�<?�"�o �����O]�8�\�F(P^窡u�gBU�zO��.�2Q���\��`��[� �h��1�l�Y�if��pR �r��>¢�|e�L�w��,(>�U��\ED$�dP[�Pg@��|���H�9[�^���Qt$��Kڟ��v��Y�X4Z�`� :s������ݶH�,F��-\��դX�i��!:� 7��Ǐ���Dz}����|S��%� �-�ic��/;־����܊Ѝmy�57�� X�ZM��|�]������V� �"�G�6��9�[�d�X��z^�n%UB���M�j�g?2��%�(&&rD�XGd�o�����nr�$�|��U?��?��� ���4jW)XV���§8�~�P+����`��sq�w�d^ާj�R܍G9?����B!�: ��B驨�:��"�4϶�߯��v(^vI�����k����i�w��B�Ō�#̧��S�V���d���.��#�Zn*��U��89&�Dv����>����ut�}���s4��Tb��A�\����""MԾ퉦�x���[6���ur���� u!�M6�u�5cڇ��ox�>0җǎ�I��Lp�L���hcix/u�qd}?l���� ��7Ѱ])�wʸ�[R�[ȼ��>0���c���BJ����TL�H@:x ԝ���q8O�r{+��_�h�y[�H�)`�V�<+-\�60����ߒ9-��&и����x{�藲��֕2�(9w�]>F��C�;z���u�Ֆ�.���Uw$�6(u�}K�X�Sē���?�0 ��ӽ��h�?ɂA�)�d�Z�����WҾ��t�-��v��^���t�d�� �g�Њ#-��Ұۿز$&�����o�LUxx qi0Cr�ʨ,`���Xa�ge�N����(&@;>Q%��M��B�{���vG��R���Q���iL� n���e��&`����UE�<V,��-[�H<2�m%l�0��h�%��ٓt(�f�hKܖ��P�nt�x;��;�'��S"s[��h��l{Z��|�˟���Y4�OKlF�e�~�H�$�#�Hk�Q�>�����F���ƃ�`����hQ�|�Ά��B�?9YQ��R��Z�-�X:�Ch�U�H�c4` 7ڹ�f�}!}HV&�r������C��)G HxI$ʔ��z/T����т3T�P�1C%$?LT띠����*��4V��|X0<�L=�"���'��Ta�N��J�������NK�,�$��b[�^�Ê4�L+�5$���1� _�D�v��� W�k������72�,J��)����q V�S|�fn�Yc���vQ����X�0�W���k�x;F�{ӗ�w�q�����,��x��:���]'���R���}&�6��(�zl~.SK� �k��60���̟�u�T�=b=I��h.p&�`-\���������9�IN����@��BJ�-Q���Ě�b�Õ������Y~��.:o��;���l�e�L�#w��`���$/��=d��l��U������0���n�S,��\<Gڹ�[�f����>�^yhZ~�Z�UA7rJ8�zLú��3a�pߖ�P��'�|n�I#3U((��}Z�*�~�c~-���&o��d4�k��ɓ�K���$���h�(�"˕�(�q��� O*�f��,��W�>�y��'Y�A���L������\;f�-��"��������%K�tO��吚XZw� ����kk6t�Ӎ�A�d r!�6T`�!|�>��MdR� �j_��\��O͒7�)���\���셰tIX�z�ӠȪg|��� /;��`ZV5�� ��"�h��G�����: K�LX��ҕ�A�c8��2�\`w����{�W�ʏ˫�� l "�ٗG�6�5����[���9ٗZ��S��=�)�|��uF��X���Maw�?�R�@�髯��q:(=w�c��s�@���{ 7dD�p[��oᅭ�YYk�4h&�ϧÇ�_�Moi��*��ީ0d7����8��K�P0�wuM�\�-^d���-:b�1�NJ�L���g7C5�;�jCZ�v�s\��^N��C>��`>��������b��I�d\���+���(٪�K�-W� a�a T�0.�����a�>�:Y�� ��� i�f�8Ⱥ ?Q�6��`r<�3.hR� ���9z�|@X�I���o��i�?0p}�r%M�]��(r��׆b�I<���E�����Rg!�إK����� �; 5���8��(<�ߺz%�1��ʿ���22\d�쓙�Ֆ�N�3�BF��=l����(Ή�(���<y3K�p��z����B��鹃5���@m�cզl�Q�9��w.+�j �W%�o>�������Wpd��I,D��DR��}2J�Ǐ X�(��&�P���`�L�� �ا5qC��6�g����,���=D�$��*�iR�3B�� ����̒�rY��b����Ո��i��,J$%�ֱ�=p�>���D��"2�T��<d;,�m��6���)�mE������%������xJ�-VS��'�N��MC� P��z���4H��o$��hk]��ttMs|U�q����[`ݢ(M�/��mT��'ւ���L��wC���X�9 M!�ib��2�'Zyh g�Q��~e,�φ�� �&"n�.ƪ����(�5%Pr��PQu`��Z|�=G���Y����v2��������Ԃ�j�|��@�K������ s�%�p̙hh����&C���.̈́�p�d ��/���w��9I����֏��}������`l=�41�v����c�>��(�x|�b��c�@/T�L����Ξ�_�Ԏ�<(�z ��i�0^�"�~sC���gR_������â�Pg����vC����� s<�?K�O��Kf���I�ȇ����@""l�i�q���r����+�8|��#G�Đ��n��-�<��#(G�[*�TJUƥu��[ e�N��>K4�|]�O��D4��%��ZL�l��r�_����}�"�f��R
Static task
static1
Behavioral task
behavioral1
Sample
hide.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
hide.exe
Resource
win10v2004-20240412-en
General
-
Target
hide.exe
-
Size
6.4MB
-
MD5
19c6a70915e9e3532b060f3a221f448f
-
SHA1
bfea226382fea6b7ba28fcdd2317ba3eb248b5f5
-
SHA256
4ede9e08bd6408352e194802c6512e3bf6b68f31039da2adee266fd5ca730674
-
SHA512
7e8c46b8f20dfed8a1741cedfa4368d72f5632fe2d57842b9f437ddde205eb1bce8c8b888adb18bf5093704a6a8c18ed4de72fc4b9b0a4a54c1bfc8dde39345c
-
SSDEEP
196608:7OkQxGBdchme59GVhsHFvNdPyCzLBW9B:ykQ8Bdc1nJvHPyn9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hide.exe
Files
-
hide.exe.exe windows:6 windows x64 arch:x64
7424a3fdd71e566bb3eca435136d8b62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
VerSetConditionMask
d3d9
Direct3DCreate9
kernel32
CreateProcessA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptDestroyHash
shell32
ShellExecuteW
ole32
StringFromGUID2
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
normaliz
IdnToAscii
ws2_32
getpeername
wldap32
ord143
crypt32
CertOpenStore
bcrypt
BCryptCloseAlgorithmProvider
xinput1_3
ord4
imm32
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 936KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 327KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data220 Size: - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1337 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data221 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data222 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ