķ��g����'=|l��aA����� «��4�oK����������P6��R�[��SD�`ny���ʲ�3�g-ڮ��n�p��7��3e}���q#�;KY�����މ���(�9ܵ�Yk��� [�Z��)[=dv��ю�.y%J>LJ����� {����Wtc�ߗ��SXZ�ܩcLܽ�U�P������It�L�^[U�-;���/R���O���2�p�5� �%($��c�NX�{�9-рLt���vm�����-�=��N`��)LQtÓ����]Zn���C���qޓpI��[Z�����ij1�ДU}Z���m���E)Y�wE|w �ٳ*|�$zp�G)�2M��]��7j���e��9&�d���o�o]�f6>�+��?a2����I@���j���V�d-��B��@�]�M��!����b�)�S.s�,�����?�����R�T�h2�R�Wb>���'�U&y=7ڡ�� `ϊ�x�*3�����ᮖ��JO�w�ǣ����u�e;Gn�v�S��g�)�08���6s�_�N����.�!�y�B*����2.U�|�fl�ĭꄻ@"}�h`4�7��%E�L5��%�۰�.�V�nL���Ǭ[$C�Bʰ�0oCqwز< ����(��^�_���V�1�;&`���`A���[������(6`t<)`',��~�<���; ,�|���N���5�� O0P$����p��W�u���*��h3ˏ�+���3�c�4!Rw���S�@2�)+�ȕ��=�n��-G���8�TⰒF������@�L�F|��҉�Z��:��D�o�"�9�I�����C���f0���-����$�܉~I�1�%(�@=�x^ �`:Q=q]�a���zf s�6z��L$S�@���O�y���� ���hE�f�[��{y¬_[ӂ�?�9n�[�{6�3����./D��\]�;t�$f�2�(ZZ�Ď-���H���ܷ�� ��i��{�^�:ga�oо�&*�jqR��$:���M��C����,t� �<���*�Q���b��|>]6jfapg7��x!դ?��l��������S�F���C��]�]zk�Pr��3���qd��k�#9b����qL5�&������n7ftGF'jAPzD���Q�Kw6�g�˽+�_L�� _���y��nx�fHy+�n��{��k��"?�Z�8·�Of-�,?�o��M���"PQ����ҫ��;79<j����m�yj'��蓧�P�2�潾rTe br�U��Ԧo�9$��@K'���ۍI�I�YU�P�|#�G�rgs�ڡ��n�I�є�7��EHk�c�v�ƛ�q ͚�F��P!h��n���j܋���y�ގ�y��������C�gB~�2�� �q�'� � �/��^{H6]f���L�f�Ze&VdLJ�ٯI�m�NxRf��>)�@�/���e�!\�bdғ݂<�/�oyA�ܶ��@��p7�:��MqW���� ����O����寛�B)��ǤE� ����R������tF���Nj�Rz�{,y��:ɳ�. ui,aw���ҝ�,��tjih�C?�dS�=}
Static task
static1
Behavioral task
behavioral1
Sample
wushuang0312.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
wushuang0312.exe
Resource
win11-20240221-en
General
-
Target
wushuang0312.exe
-
Size
1.8MB
-
MD5
09ef213081c6caba5855ce88372c73c7
-
SHA1
a3ad189914f81f572dea35f9e85fd53989f4039e
-
SHA256
e091438258fa67af51aee9f393ae94862c72285b7d9193fea759afd288d6f6b1
-
SHA512
043344f9117ae1a3e02e69e837f03428a54ecce37d3e25489adf2f9935f58a4a3bcd677035e2dcf5664185cfbec5088bae24bdc52ede31060e49506b41fad032
-
SSDEEP
49152:oWv9dmCpUppQ2Z9zCL5QEiIvWxUecwBc:ou9wCsQUCMC5w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wushuang0312.exe
Files
-
wushuang0312.exe.exe windows:6 windows x86 arch:x86
d52ab0174e98f8fad53dc23027a5c4b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
kernel32
GetVersionExA
GetVersion
CreateEventA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckMenuItem
gdi32
GetClipBox
winmm
PlaySoundA
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
CloseServiceHandle
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Read
ws2_32
WSAAsyncSelect
wldap32
ord29
ntdll
_memicmp
Exports
Exports
Sections
.text Size: - Virtual size: 785KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 631KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wushuan0 Size: - Virtual size: 797KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wushuan1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ