MNsV������%����*�� VT/R�Y����y>��.��]%K��@1���l��7����rcZ�鷡�j��������C��~��5u@�Q��Ŏ�~m�Z��W�X����q����l���*��54��˙��.ñ�R�7/�)]Y�K���P\(�8FX���R$7��Q�>z��h4L�}�k?oIr4RB�:�Z��/@���H !���R�6Gf���P�����n��dT/f��# ���x�o=;v���U�W�9a]A�Y��:B.�֒w{'=-�x��eE$�|zwD��C���gL����KD �[��昪_%jȋ���- ��Q��5y��U�^�:Y��� ������fb_&��a �,�Ҽ(xw?ߌ�����o�r�m�4�y��)�<���d�+H}_0gC��/'w�L����A7�8�JsԹc��d��ƃ��n4� �\�De���?�*9����wk�[�y��n�� ��s�=$[���룷%��D���b�@P!�/�0�%�?��h4� �;J�����o�@V@ӡ���S��F.�#���<e� �� ����ڝ�>��Pt�ǽ���˟�˟�S��a#�ZN� �R��yb�3+8L��W���A��vMo�y�D[y�w��S�'��C�;e�Ҟ��`�h���xۿ�u�����O�]O ?���s��yq,ns�uI��K�5��]l�V@�6ҟ��o���.kހee{δ��?��-'˃t@�O���������K���)Zݷ�́��@��������rAFہ��^"X�`&��������ޓ�h8��'�蜣g[ԙ�(���S��{zt��؏��:��TU&c};��W%Z.��V@N|3#�[�� ����� ��zo�&�jU �w��(�];��W��ټ���1�w� �[�N?g��S�rChm�4�ӻ��`��z︀�Ǵ��me]�� ��G�����ʹ��Y�~LA�V������$��Tj��խ����M�`G�|6Sui���tZX��/^����I�Ս��q���C��R��Z���t��R�oS�I.Z4�X����}7�]�@#@���P/���,�}�i���t��~��lG��R�}������Uh�TL��)�'���6�$9. ~�]ZB����ϧ/���L�$#�/L7�HI����}���� h'�fs3>�+��1X{]���҂�*��gҽ���5�Q�������T'E�-0���G��'h�x'�jsJP�C9��OU�1���99��"�59+���>��iS[j)���~�����n9u9S'�m���|�TX.��*�t[0����mș�l��Q��OƇ�"vn���6��n馈ia�����Qj�y�xk,g'��</G���M;��]ɯ՜���3��6X���7 �UZWt~d���'D�>���.����VPi9!��nz*b/%���Ё��ߔ��ď:�f7��s���H�Y�esm�H���E�� ���u���j����D����F�?D��q8T��.��R�,�ƔA�'2�7>2q�����&UP�ZK�\o)m~��Mˡ����mw$S�o�x@ר�Dwh��w��G�z>3�&�TD��2��[�_�����P���`����p�����f�B�{W�9�<���HW�st-����\x�]&>�����՟��"_���%��3r<��7E��h~&<�o��K=�&����^P�k�T2�%sDIl��j!9�sY�3 =OV���:1�Ⱥz�x���b����V���%=n��-<\��~�,�̏��&[ Y��,� ћ�BYD|��X(ק)���!�a������%�zp���c~;�k�<�G��R>���G��e��@{�-/�C��}Q�Z���[!ί��R.0I��=X䈆Ʋ�D��f}G�R#Yk��u�]�� ��z�ȅbm?hR��o��]�W~����Ћ�_�� p������B�C����̠ōma����zE���X�=F���J:���9�{�r�x*�服~�$���īi}����lġ�H��q��!���`!k���Wc��o䩡�e ��,���N//L�]� �7��Tp��s���Cz�!ГoG���z�<6������ê:��z�3���C)i����)��R��q��xF5¦�g8YU$��/�ہ9*�,G[a�,�nKK����ޯ�3<jP֔���e�-� cC}x+'�_}������=w��E7 �%��Oa��{�c��Q�N�^�+�1:��n��Ĥ�PTU/>Rʟ�@v�/�xW�q0����H-��Eq!_:�z��t���#����|1�ǐն�g�L"BJGhg <�R�T������'ɶ�2�#�}�)��RF<�&��W�N1S��� ���ѱeW����C�Px,C�d�. �� UW!�1�%�x,9;��MsI&-�g�A�c����QUЯ�=��wϣG��y�Cܻ�G�c���:��c|$���Q�����h����o6������oc(�E&l�.���fJ��h��j��$�5PW�W��T��^&ȳzF��G<�sva��˂�c�q�f%Tь�^��&�5��<��}<��� ��i7���,�hz6\�z�w1��ߊ�k�1�o��a�">2F���k#"}<=�(���!h���P*� O[�Uۅ����.�V"ֿ=}1+���dR2���|���H��x}�c�.���;-�-jr�X��oA��]��l�8���}ny��Jɞ�}�q�h�a�3����Xa[�&(�O�l�J�����h[���c�C��Ʃ����������p}���o��$$_H��oJ�c��Bx5o��g"臝�@��7���^�����g\Ɏ}(�� n� �<�ؾUzIt`�o*�����5B���͋l���b�+����ǝ>���4��*���b��$ޭ�{�X D�q+)&9����"L���$NE.|4J7p�-�����Ҧ��+����T��t� y�^ɑ|�����vɦ*��6,k%�VT��s�_�s�űv*��k��s�~��\�[����ۚG�&<2\d�bSQ
Static task
static1
Behavioral task
behavioral1
Sample
b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7.exe
Resource
win7-20240221-en
General
-
Target
b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7
-
Size
6.9MB
-
MD5
e173c05c4a3e872292b1f21e6d1a633a
-
SHA1
60c97091d291855e9dcd3757ddc3a78daae1ac18
-
SHA256
b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7
-
SHA512
34acb6f310646af5ae973db4612e001ec2078a0c0f2758f9dafce18b34e5f703cedd3d316ed458bde47b9c31149e46fbddb16e2c0320e19e426389648828a5af
-
SSDEEP
98304:kb0PkiC5Sofp5XJdP/0Gu4STi94vlTKlrfxgLQFMjAe6shVJRzux84i:kYlMJdXS4STiqlTKlTyLKMkpsLvux8j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7
Files
-
b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7.exe windows:6 windows x86 arch:x86
bb616e083eaa46b8688914cb9ea611fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
RegCloseKey
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
msvcp140
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
wininet
InternetCheckConnectionA
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strcat_s
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mpn0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mpn1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ