�賿t;�%�p��G�%=���⃤� G�}S���|{�{z�D<mW }m;#����-a���aϝ@�F���c ~}h �(�*}�yJ��� ���դ�8�*:O��9'˸��� RK8+&��k=$��㉑��j9�]z�O�on�������J��������c���AZ�9�Qpuݽ �V��V�# ���Yu��<���+��q_}�F;B_~��V���Y����40��87����M ��U�ԣ��/V�5g~��>!X�Ү-M�M�=�Wm���q)P����KB���t|'���KJٳ�B�4�Sxh��q�w���=>.?��������;�%���`iU�`a~��m��/#zvel��j�![��=�s�&��?'�퍲:��{ڃa��"����蛔ӽڿ/X��Pzt�I`nDҏ"�ۖ��%�[P�(�JQRA摰�GW-�~N�s�Ā��|������iI����@�!|�k�����"�����"K�<�������ˠ��䢍N�73z;�{T�T��)#Kp[Ģ�E�d��~�B�$Lՠ���]�ӣ�X�Hn_�l�Jʵ�@�":Y�p�g��7/�_��#���#}>�I&pD�l8<npy�[Pk�Ѕ̈́"k�.c�3����䅱��쐪����n��+D%t�g��g��i����j���?|H֔tYn�?m�(ת�_I�x'�[ ����'����R���Kľf�o�<� �����N���U�S�Ag7B��q��!�~|~�$�%�=o┪3�P=�<��UA�K���N������6�_��G�=]�WS�CN��[&9�r%��\��t� ���wW]�QO��&R�9t��{a���}�����b��@1���� �j^7h\�0�&Er#�e�����Ұ=M8�p����#��}�ȑ��v+��o).~� H�`1������K�ƒ7.O�mь��PrRG/��1�����M4��tVu o<�ĕ�٧jNΎMR�H[{'z�7��%U��<#�!O���#Ŋ���_B�g_x��(ۺ�ۡw����&�z����[�J;�$Q�m2|>�1�-"�;��b��=����}��@���TB!�h2��ڌ+jwK������@�`ݬ�_��f3��r+��o�#�����\�@��q���@�{Tw.��)h+�����c d����堝��\�|�I�B�1ec͆��N��&�bL����1[Ρci�[{�%al�m��]p%:��r����U�f�3���zp��+�%=E��g�UDv��xw�2�:;#,��Zc�ކ��!��T?�S�B�����0%s{d�,ᵾ��3Of�]I:Y��9����c��*d��XfLR����%V�f�Q8�D����F!������ԚR�yQa�N5]f7�gC��V��H���g)��M���;�t��ږc��H�����&=x���/�=r�5j Q�z��٨MY�E;)0�LCڪ�����][W���Vnj��î���e�����ȑ�����艢l�N`ݖ:z%K���Q���%bB �^|ѐr&13���֓on��U���j�L��Чte�4<d/��P=��%��5�쳞�� 335!kb+ 8αD�����o�h��n"w�Æ��F,��5�b1i��Z��#�&UT+��^�ܞ+r}�d�"����Z��ri��;A�J�IGI�6�+܍{���ē�z�g�{G�O�k^.%)�M�����Dl����.��E�w�Ӷ1ͧ��`J�@��ßZ,$�aͪ�VZ�~���E�.���U�@�Fp/����/ �����C���|e�N���b��mL1���x*Pk�&����8lӯE�ns��e�r�K���R��K������b��6Iu�p<,����l���E�%�Y���Ӟ\�����w�`]��F�+:�+��?�Յ��TNJ���K��np0VY��K�|�b^�rL��E�j�#N���%Z�̗������(�������$�o`RoA�pKw��3�d��.hk+���:���3o���SD\��G��C�$��s�X�4�����^��v�8��"�\� �zE���#�Á"F�Q�D�Xd�{�s!�P�mόI$��i1��.����mY?� 5���enLO ����zO�~R�lyt���a����0g+�k��[EXyN�C#G�!W�q�mq��bK�Ҟ���S�8��Q��^�1yH@��1���Re�,p�F[Yj��i��w�*^u���g����ٲ��ѽ��W+�B����Ϲ�{��a�0�)�v �H�����/s�<~;�{��d5h�6Ǵ��5���laG�x�*^��2 �%���I� a*���G� ��<�iI(�t,�g���$�%��ѓQ�������5�x����=g��3 �ˇAz�� ��km���߄�?����מ�h'tX��0K�a���i��+r.M�2)�_���� ��LE _����ԼBF���;�Ef?ձhP��7Iyr��%0j{���u��6���s!��_�,Ø^�.��� ůס�k��\��L�9������+��9���,(�� ���P������&MZ�Y���W�B�m�ß�g%�)3�����n��U�,�˶ޚ��A�[�q5�%���� H&�Cޗ�\��v�|��Y� ���5��JNJ*F�き ����4]����Z��mx��`�~���=ZՁ����3���J��� P����:��R���"Ϲ ����_p����*BK��4~�x��Rfv�'t��s��Z�,��7K���j ��� mmm� "��l\�Y��W1����M�-3.H�Y/��:8���P�<�B��$hGyG�!C��=ˬ{��{BTI G�Uc'����t^[ڷ|����2\.q�Ȁ�9���u"\Om-p�����a�$�{�a ���]_��B��O�X�̦� ��H�q�ɔX�Tc~���x���/K��T3��(���tDvD���������@��V��7�$�-Զc �>=��^��k� If�g�1y��6"Ň������^���=�*ԟI!�mJ&�-P�J����
Static task
static1
Behavioral task
behavioral1
Sample
Paranormal.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Paranormal.exe
Resource
win10v2004-20240226-en
General
-
Target
Paranormal.exe
-
Size
8.9MB
-
MD5
230b4fc20cde2488cf204fbe212a60bc
-
SHA1
e85d42b9b652f14b68a07127484459f5217b387f
-
SHA256
1910377d0d1a2786fee2935ae002cd8629e9c92bf5e9dba4c510021e8d16813a
-
SHA512
a69884af8cf1442d691e2debf4607f1a0a5d197e63d7d5a7b764475d017184875f4f3a9f4213614d4b53808a144378a133017569f174bfdab5a10c7dc5f6fb2e
-
SSDEEP
196608:Hb5KHOSLvpuIcg2cAyp2tKru+U+KA6rJnItH7dRv9eGChAykqPdm:HteuIce2tX+d6RIxrhIf1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Paranormal.exe
Files
-
Paranormal.exe.exe windows:6 windows x64 arch:x64
60d316f941cadc3175c3bccceaedaf5d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleWindow
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMenu
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChain
ws2_32
recvfrom
shlwapi
PathFileExistsA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
RtlVirtualUnwind
urlmon
URLDownloadToFileA
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlink
Exports
Exports
Sections
.text Size: - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hLI Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SSt Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1-U Size: 8.9MB - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ