���s��1�r~������ƹq0"D��Tf>�ߎ��fL�A���)v�O��ɑ�3vC��E��̛�|u���~(� ���;��UG����j��Ld�-|��yqz�nǦ�h��� T��e�*�"fF�0j8��m?�|KN�K��Ah糺T������g�G���K"���n}V�-����%Q]C�����V38��B��lGs>�ga\|���C*��3S�X@7X�K��C��(e��O������OAP}0Y�e�����|G����+_�S4��E�sB�1����J���1.ū-�$;��U��9;F������_&�넑� �l��V�h� �� ��=:��E�����CQ�$���|�2��� ���V�(75���G���R��})�@�~wg��W>jq��TfP�*^��#�ۛ#�/wx�Z3�fە����V{��M�}�,Q���Dp��c���Z쫫Қ,��ȉ���L��Z (80�=Z�]Bw7����& k*��x�v���r�;�``+�gO�6a��ɀ!��2CJ����xR�H�> �PY)p�*U���W8�Jm?�`R�]h����D�$cGiI�i�UZC,|z1S�z5��Vht�$�TD�,�k�X�R����t"6r��`������bRu1�y:��V�Ʀ23 pu�*�o�Uޒ.�!�sz��.�w=A�ZOIyٿ4���#���h(�͞"�L��'X��bE��%��U+���JX^E�٭?�ԧ����]�mqZPjD�,�܈.���3L�yI ����|���^�;83��)������C�{'�4u�7Q.r��<Q�8v����߳�{%_p�C1^Yxd���7A��Z�v#cJ'�YL(%��Y�b�|I$��B�����X�1S�l���GO�^�T"��)�/�r����.��Ӵ�H�l�iG��y`om�����)f�b���K#�@�� ]���NQ�߃�CcH�U'1b3b�--��Ę>��t]1�rc�Y����q�W��G�!܅ ��S��M�+IW�wl�͏�]��="u��Ї�ݟ�tЇ�m���3���f(�\W>�2.P�t�d�Ǽ�11&Ƌ��(ӻ�G�?8Bp�a�I�P7���P�~��G�c�zv�U~�c����*���OZ+iCH��Ah/��R�oM�ǽ�hʎ�j�o0�ョ�UQ��p�-����8���L6�-����b�=l�7w��}*�@�ma�ɣ,aݲ�%UTQ�&6r���f�����VYպI���ѓ��a5�3 �5X�^(�(� �!�6����>2T��2����M���K8�!RM$9�l����nb�njy?}��s��w�_��E�;b����Xi��%�wA�� �|���d\��+1�=Sh�2]��B �/W���K�'4���jĕ^p�T+M�x��u��(eDq+�Zz$^;�pj���9�T�����4�[ [�b�"����O��)?�����6�x�(��=ک��P�KV1���`!�f����,K8eІ�,`�K���V������k�ۇ�V�d������2��H�u��$��E�~�IW��~���4�}��d���0'�Rf�^�MOB����Nr��RXtA����W���,һ��LL,�S�2ꚶn�r��=���K�;ay]��%[������t����������g��%�'�3��C��.��r"����A�J��xy�),T�}8j+�V���riB���)�hS���e5o��po7�/�<�;Zۏ��|���������f�aq�̖#`� � ��������hQ�UV�G�̻�Kc.X��T�Džn�ҙ3���b�)�!�J�;UF� 4�f�����]����Z�Q @ �@~����n��l����n�}��MY]i og�#z��.��|�%�����r�4_,x�oa�������������z�_W2��a�[Z1N}iO��Df�.��a����Sˬ!��/�����4a�Xp6�J�ϔ��+e�TnV6�k�M���[ҟ��C�D�jX>�"���'Ԗ������F5���`�.Щ�j�+������������z D�������4�"��H�I����H����&�w?�h�0���!�B�F���P��n���۳�+��)ǎX�2Μ�6sԱ}K�R��m���]_��*����^�G�>x>�$©����8YϨ���avg3�����K%���ZQ�F�\8����d�e6������.L��>QIX�������BnI�-��.��wZ���<��ST�B9i� p�tQ�x�I�h�P�2Vz9��~�ȭ�d˟Z���]d�L�s��}�aI����n��8��td����}�5g�۴����AZ6e'�&��Hq�+l�z� ��6��\i�2|� ��%W-���$ɦ��Z�}$DH�n����!h����h��\��uP��,Kax�7��X儚c�*�]=�;> ����l���.>m>}���{����j�r�Œ90�ɦ�n{��:���g�]�+^俺e* �W:��LZ֘j�9�wv79���%�':"�5 ͥ��Կ��) �!׳1��\�@�-l�](�t��=v&��-.��c�� 1Ѻ�I]�K����&� � ��:��ˁ7���O����!~���Wj�h�R���-=�u k+-8'&m��{<���oW�Kk��j�K��C0X��`ڊa�EQ�q�߄`�������:s\�<��=\b\�Mg�7L�P_����Ҩ�S�N)E� ��%�m<R<����ɯ+��O��W 1+����@!ܬ�u���>s;L`�s��L�s�r3e��1�3�{�����6��}��xB�\S�!��*3c��Vx�~|�MG�P�� H�ߐ/��L?���Gq=r���&��/婋��2��_�꣭��v�����,�e�n0�9�"@���N�Rs��:��(wљ��:��J�SmH&8����A}�k�"1":B)k�4m���N�X/����1��KF@���x�!��v��;�/�� �C��<\5aL?�0�?�˚;&��)�1�\�\�����dwy?ˎ]|�ƭlT���g�Α����
Static task
static1
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20240412-en
General
-
Target
Client.exe
-
Size
18.1MB
-
MD5
b4f6029db5765d0e1dea72ea796ed446
-
SHA1
06a571202466a292479fb96abac7c0617067fb3f
-
SHA256
870857949a71efc2aaab900f38ca31c58c66ceca6e035690d44096e4f2394e22
-
SHA512
e94a53165a71635952d4c91f9d77c76dd973b86add469059d890d54146254ff8f001df3c01f7a69f913ca30606f68ef1a73da81f9552173ba3afe8e63191b556
-
SSDEEP
393216:/3CG0PqLTiPyFCEgYvuDqnqKD31OzVwjaPjtZ6pz:/yG1LTiPyQnbKhylPjtZ6pz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client.exe
Files
-
Client.exe.exe windows:6 windows x64 arch:x64
fe493511d64bf971fb3047f5956fcdde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
gdi32
DeleteDC
advapi32
CryptAcquireContextA
shell32
ShellExecuteA
oleaut32
VariantClear
msvcp140
??Bid@locale@std@@QEAA_KXZ
psapi
GetModuleInformation
ntdll
NtRaiseHardError
wininet
InternetOpenUrlA
ws2_32
sendto
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertAddCertificateContextToStore
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-string-l1-1-0
strcat_s
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-convert-l1-1-0
strtoll
Exports
Exports
Sections
.text Size: - Virtual size: 637KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.,4+ Size: - Virtual size: 15.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CNN Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.>BG Size: 18.1MB - Virtual size: 18.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ