�WIJ���i���~�S��d��cdO��(�K�P3}��}�r'/�b`Ӹqb˄&�z@�tB�}��ɠ��b���P�|?� *kD��6{��tA9��#�o�<t;{%4�6!cR�L�`�~�`� `49ۊq���qm B��.AC�|�}��BZ:�����'@ʭ����4)4�i��T�<ۭ)+�cj��u�-ڛ��J�[�ŏ���{fo3�p�[G��T��z� ("#��.B&�� ����trm�<��c�������;I�T�Q���������j2�Dn��@p���k1KOۏ-���[ ����<iObf�ӎ{ [��� �5�)�O���nV�Yt�V�XN<!�fػ�� �\�k���Wa��xw�{�|t��B��]Գ����b�8�wv#�c �r8��Ț+�k� z�!5(>��3|�z>R�VA(0��A�q�i���D���9����R%a����!=t��u�ۋ�A-���x�����C��JܲN�,0��=,�4�,�8���D�bB�3����'+ �=uL��R���҅�sņ�������Ȩ`�!B�%��>{��p�mx��WB\�+ �!�Fc,Me1>`AJ ����eU*gr�s�@���ʅ$��T�������BAw���)pޔ?&�2K�֏�G;��$�ޱͿʩ[G N0�{_-3:�t}���J�V�4m@~���5��Ksy}6]���E�Cs ��'���o� .��.7��ӑ�x�c�тi(3#��P��.D�>zK^���C��R;�T����Nz{�;�%f��P��E8*����_�����v|��x��x��^�6��8�%��JD:G���I�1�`��7��ܛ��M�l�!�74�ݟ���xb#�k�]��OԨ�\'^�gd�Vp�!�!~~�Da�`���?ї%�G"������ڼ9Ȍl�H5�B�Ȯ.����'�FI� ��Ck �;���j.M����k�4H�M�[l��g{�ouUcX�ToZ�twf�ͼ5R��}ci�8x'��m�"�Ew2�hh�Ѐ���v�;�e��Su=�+jZ�8F*o����#��>3�p^3��t���o �u�VEyp<I��P흾�0� �tx0���Y:?�.�R"R�?����8���v�ً'�30��d ��_�ZyF�z��e�I���3G��R�o��_���w[!�'C�д�ϥ��T�������϶�4��b"}�hd@g�#7�:�~.�/���>`�i3rIK��_��N�5��c�Q�G��LƔ�ʯ������������j}�S��6����ã0�C��&u'�qx���Ѯ�'�Gnimf�ro��`кp�n�X�G�$��"o��6�mNZI�����[��) ����i�{SO+�Io�n"��t��َzg�2�ǜ�.�+���5x�@� �B��i��#��ǘ1�:3��5k� �p|g���d*�� ��R�_� �V�0!���v��g�anR|� �a�s>�5��|�%��[c����ҡ��a�r�w?�&e�&.��3��@�d��nz��~N��ko~2��u�p]f��L�o)�h�)1��H��ϸ��]H���w�ǎ�/�<�jȕa���}�9٣hZJ�.Z�_��Ѧ��hAH���[3��c�*��A���1�)4b(v:����!���p�>�8RGn���=3�`u:�G����a1Y��-���*�q���/��U�1%���_��j��K'�;�[p��P�/������N�]����}I��\��"c��Շ��}<�R>T^�Z2�ln�����������w73���d��hq�%���J9�˻(���z/$���XHھ(,0:��n�I�6�e��� �)�� ���cK�5e�ı��5�i�t���ʦo�}T�.w�0ٳdA�V�HoI�P�8:�S�=Π������v��ˊҁ�6��selZr��<a`B�E�ʹ�3a������g½j����G(F~��������| ���go�T#���kDL'a��Wp�Aݏ7M[���c|r�g&�.7˪h�]��b2��F��+ىc�"�E�J���Y״D{T{(ZЯ�/Q�;��s U>w~�Ró�<���`ɔ��g���z�����=��PǨ��(B<���2�BLv�u��H�c�z��]��#o��p�(�r��8�V�����q�ِV.)�����Q�*��"���Y��P����4Ҧa}�5;a8?�)ކ���8f7E+Rv#�m��B;�yn}-�{�9nô�h@ ��P�������Y2fj2���5���pn�nhU� �X)�n9����<j���'h��2��n\�k�&�3__l7(G��5\j\����oAyX��&���W���aj��W�^kuҌo"�*c[NG���"����Y��p7�e���Ա�4F����a;������FPK�9�y��Yh�ܹe+K������@�Y�ً�?�}���C��*�^;�U�ن���p�����b�;ns �Z��</��G��F�k���]��U �2�6D���p1`�e_I@EX���+�{K�A�=艸�q|Io�Nmzr��_7 E-�F����Z����1�i�tZ���s$\�g���%g��V��a�+nC�P�qˑm"n�,��%'Ϥp��f����l%�X'b�9�1� ������1�M�t�{�Nz}���gE.����x&jށ�ur��v[�����a���d����$�,��)*�2˅���aǼ8C�|�]X�Xh��Ұl:qmͷ�Ű�a�t���<��{_b����_�tmLh����jd>s�Y�ޑqkv�E^����Wc�|�����U'��Ur0�c��uѤ2�<�|�5ȿ�KQ!��%3䜢ժ���W*�;���l*��bH��Hj�A�i�&��0o��C��y��=�v��ҹ�2����;ʮ������zn�2v��MW��3e�$ʢ8IT��k� �&EYȳI�`����+ �f+�?&���x3F2�c[4��Ԭ��-$���,ON��;yEv�Fӭ��y�t�K���[l�Z�ɞ�?J���
Static task
static1
Behavioral task
behavioral1
Sample
6448db72be66c8d85509.exe
Resource
win10-20240404-en
General
-
Target
6448db72be66c8d85509.exe
-
Size
8.2MB
-
MD5
5420ed1a97d4be9bacdb9daaa4f318ef
-
SHA1
17e2db27956d7682860991cd9435e78a506f92b5
-
SHA256
4e10494f74dd4f6ac8d365dcdc36d0cd20dcad433f4ce1d3b13490107ebb4d71
-
SHA512
9dcc178cd36d23b20ece9397d29a1fd1a8f38eaeb99f79ac6f1d3a653731627b27b4da86a394aac45d2e0f7965f9e1bd4ba9c2293b3e60b122426eba7ba2b660
-
SSDEEP
196608:q55528kw24GIsUvxilUZO06oXGgevacMhU8CQJUl57KY/uREJz:q/5Cw2DgilUZnbGDNoZJUl53uw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6448db72be66c8d85509.exe
Files
-
6448db72be66c8d85509.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Om~ Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.c/5 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.N0T Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ