�*������ &9�T�(=�I"2a�Z�2y_x���M&]*~������v�zw^��9�$��wRt��P���0+��'���ʔ���ivNY�.V�4D���Q6P�괍��*�Gd��'\PJ��2��C�y�!���,�@*�zU�W�S[3�<:��|�R���Y���6�m�p�ʳ�Y%��.�J���tMȁ��B���O�Cs��z��,ԱoqN��5i#��b�>2<R�*I6qV_�]y�v+�R�J�4H-�9?��0(A+�;��Qϳgw�\X����G���Q�����:��N&Blq�w�Ow�b݇S�y�_{�p/lb�S�2R��<�������U_�<|�>�7sO���貶"wt�=�l������}:E� ���;�7���y��W��s;E�A&��8@�(��M_��B�̴ӝ���@,^�6� XI?�,����C��I����i%bK��z�۞��X'����s��c��67H�v|#$�� ��#��z�#�v���dk�L�2MR㭃�����.�+W����*<���*^4���7fĿ͟-��k��!괍� ������T��C��&�_e�O�z�~��Ҟ�j�H��*:�b���I��R&��x�4'�Շ���"d�O4s'@��C�p�q��i�]r�o9S͵#8"ܹ]�s�,F�8� ��;�(��@2��D>�Ǹu�F���:Ⴋ�����H�ퟤ��u���S=S��_����7eI�Ț0��Q�:��獹�H����� O4�t��,�����w�5N�3���ԓW?C����LE�RE��:�q��jܲE�oGt�p1�L��S\��&b��D[�T�u5�\:����w��$��5)M"�ը��GI U����1�{��>8���'#1��X�<�pw3�V������e�w!�?+v6�h�����w�N����r����N�z����&s4����<"nB;ϵ�Vk��,�(^|m�#����e��h,/�!��Mq�<� ��a�xPBk8����G�NC�Q�;dF�5P�oy �x@�jTl�>c/۳�}@7� 1�<Ybt��b�@��l�0��ߪ��"pu���Ӷ��mY�+��:�<C ��b�ʇ$!}�_���O)Ƞ1�gx��A`���*�J�<:�B3���59�M7&j^(�@9?��X��/�%��Qz���5pn�& �f�8���T�S d�!hƎ>QIFX��T����c�#��D�%?�G�_90Rc�q����`�ݸ)���A�Ǿ��G%�c��h����`��#��Lr�Ej�������VJ�#3���w��\>��' ��>�0�:��5H��?���U�R���f8�LE�0o�a�q:u��\����#�7;������7;uŚ?O. F}K�W:�+)�t�$�����b�T�cp$?���Kj���/�>%�8Iu^�m�K�AY}?H�qW� |�k�<��=�����\��������GN�7�0�����f�8��p��s X�~ә22��H��CX�6�Ֆ?�Y����&���H��u��uc�j��ܐ������q����|܊r�g@������L��u�S�Ԇ�-A��jC��f a�B^xlN���C�]�F���&�^�����B���"��T�/���N˓�Β�BQ�f��F�P*%��֓@�/�� �SH�L� �:���)"ѢL~���D�t�>O!�X"��g �Q��2��밆O��S�h�5��c���Uc����z�-�(7�O-� �f=��W����N��Va�C�.��^�ڄ07�(X������(��w:�����囼�B}q��$w�$ė �(�5E���<��]��G���'u�v��1���_�oe������ r]�s�|�i)0'� jOz��Ý$3F�li��]�D&����ΏD/�RJ��MO`jnD�A��?2���=���jn�߄�Ivr�� У�b<�KQ�u���9|�wPpM�SR�u���܂���a��}Gă��c�*�+M:��5� ��^4��$G������<S�P �����B5�w�J� ij�Z�P)J�~�����Lz�br�����[V�ުk=���TBL=]�����P>dWx�J;\���aK� ������r��+���jb��#%��y�J��z�; {;�Ɖ�p�-~��[ �J��CR��8)�>��ޯ�O�X2�d�)\������d��<�.~�k&aÓc �a�V����J����9�R�7hH��+f����B��%���.�4��>ט�,iVfV���ߠ��e� ��'&�㢻��V�x"�]=��X&�|UfD��E��jT���m06�F�������C�1�0�f��'�p=� I#4�w��~ �"�?|{Վ]Y�UJÊ;��ѓ2f��%8��J}S�>f�H'7L�e�I���5?�&�R4�l��S�� q�Q��3W=��9"����_���/�uEØ#�i�4�d�Ӿ�d�$=��L�{�S,���QN~&��MӺ�:�7��ǐ4�7�X�1��5p=�̀E$�r��[���=ǻ�?����1��~���q�t�C�5Uz�>!�0��������cF���ǯ�dg�4�i� /�����Vч��ٲ�:c���IM�H#,�E�G7�g����8���v1�z��m���M$��y��K٨$����ˣ��[�������SnOvT����-���d�F�`-� �9��&��ݚ�CYxQ;Z��m"媝��� 0.a_�P��miR�y����6���\��O�4�AX渦K���:�|@!Ct�<�f�S�M������|�-hd���s����0�ǂ��]���&� �h�6V�l#���ڵӘ$�خLt�t��҇O��}�R��G�'ϋ�?��Ϸ�+:G��*�6`W �~�'�!������/����ch\?��e����5}����:k��pn��+`��->dj��Y�ʅL��1/����s���9����j1\�f��Lf©Fd���R1���jT�@`�#�[o�=A'�I���W dԸ��R��#cvl(`��W�1�
Static task
static1
Behavioral task
behavioral1
Sample
453a6cb01e35309c8cc0098be8117e09aa436e8b6c153a529820d346705667d0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
453a6cb01e35309c8cc0098be8117e09aa436e8b6c153a529820d346705667d0.exe
Resource
win10v2004-20240226-en
General
-
Target
453a6cb01e35309c8cc0098be8117e09aa436e8b6c153a529820d346705667d0
-
Size
7.4MB
-
MD5
6db815d99b4a7c814d9b0ec59c1aab8f
-
SHA1
93da18e8b16cec826c719657d8d17e2d17be9a49
-
SHA256
453a6cb01e35309c8cc0098be8117e09aa436e8b6c153a529820d346705667d0
-
SHA512
b844fba865a01547f663aadc54e99b1ccf6accf88901d4f6d3f5c4f7dc327bbf622c38c6fea0056aed817d487fd6528e9089d2699147b238feec5977c49da903
-
SSDEEP
196608:bOO8NaqDRr5hmu/nLNB4Z5CgwhC8d3aszA42wr61g2tx:6UqDJ5hmwB41K3as0I6i2v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 453a6cb01e35309c8cc0098be8117e09aa436e8b6c153a529820d346705667d0
Files
-
453a6cb01e35309c8cc0098be8117e09aa436e8b6c153a529820d346705667d0.exe windows:6 windows x64 arch:x64
848a010a1154622738a392277072cc42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
freeaddrinfo
advapi32
RegCreateKeyExW
ntdll
RtlLookupFunctionEntry
bcrypt
BCryptGenRandom
kernel32
IsValidCodePage
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mu^ Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.'b2 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.68x Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ