�>7��4�����Y��^ l�Ia��dt�hT�ys<&�?Բ�}�2v6H F�5�� I�P/���][{�w6�'�&��%��q#���Ԭ�+dE�����v�>=����nA -�Y3��<Щ&=X����ա���u��z��+�l�H��pU���@�knh��(��(�Ύ�3?�I��b��w�TcFkic)U@�۶��D����QW�w�_����Ѽ��8W�ͬ����zT�\���!WM��o��S���6q�[�������f�"p� J��������L��|�Bc�w��D!g#d��{P��Df��$m�ҿ��F1���-cn,��Y�r���?�$r�~����5����h�,FE$�� ߃ˢ��i��Vް"ۃYJպK�R?�6�&�����a�Y��UW�i����ũ���vܼRn�7O�N�\K����-�7�83 Em�NW���>K�Ҷ�ψ'TA�O+.��m�|�����X\%*�5�e_ɣ&f+�<C�}��=9eܮ�Ϯp��g�c�M�̞6�C�>,����!�m?��8#C��C2Ӝ8!�7�Ma�^e�c4��d��*�'��*�i������ ��>�J�J;�X���X7~'wWHm�?i��UN����#�����2/r�dn!���3��ٲ����e]�h���A�-<]�FR�>�oy��R�w��5�d� �c�Xm"߳�[u���_���z���/�=���uq�h`T%����� -2�lAF㱗�}��N}8*��K�+B��p��樓��\��b�Nt�L���aJ%��_��BV2�^��G��=��E�D�;���k��I��A��vf�Ǚ���1���p| x �Ezi��hqP����9��!%68� �G��>�"�.>[�X��Ğ(�B�O%�p~K�+��Rwp��,���:�(�x�m���á�����W ,�L�?�O&,X���Ex��퍲%2�p�Z��8bdi���Nf1��R����+���YQ���N���Hh��%T�N+1a�[YѦd�T::$:Gب���~m�gm� �f��8�$P*�r��|�8���q��=� � 2������74A_ˌ�"���J ��@� ����� o/E:�5"�=^1c� ��@)�Ww&��d�o�}��9oO驹��l����ی��� V"�)B0d�M^Ir{��C�4Dg�Hm0,�SV��z�{+����f��QҬ�|z{w�t�"���{G�P�@c$C�t'�v���Ds��=n����q/�U��)���3�h��Y�̔�vD&p��_��;�#a��y8�+D�+������v��2�Њ����RE��"⃠%��Z��iN/���:�0����A������=���������P%�F?��Q6�Z�bŨQ<E-d��p]2�z�$ۺ�RQ�fjp�<��cg����o�>տ� �ݩ��K����o k�?�a�[C���ߓ�RQka� ?c���da�1 �Z�A/�1̉��x.8�����q�2_��G��0 �w:��Ϋ��is*G�c� D�� ����K�m�$u�}}w0�����|��+�S�m���B?�� �����g����e<J�d��]�yQӛ^B::�[-�?�n��z���f��?{�p���~��Y,�܌���4��������%���#��&ëa��Z�f L���1���(�N��"������V�C�#(�1\��Q�i&gxՙ�<i)���|nq�g�,;�OAetR_��U5< ɥ��r�ޯv�����x���z%;�GnUJ#t�JJ�,Ԁ�b,*!9JXK�L�ݜ�j����XC�M��"nc��PgR{����J��k��Ǘ��1�|��p�>�>� �S�eR�{���n�րӞ�{[��OT]�)HU�mg�A�JRSNK��X�!p;&�mr-"�\�P�u5ԇ�Ć ��bŘS֝�#bC4� �.F�$�9�Ӧ @�|/Mi�,��Ӑ�&x�/�8T&�Wc�Ny�����`'U@V/�B�ɀ�����|=���i�aO�5���ڟ���t'�N��`���k\�+����)�wT��R��(Ee��K��>-"1r }���iy}o� X��3B�AER)��� �r���q��5����>EiZ�ҹ04nH�x���ڴ�<&�"K��+������|�g��Ͳy��x���:�y�A� �ϭK��@>mFe9�J<�i�e�lg��@���EDlg��#��������sdՅ�@���%p���Pk����蚞�4��:���.��m��,������Ia�<�ND�ʀ#ϯ���T]>(t�Q*x ������F����0_��/�̽vVGc��UӘt�&����-�w3^$j J�DR8��']o^$�p�t ����$F��ͮ��wu�h�W<������O� �6�9��k[9�ph��)C-AYp>V�n��4� �a����َ�yIkJ�c����e�Y� �`�}�7�Zn sXD���d�� �����C�bs,�|��}s{Lk;_b@ia�L�J 5ok�Qɐ촱��'�ZCmߋ�`ԋ��aBxw�P�i�>)�z���Z8(c�@2 �s�J�֮��s�،J56;��-k0���B%��*������PuG��CB�J��E���K�f��*����I�KDz��4�PUv��:�!�/ ���\B���Ui����_��v�˥:q����Q���+���0Wz�%Px��i%c�����`�sI���֔oA�:>�Q����G�i]���?�C���3}>r4��Z2����&(%Y��2{�o�bw�����K�8�fh��ǖ���[M��5��he�9A@#����x8��Dg��E�����A4Y���bb��Ƹ�U�LJ��[��.��YS�W\xFH�tm� ֳ�IgO��"��P���!�o�ʝkJ5�'f^7�V4�4R�Ønb�S ��"�8^�U.'H���VlP*�?��/��>'�����R���@��.�Pn:��z�����{�� ������O������~���T� դ��P�'�P<m��
Static task
static1
Behavioral task
behavioral1
Sample
silent_test.exe
Resource
win10v2004-20231215-en
General
-
Target
silent_test.exe
-
Size
5.6MB
-
MD5
d4c541a971cb5d41e2de0d1f3d4b9897
-
SHA1
39f6b1835dd006fc53fd5edea203374f93b2d2aa
-
SHA256
920cdd05c70c88f60d93018616cb08a8946ce9a8e8397b9771fb5c96601d3c22
-
SHA512
dc07256a22ff0f1d60ac735565b338e0a24592c969bfe67b575d851f2e904d9c043bdb6a89b1c4331379a2da085edb68ef21561a82f3f2dc66872cfb284ef736
-
SSDEEP
98304:UrHfO5U6jlYYF/bcufKDoEdeB2ufnGL2OxzA1ARlfwFbSN3kz:UrHfilYubTKDxui6OxzkbSNO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource silent_test.exe
Files
-
silent_test.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ