��ri��P�v7��ͻLP�d�&���na9E���^L��)�o�]ثz7�&�8}PX���BF��}�?��gG�Cd_�� �I/��>4-��F��������ۏ� R �\�`��:����IwW"=����B�*K�l ���GpPx�Z$����iGp+�6<)[�����ʬ�y㍳�̒�v:������x2N�wK�7ys���ZW�b�]��X��>S1&�j[�Q �H����~�gJi�3z�lj�J�%j<����rl�����%�*�^\2�P�A?9GSI�&�ٙ�@v(�i�=x ���7�\�X%Ox9���4�t5Ci��_����'����4]�����!ߌ7ż=�x�z� N9"� ��w�TH1�����S��ڽ@�������_� N����~TÞnvw�U��I���.T���y�����Rׅ����S��q��_��n�~�h���"_�����!��}�v02��hgNœ�������7RxK�, ��4��� 34ς�|��0��â�Ԇ��ͱ����-��h�8׆����D�M>�Mg!D�� P<��1H&�MV*G8���D��60fͼ��e�9CG+lh�̬ߝ4�*!�}<���ᶪcvZǫd�Q>��ߥz�����prB{��CNA�҅'��x�����}1'wXtr.���Un�~j��8�(.��K�Y�����8�&WN�#u虺��la�P��9� �iQ� ���* ѕ�H=��.� ��R����A�[m?�-��[���y�rZ�p�O{����M١����E�e>�c��:���� h���g�/-���d�p��13��\[OXN�凳�x�چj�,r8�Z8�[1��t�&���n�����Ք�,UXŖ���dR���UN v������)�H����f�|W�� b�e4����vw���+#��h�����k!������J�x]4�ҙN�@���O� ��h,hkc�P$�5�!h��O�� <�m�hҤ�.��.�f��iV��U�)�0� �Š��b��u�/����������a)ZV����g:Ӝ�=��u��!������R-8��}g��@}��易�?}�������*qb�yl1�mE�5�v4�\�;4���L�@�9��I`#��U�R��;?Ɵ�����I�b߬TQՈ�˞���R���8G�P ���Ri�� 2'����%�!��k�0ݹ������?��&�����95�-�'����HE��ht���zA` ������C�o�D''�jh�]���Y!WN��@x .��@���̩�S�q�M%)E� ��&��g�+n�0���DY���F!$&^���D?��)��Ծ�u����HEf�[5ABA��R����ځe��fC'��OX�`�-��c/ �u��ME���jo���B��&��s����רm�*��KqwX�@XQ�y���2�Z�_6�@<�o����R��`�_Z�l��K~�͐������!�{� h�M&��b>�a6�WmS%u��{� J(k���|����gUt��F�.8�o��^��2{�#�ɔ�7�![ܧp�K� m���} ��u��m���'�XSPV*0�2g_U�z��t�J����e��<�ޞvʏ�yd�y<vl�D֩5��i��h<Z����&;6�HP���r�����3���c����}�$?��$�a3�E5%���sڷ>� �I�G����J]��d���}n!����R��ϙ�Ak�KK��jO��F�p�3�#�3�#,Cy��i�Uɿ�𪩜\YL�ИK8��;7��N{%�9���~�����_L��,�U�.��JYH.#U�Qڻ���2��.H��jaZ��F�/=lO�u p�c�O��t�_0�vB]�Vi5L%I�XX��֨��7���s��r�[T}�� Yb�nr����D#�3r�8�v���.�de�t"?�? �Y�b����<q�Ø*�]���6�����|�|hݣ�ۏ��a��C�#�U:!~����T�r? &C.�,�*��c��\�/xn��*JU�b���R�L$g�5�{ƅq�~mY9���x�P i��G��P���v <�VW 0h��&6����ɮOۚO/��.��V���'�<��'Tޜ�n��Ѱ�����\t�ѭ�_w�$6(��,�?��a�p�pdrܝ[��J��o�cZ)��Ub[Z �$�Sn���Mg�5[�o�������1�?= R.v=�u�$���.I�^�<y9���������߂��3��Y3�%�Q,pW5*�Q�=�y���U��m:����Ev텷"g�t��n�SE9j_�s&�`g�����aQ�r*�1ж��� /^[�fw~ha�Z:�W?Tj-US�h� ��~��B��� �)��}�Nd����G�&i����V�_��Q(���T8r��[���yI��S�a]���HJ/��[`?v����=��nc��{��d ���-U���,*���&���;]��]c�p,�r[�13�H&P���&�o�S�b�̫�1��)y֕����l �q�|#���.�%��]P��J�p��4���z���V�N�f���<2�˧�_.JK/T��{@��g6�~F�w�U���3aF ;y-[��_, �����aT]��L��S+mX�����4?����ku�P�ן����۟R�ѻUؠ� *�v.i�ؤqE�KQ-'��|l��0�~g9�D^��SCq0z���3����%������j.3by������ٜ�%�%K� �G�c[�B|�).C��q ��q�����]�q�m�pOT�v-":X������q��4%�� ��L蹕�#g�{�H�5��Z�������!4��l�y��!<T���:����������K���5�#��>bߍ�����\w�^F��M��RθBh��r� u�|�<w#9)�+3�E>�G���щ���8�*�ɽbk���ۺ8p����%k�h���1�-~�&<��.��L��G���2��Ƀ+(41����?<\���z�.�ʚo��$���3oY�M_(�u����Z:Kg@$���B"��S���%�4ޘ
Static task
static1
Behavioral task
behavioral1
Sample
6939e6f94bbde24b7bb63d5de97c66981b7376b8d3718fc2a20efc1ce10f9105.exe
Resource
win7-20240221-en
General
-
Target
6939e6f94bbde24b7bb63d5de97c66981b7376b8d3718fc2a20efc1ce10f9105
-
Size
6.5MB
-
MD5
619d5d919cd13c22f44b19c121d71db7
-
SHA1
349381a79413124cd452340def5c70b1394653aa
-
SHA256
6939e6f94bbde24b7bb63d5de97c66981b7376b8d3718fc2a20efc1ce10f9105
-
SHA512
edb0cc1ecbcfb243dbc8081f4a07bb09e33cda5b889a19d824a068ab501787c2829b766f47162fa36620c04423a9a68c5351aef717cb5680e092fd88d6458c85
-
SSDEEP
98304:xcACsxAdWLBgKaHJMecE6dL0E3UWH3O5JjEmsOaYX7fsnUl7GZnmL3uzZ:xxAQ3yMer6dgEkWXO5JsOaaEhz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6939e6f94bbde24b7bb63d5de97c66981b7376b8d3718fc2a20efc1ce10f9105
Files
-
6939e6f94bbde24b7bb63d5de97c66981b7376b8d3718fc2a20efc1ce10f9105.exe windows:6 windows x86 arch:x86
3bfd962c27b7334b5172f928db0b5ce3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
RegCloseKey
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
msvcp140
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mpn0 Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mpn1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ