�K�V%34T�"���Vp�A)2�n9t7���bj���m���Zw�0��~+J��U(�$�GM��zd_������潦M��f���-�5H���o1���x۴�Y<�+O������� ����D��]��}/&�#��3lpw����b�>k]U�\u��=4���� �:�e,r��jd{e���|��I*{���D(�5`���c)��=�6�M��e<����\i�|@����i�|��Q$�~�o�ҋ���o��aQ�~H�t��!��<iq�^R�O�MSheꐲ��f�:�b��V+Fm�9Ea�5�h�����t�+�{HQ9N�V�t��x38�����N2�S�t�"���� ���yp�G��,fT"]c�X�6�����V ��4#���dnt��b��fL��b �2uŇ{E��d߮�ǩVAA���i��$�[�6&�f�T�*䑐������M� ^Ѧ�$���|�+!�O�C�m��#�U�:(�-6n�ڭ�E��� vXc���!�#2��r =/�tEr�,�S?�>���^�(~a:��k~�{��+3I�J���D�d ���D��^mUv9����{k�H������, f��y�l 3K��z�[�����O<Iqb���7��7��%+NUs�EK*IH�o-������ ��7���a٣.�*�A[�v� ��q���u��C�A�c]�;� U��U�t���?[�j���R��?h���������V0w�҅֜rF6#��wƽ������"s��������TaՖh&�cr�ȁ�� XqRʆSIt;w��x�H��pݽ�����{�R0uX��C�J7f�5w�#7��p0�Dҧ�{17j���k|]� �u���_I�y�YB4�b0�>#Bl�G�4��ۃͧ����E��4 A����3�qu���at��<� "�Y��@��U?f x���$1{�A]>���D�1����;aq��a* P����nޮ�� v1}���`&Ϻ���EU�T���Lq�����:���vad����^ZD�Pm��6N'���j�q ��|�dn��@�]�PF�gx�Sb��zF�E�G�p��ü)� 9�q�vɞ��U`HS��!)T�I[xn��vp� 2I�������S 1��p�F�]�%l�/����+��t�=s5|���xã�Vw�PJTy����j���P�[��c� ����xK W�o����<�8�!���hm]y$]��q_'4���.͏\�X+�[�|9�Iقu�c��F��5N�b�Q\�C�b���w�M�I�u>E� #��LTj�<�vѱ�jSХ��O-�YM�`2 [��i�(��5�/u�w�7_~��"�t ��`Lw/�.�:f�jGT�R�:]�.6$-� �yVQ���������r�d��0b;봦��yF0��ZIG�3��g&�4@��LrS��8���J1�{D��C_�6��H�n��MK�GT�Ѣ��7����p�!Ý�]G�O�C?��Qf���Ӊ���^�V �m�- 0?-��S��nӬ��f�O�T���X�'FFȤܰk�1Z���M �5���r*���erT�*���� n4����Zl>��&�y<7� % S_\(O��������y��tZ��<��:+��B�� {�|�X���Т(�����6�ew����E)�FJ�rǷ��JL�8��nu�DMy+���~��<������D\��pv���#sD��&�Õ��"�[���>��f2 ���*NKi�M��u���E�n�e�+��z|�ӽ�D/�Wݘ�m�佁v�B����'�!��<X�lx'%H�:�I�}n�9��&LBn�ǿY�tsM�Y��UX�����������@@�XR��� ���,��s�9��Ԑ6R�#� Ax;�|z����@��`T�%;�S��/f�}�A�v۾S��t39SR>�W��f��p܌�'�(��X�"A�1���J��<�n���ڢ8��o�WA���אzD���7#�����W��6V���S����B�RS��8ё�V�!�0E/�`�� ���P�>��*1�w�"6ʢ�&MnjL��ڍjӕ��A$L&�3Sx��F�y��m���v�6�r)��o�x��I�Y�)�-���"�Ś ~l�@��|} �&\Ր)8����e��1A���0\k�������ື�FK�D���F��nУ]1�[�����M�pm��Ro��:*���q���ˢ)2=��b���Q��>՟��ə"]���tT�ǡ�]���%<|�����=B@U����P#c�Y��g8y�8d��+ H�׀@�2�P���� �B��y���!?2Sk(��!����̅߿#:K���N�Ou��~Z:m����5l21am�9��DWW����F�U�Y�J����:� j#�!���Yy��O2�76����f�fp�y���l���"Ïzg!����:w�� p�n:�2E�@&��m��Z&f1��d�Ϙ~Jl��|����B�[i~A��̋�Ѝd�r!N��n6�g��za勞3K a��7�ڰ�H��mլ��^�|��]��h+���FIx(dw,����tZ��P�go�_,�I��� F����������@[eX����3A�iV����PԽaV/���?�h�O���}3ƫ����)F�܂��1DI!B{�-�C� �����0[�����Wh�ᨺ��T�����p������R��O�ra���﹤ǵ�0���hԲ�C�VM�m�W��ڹ�1�n{�;�YlɌ���0wN[�r[v����ރ��.�M���� �Cp*��Je:7��m�'��r�:NȜY5��5�'En����͍;@�1��ܻ�yO�U�g���x�'9`�uj����t�f�f���.k����u�f̀�y�(�Y$���#����W�שn�uO%�B���"3㹍*7�>E�\�'-�P�tA�������,�ox1xX�v�S����]@D�����eVY�rX�'|�"V�ܯM��e�`�� e�̉��'��]po!��ܙ�Xm@N�b�_�tޯA�@:�H�
Static task
static1
Behavioral task
behavioral1
Sample
536ef1142c264b61d32d3af52d40ef35807816a2b139a1d05fe0a080fa55994a.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
536ef1142c264b61d32d3af52d40ef35807816a2b139a1d05fe0a080fa55994a.exe
Resource
win10v2004-20240412-en
General
-
Target
536ef1142c264b61d32d3af52d40ef35807816a2b139a1d05fe0a080fa55994a
-
Size
13.8MB
-
MD5
6be11ea36bdd74f0560e4eba7eb0538b
-
SHA1
caa45ff8cce5a3d93986e6405e514781187cba89
-
SHA256
536ef1142c264b61d32d3af52d40ef35807816a2b139a1d05fe0a080fa55994a
-
SHA512
97c6521a00e7f9a0df45c2b390756707b1b7e61a4d5d3a184b29053539e0b6ae4297ea00bdde286130ba9441cc63390c809c648b081abf49de757ef7e42c615e
-
SSDEEP
393216:7dSkIm4lIwfV01t/hFl+UkEoiCkUAg8Vh6S:fIP2wi/XsUkRkUAg5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 536ef1142c264b61d32d3af52d40ef35807816a2b139a1d05fe0a080fa55994a
Files
-
536ef1142c264b61d32d3af52d40ef35807816a2b139a1d05fe0a080fa55994a.exe windows:6 windows x86 arch:x86
8a7b8108736d1ca7f0527de8a9912fdf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getnameinfo
crypt32
CryptQueryObject
advapi32
CryptGetHashParam
kernel32
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
CharUpperBuffW
shell32
ShellExecuteA
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
iphlpapi
GetAdaptersInfo
rpcrt4
RpcStringFreeA
bcrypt
BCryptGenRandom
vcruntime140
__std_type_info_name
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-runtime-l1-1-0
perror
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64_s
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 503KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qvmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qvmp1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qvmp2 Size: 13.8MB - Virtual size: 13.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ