ƖK�|��ԗ��Ad·X����O�����w�� �q��9H)�\"��m�W���p��?�>{,�x/�>U�8`�˥iaL��+��B��>m���b�T�,�Q�Fٱɲ��s�$E����u9%����p���RW���$$S�k�qsx"�j���q�~bC5: ��i�!��8_H�N�g���'��T�=w�� I�j�o���]Y�b$����F`[q�'1h1��y���`m����Ԙ���]����E���Z�Ά�����_M"$ɑ�����7�p<@S���E��̿Xep�cBϼ���c����n�閿&� XU�����?�A�@��F�fA�|��2��y�̏����>ьq�^�,\̪)6G��|G�i���gd� 66�,Qe;��ni+0���kD�h�Lɘ��17O,rj�x�;\�ZY`1jT[:4`9^�{L�r���K�z��n��� e�Rd��b�J��j�`7�;����k�k���B4�Z����P�M'��s������uWˉ{o#Ң�႒�� 3z\'���)�$�'٩K� ����2P�Ԇύ9����1j7ခ�� �w+O]�� �_j6�lU�=onk%��xT� q*��cd���ぅ_�[�ˁ�ʾ����ב����z���cj�F\N5S�v���aH�11c�ċ��jYLl=�q�C����Xy"����F(I\��/��"�g�l�����B���;[q������xϣ�Y@�����!��@�mAV��*�M~�k�[YI�V���G�#��g*�%ϒɇ��� ,��D]�<ŗ�[�*e��K!�{�iŴhlo�����>5�v�(��g�َ�a���ݤ����.$>����|, �wE\�M4�c����7���1M��Wh�C�:���|쓷2L������s��YI��4���/�" ��o��id����'YLi3�a��7����mN8 ��Z���h�T�Hή�8�uJ���k��]�O��l?�Q� J�M+\�/ϡ�@�_��8ߞ�|�w5�`����)ڭj�1��Ę���C�Z�����<W[*V��'98W��"[<Drm��{e�\��9(��u?DK�2�w���an��*Yl̈�ꯋ�V�U%��e�����1;o�eT��*�+��F�+\څ5u����ݨ��R3\l�N`?!�ԧ�Uh"샕��ܫ=,K뛊\��>�e�M��ԥ]ї��H���)>a6 ��Eې(-��^:���ի��7.@ٿJ=��Z} txO�V_���68�k8}X�D*��Yo��7qC�%к��+���#��:��/d�v*c��x����Ϛ�u�7�q�H��z�51]�fž�Yy��Tee��;Z���}k�N!�p���)8F��BS��P7h�u�� 0k�K�FT��b+�p���2��Am��e1�QLB gm��F$��Y�L�k�-�Y�84 ��@�F�I^���%U��5�#SG�\��R����:�5�5�Ψ#>�3k��hˆm�*T4�[J��VV��H�ٵ�@p5���DŽ���(�-��K�8��{�d9�+A��GH�x�� 0�D�m�Z�����џX��'o��u�j����Oy�T_�#�$ t}~�f3a�D���́r�2������5yOh-=@v���" �cO���s)�$��v���T������̰#��5b��z0�[����Q|�h����D������%�J��o�v�~���29���u�#~��E��%mM�����/F�f���Z"T� c^���g�ͅj /��z�ɫ`����܉ݦ�O秒��|�[a�4S6K��q����/����Rb[�d�Y����,���H�1�[���eOL��3S_,h�8�捍s�9Qf���~6vZ��9�����ȞǠ`*Ĉ? c�(d�b ,&��V�~����2��x���JԷB ,Uy]��P�v�k�+�ѱj0/Z>�t==w��y��}HO_��C��S�͊«i{�dz0ʐ����G������M�b4^������e��Z�`�*���b�Uā�E���_�-����-���ЌmG�d���&Lྗ�Q�HK^�9�֍U[������x`��b��W[D`��< �"M�_g��r����[�������t"{y�^����>2Nz�ؑӁ�v�/+<U�Wu$��i���� {��xv�=����������$��fǎZ<��};k�����(�x>a"Yy���� �Y����Մ�u~������ K/������*G�X��s4��8������d��$&@�FK�-`���9�O|��������a�B�������)�u��]��ũ�/������B `[�E�_��jo������b}�q��C���c7�rz�o�s�Ӭd��L�F�"�?A\�W@׳8�y�+h/3�U��9h�:�e\Z������@X����5|�+zȁ�({19�,���r_q:yh�b�����4J6E��I��B% �!�)��vV��2ExWM�� ԇ:�Qnȵ�p��/%��Բ���J˷�7�]l���3߯s_�O_���[ t��I��k[c7�W@f��f*�c8���Uĩ�ǩA�����CK���~9�E ����?�rH*� �?(����s�r���������鯭8k�4ԳA���l){�~��b�����x���y�|[|P$��g<��C30��5���7�b�M}P_�Jf�a� -��(���e������Y���废g A����h=�;�V�n�����h28��ޖE�0���k8-���k��`\ߋW�@:�oÄh!�k�H3�H�w\ P�Ĵ5�-�()�i'��E"&>�ҳ}��Wgŗw��R4)q�օ�ݺk����G�ª�ֵ�����m����>(�F�gu�o.\�(`�f��%ܻ@�0��Wc�l,G4�0��$60�\�4 ����o�\�D���RdbP�/F?���(���oh�j�P�-m6a�,I$U(�">�fR���ԝ{�,�;�7邺$p�J�=����Yxf�q@�:��1�����~JU[Gj��Se�t���F4u|�JQȆ�����D��Ƕ��%Hv��Oz��&Ã3i�1�hj2
Static task
static1
Behavioral task
behavioral1
Sample
395790ea5793e0fb8e2df1265617be4685f2bb78f9f2ea81032be19b192eb710.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
395790ea5793e0fb8e2df1265617be4685f2bb78f9f2ea81032be19b192eb710.exe
Resource
win10v2004-20240226-en
General
-
Target
395790ea5793e0fb8e2df1265617be4685f2bb78f9f2ea81032be19b192eb710
-
Size
6.0MB
-
MD5
1ce82cce6ea3879afe526201a76bcbe0
-
SHA1
459044b97c202a649ca4392175b55725283577f9
-
SHA256
395790ea5793e0fb8e2df1265617be4685f2bb78f9f2ea81032be19b192eb710
-
SHA512
9261394b7aa21cb065c9f4391f0341f6d2b639691aeb60ee23459f3df0bd0015af42b5dc26023ad3a2275601c568bdf532ee7d61db98be35cc06143f6525db08
-
SSDEEP
196608:E0wnvvvm//AHoD65vdii1xBWw0Ia9TMMx2kl2x:Vwnvvvm/oIDUvw0xEPMMxZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 395790ea5793e0fb8e2df1265617be4685f2bb78f9f2ea81032be19b192eb710
Files
-
395790ea5793e0fb8e2df1265617be4685f2bb78f9f2ea81032be19b192eb710.exe windows:6 windows x64 arch:x64
d910780e43eb6473c6ca334d8a16a8af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 413KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 878KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 380KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
.vmps1 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps2 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 189KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ