#��%$�Hx��jV����Z���$���wa�סKT���7HGN��Le���4�����lY��E����{�c���}=^x� �;JA6�q<��}%��t�,�EM~������y�����WK��]4D�X[���_U[�"U�v:����K���C����kb�WJ`�WZ�;���Y��c���:����2@�ۈ�÷)���fj*�N~�p(d��P7U�)B1#��������]0�c����y%��]`B;����P/�<�v*^�8(sB/K4?��8�R��Sn´�ΞP�$�� ��lI����6��.��X�9w��@�z���8���5O�U6��$y��y1�<�ɴM�!���;Hj*������)�K��.#����3�q\O�&3L��}h��M���d���W}�ݞ�����;p����P������ʸ�Cv���ۥS&M'g�4�`0���:d����/���q���!���3�й'�AO�#��� >�xԬ��� SMmdGh`�f��� aF�Ւzhm� }�$̑A@˸h��H�j=����o�?F��)w,�/=�|��(��Ǘ-Ԓ8�n��� 1�TD���V�<��>��釽�㖁��|#���r3��a�@�en�+�����o����P��?~����d�����v������M�]�@�M����t���N�t7�&H!/fc|U����wνbmG�L�v�/rRJ�{ ��tV炒���4P�8E��̜G3��!�̷�+>.4~:YKz���g_7��zj�q�����}ߗW+a��c���UǸnM*}~�U�3�*E�\A<������^�"�j��7 Nz��� .Sb�kܰ��]����!��!K}��ۀ���v:��$>E�%dP&�HV���� ���Y��)��[ -���B��?Si�����Q��Q�}���~O��Mo�y7��R��;"�� >�c�P����|M|�K��#^lVm�a����w�L��9C��Y�1�/�+h���p,�"[#P�D#i���--="�L(;2����;i�$�{�M]�$�_���`��� <2�����e{�p�7�:z�})�4\���.����U�=�~� b ��m�B��5����L�L�-G��� <� S����4��)}�ke�X�+����+���4ؗ��-��R]d�7���po��%�<r�8�R�mFh39� iReۇ4��mB�!w�LHf�A���/ZJo߅�u۷|M�#�J X?�,�s1ei]#U2Z:܂��QN-��*�7�;jw�?���h���#��"��vp�����$%�>���1#�hX����?R'�L�4lƚ���9�J?1��D�����B�Dj���{�9^���:���j?��9��5�x��~ P:��=�MC�6��11�(yϮ�)T_#�O瓍]E�.��WbDIY6�q����5�*��I.{��&���ֿa�����SY/FҠ��A$x�;C���۳n\�w}.���ND��.�<\�/�B�j���ac[P��c�$E�5� %�H���-�&L�iU�}qy����LCP �.W���T �bCV�_��# $���tsPB�H ���T ��+aD�:�a��e{[�h�u^�M�����Jro�e�*�/Op�j-�����_��'�L�c,p��*t�A��7�Ǡ�*=F���/�&[?p���v��ֶ+½p�ij�O��=�S��P�B[�U���c]@����YE�i�N��N� �䭍|��<�%R�pJ�u��v�[��z?jzՙ9~S����\��b EC)��f�s>��\���c�k������Q�5���p*ŋ[����_������[ﭫ_L�d�!Υ-��cX}��ygj�EK��a���!��0�MdP<Y�����`��GHU��ehR���a�UwH�2F�P{1B0Жq0���%A.�\ ~�Íi��)Q]ua6���>�k"�g�ô���v%p���k~���� ����Ccd��/1��aL0ϝ�b����`t�k� ����,��y�ᱜ�b��#QY����J����Bj����1���AB�#2?W��:w4m��l�3��سjd}<���� �����8�����|^��<�e˱#Z`c�H�$peC&B����Am�P5��T�'SݞC=����?�������{���/�{�}H�R��ȏ^Zo�ߏ"��)S�w2z%�I{��2�얟@�(r���&���(s��B���G�|�>�i�%����r��yH7���e�k� �hy��k���dž���,��o��z��2�&k<��U�%�.�2�|pL�Ņf.t{�1z{ ��ֹ|���9h���Ͷ �� _�@�n�z�Ź��O5�b@b���#�Rh���o��`$�<(��{NO���6�Y����w�siwO�����W/^���y���V!�cpM�n5z^�rV�� ��� Pw�F����5\�0\'KKN��p�Զ�� c�'���f�=��:����R)�8�D�n�TȰ�WC���������@���b��"̜���}�c�B �5$����;�j@_8�\{.�cC�ɒZ'֊�\5���!Qgcd�������Q����L�f&�&�uE�ɀc�/k ջ+"��O|��b ����e��(��NJ8�M@� �E�JQ醉�S��g�o�C`D0��T��'/�~h�u��A�*ƿ�d�m����ӛ��f�݊=�D��@��n|�U-�c��dkS����:��ܘ0�K�U\�vvp�>�7�L�������d���e��B����L��ܮ�c~�)��U�Q��0"�M�;0�y�^��Tˉ����x�b�eI���W���(���R��r��v�JȭK�f��!A�*�+O�{�wmc�aw�d���5�Zz��$�>{L.h�8Ԛf��Ք���.��E����U\+�*`T�����bSlN��#�[IA�)�)@�F��Cf�d�-��}�#&�����.���4fK� IC0n��6}���`'����z�v��K�#J�M����� u���NBMt������f6��J�rx�|�
Static task
static1
Behavioral task
behavioral1
Sample
c02741d36d4abcbcfc15debae9f17e78babf51688ea50e3b62cdc06bd85eace1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c02741d36d4abcbcfc15debae9f17e78babf51688ea50e3b62cdc06bd85eace1.exe
Resource
win10v2004-20240412-en
General
-
Target
c02741d36d4abcbcfc15debae9f17e78babf51688ea50e3b62cdc06bd85eace1.7z
-
Size
5.2MB
-
MD5
836afc65f83dabe9d4aa07076a14f6ac
-
SHA1
a18e50078fcf5db4b4aef9b51cfa4035a6c9f277
-
SHA256
d49747d8c695f0a28701b0abb5a3a7b137191ef624ba4de105765a1a073792a1
-
SHA512
d9d279abd3e22b85137c84191b6c218edaaf4d8a0894bed18f173975937ca4627e7f4f6cce4b378257414e01eaef69e60a11d21ff684989e81d9e909d6ca9b6f
-
SSDEEP
98304:/klI1KI7ECzL5/vbblLw+lmRoCDIshX5uV0f/THwJXM5T3u55:/k+KAEytbpwVWCDvhe0f/TOqrs5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c02741d36d4abcbcfc15debae9f17e78babf51688ea50e3b62cdc06bd85eace1
Files
-
c02741d36d4abcbcfc15debae9f17e78babf51688ea50e3b62cdc06bd85eace1.7z.7z
Password: infected
-
c02741d36d4abcbcfc15debae9f17e78babf51688ea50e3b62cdc06bd85eace1.exe windows:5 windows x64 arch:x64
Password: infected
e8bdd864b56c11f82f3e097ae7f71e01
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AddVectoredExceptionHandler
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
___lc_codepage_func
user32
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE