2����e�\�!�:cyK.�K�Cj�vԋg"[�2� ���I{�I�Y������"�� @W���F��0�U8<?�������S���fe7]��Nفl 91�Cf�E&�`$(,, �k�"�L���økFS �j�XfXǔ��K�HZ�G��d%�frX�j'[g�E�еɈ�5�������ټ�d�u��x�����LK�u�Q�ϴ���ܗ*F��v�uI���������$9�Iwh�v%�]!֍���~\~M%*����79ل*� ߔ-fv��]�:N�s�V g����8�vh�q�'��&��֍&:�8�/^�)%B����U$�}��c`�E>�p��2�܁�ѐ� L���6W��/��~^Ƕ����j~���H" ����E�50a.���+ٍ7��O�������tk�I�����/mryk`*~�Ȑ�6����U���mҐ%���+�&�`.��hyx@�G�~�Φ[b��?�8rh�Bev�(�i����%0��X�x����j\)D���iKx�(m4�������3i��� u���{�9�i��K�����jBAA]1 ��G���Y�z-}t�l{x��Xm�>k�)N��_���U �`�&�t�[vl�K9�>�ў�R;PE'S�k��d��IY��t_�t�L�UA�mn�����.W����>������A�e 5�u�H~_������Y��5�&����`�ւ�r%P����4+�Rbi�����%eD�S�O���v_����K�pZ���Uphz���z=�MPB�e�?͕��x��Czh���7���|Al,�Dv{�ˆ�Dn��oL~ I�~��] �.T��\�k蹯v}��E&M��Tb�$U�&��[�J����,/i,����� ��)�ف��S�5���b�܋������<���ܻ�����k^���˝j�/wݖ�ۑ�:ڧ�ZU�2B���6��+K����[>�'�/4ޢ��� 0{���h�E�%��U��[:��B�+��ݎ���A�Y��߅���2���>��W�i���qm�_��S���"�jEx�V���-���%;����Br�Q�=�J���⨒ڀ*g������\�ѓ�˾C�xG��J����C��ayT���P�=ƽ;}��w"�}� 瓥���%� B��}I#X�k��na�L�(�̦���V^m9U��$M�����}v^O,�s�<;ۯ-�{=ݎ�=rd�h4�ܪf�VZ zЭ{��:�G����Gg�k���a.��쪟�>Ӆch͇��m�<�u�b��5%۱X��4��L���H�o5�%�z�?V�V�6Sz�� ����~�h�h���X���-%Źn#SRgX��� Wn ��#p�����`1?���fߞ��O�5CCh�r�ZȄ��~2O l�h�`�M���1Xwd^zQ3f��`�t?5�����(3��j~0��j�xm#`�U9��yx�(t�"�_��{��<��n�:&�7=��bf�}_����T�hŢ8�)����b�/�0`����5�G��uRv�{k��_IYP���P��~��&Ա�:X/"�\�4Z� \��.�������-��v�/K�����Rh&5�� ���5�!d��>߄�ݶ���}1�H���6�6�T��y<�rYO��2s�����F�(�gw��)�6�^V ����/b��r����!e��u#�6�0��_�~��- ��\#�|��/濫�*��-�v�'w;q�W�+\�����Q�0h>����9c �+Vr�]��5/���(�m(�+�I�k}9܊D�� �F�+ �8�U����ԝ�,�DΒb<c6l��PV�I���7�&X-_� [+����-f��%�Ln���MpI�G>��H*��j*�g�X�)��G<*���:FYj2���Y�@�]A�y[���k"��[��_��4��o[4G��ΫґD��X�UF��5�vyF?��^���������$`�ˎ�K��Kw�\;� �*��'�����ۆkg*����7�Lm1koS�� �J���r�筐�Pe�㙐��j�A~�����_n��~��gpq�>�2���ޕg��F`�P@�!x��A��>g��g�A���r�.�zr���� ,����X��W+�_�b���e����߶���3i�0�9�����*N��>�S/~�a �O�yBG��:u U�Q[�"��9!�)vkc�� '�)�����Î�1v� l#���]�Bɩ ���^�l�f�T���ݧI��m C;)=�Z�G���E3�|��,�я�"�|�n���j��6J �<� g��YS$��Sds�oH@�K��p�Q����M���Lܧ�{�-[Η�պm�x���΄��=�GK��Pt��wG)������#���S|�ؚN����u5?��ho�i����#�@_�� �����Tv�J���B����(��w_-*�m�곓�-��*8��S����]��m�y=F�M�V嚱so�Y�t _���ȳm�������� �H9�������>�) ��0L�s�ɼM�s�<R��>+!~y(q(��$��"�<���2�Oeˋt�F����_�)or�ŝ���F�4�ɫ�y���Q��E��כ7X۠�9�OO�a}9��� bBD�k�g26P�Lp[�h�����R#>�^� *k���z�n���vӕ6�vQ*��:yL�ۉ���Ӝpvm��t��6�,l��5��HV��Yا���BB��\�'�ֿ<�,2��H��q��������w/��uƊ�5��ow�ZaK�,�>ɵ�/CE��������� ��� ��ji����j�Meԫ� �w=�4��3S�I[ $�-�$E�in9��nJ=�gvR |����&z��cre��>��>�)���&�~c���f��zf�m�Og}��i�>_�.}�0��,���7��xYJA&oq��xm�"�\j�:�b�!}�fr5njl����w����}�Yja���H[�/a�~��Ag�B\0DDQj���?��"���2��:�m��ڂꢼ=�"���::Rq�A
Static task
static1
Behavioral task
behavioral1
Sample
gbl.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
gbl.exe
Resource
win10v2004-20240226-en
General
-
Target
gbl.exe
-
Size
41.7MB
-
MD5
b1665bbe73b75a16bd447ed7f813fd64
-
SHA1
9a53677199a7c10ddf71ee8208f565293a7bc30c
-
SHA256
42a7feb1a4dc429d220c35ebe314d7453a0c975eaad0afcaa368279faefd2d0b
-
SHA512
9b18871f68b1fb4dd21738176b20dbacfc165db066a17a2849cd5ff4dae26df7030dd4518c18f7028f530d81e5ee125921d5dffb91b3e20ab522c5ec52bc8e5d
-
SSDEEP
786432:Z5mPS/2mxlT66jjVmSMq7JuP68OnVDFz3GKHAYtvtXquedpMSwQHkTjxdElZtK9u:Z5MrmxlTpMxCJutqGKHJnquoGQE/xEZ/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gbl.exe
Files
-
gbl.exe.exe windows:6 windows x64 arch:x64
8c0ca972a943335cd26fa68a2ef49e6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
ws2_32
closesocket
user32
SetClipboardData
CharUpperBuffW
advapi32
GetLengthSid
crypt32
CryptProtectData
wintrust
WinVerifyTrust
winhttp
WinHttpGetDefaultProxyConfiguration
kernel32
UnhandledExceptionFilter
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
mswsock
AcceptEx
bcrypt
BCryptOpenAlgorithmProvider
ntdll
RtlCaptureContext
imm32
ImmReleaseContext
xinput1_4
ord4
Exports
Exports
Sections
.text Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gbl0 Size: - Virtual size: 36.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.gbl1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gbl2 Size: 41.6MB - Virtual size: 41.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ