dV8ء��G�(�����`yd�3��R��\M7��{8Rꮪ���{�̵�w��]/���]3R]�ae��qL%//�yzX��4L.�S|Ӡ���1c��O~�n��o��B8�kb��'h]D0�����ґ�rʴ1��|Sơ]9a�VH4��nf��O�3�aMO� ��&���v,�ٷVげ)-)6jXaA��H�2��)HP��#(|u�-y/������Z.����G�k'�L#镸����ȱi���T��ο�qV^+�kD���L��d+��������ɂ��Lk�anG�P�ɐ�����~��{��<܆���wE���]�w}�&u�F�ӕ�����;ĽJS��E���Ƹ��)�k#�^ ���^!|2��O���c(�.[�Bg�����3� �sޕ�/!����k�Ѱ\����B��u�cUvpf��rфYB��ɑh�f�D��F����Ƅ�~��R�#d^>�K\�^��2�_�_���J��MC��4�0��m�Q����9w�O��c�@3�Pg�5<���g c��I�M��~�gU�-�Vp�r�~��nh�_]��@P�7�C�e�t����~2b|�e_�}����M�ܨAB�U?<�JL�4�PW�-��3�����g���&K(UJr2��)�V���k4^3JDz��� 3��qeOX�` �\�N�~��n���o�-}B6W��z6�lHƯ-�S�8*L�m�ǘ��8� RH�DIE$qd�Q �N*|A\H5 ��V�*�E�<?|Q�jǜ��25ۦ�{%��,yn��Ŕm������ ��K�Q4R�*�?W��(�)��2���q\ta<Oۭ��7,�;p8��o���������S7H�J�>v�'K�Z� ��&��o� �O�J�!���Ԅ�qX���&�2)�Xī_Ent&t���h�91���c=GP����B�Dn�F�㔄lz����0�H[Vp������h�Ь�S+B��G� �ӻQjoGK��}ߘ�9�J� _�wQ�2%�©q\�Y�lxO�)���f����~�T�� �)TT�Q�Ry�>�-7�U#g��ͮ���ܤL�9'��ўL:2F�鑶Y�e[9�&Ax�FQ�v� q�J����ˠ�G������p>�s�������Hn���w'U�E��3��1H����n�/�s�^r=SB���Ѓ��%����S_@���C ��.���gd�Q����X��t� �7�g���[f����X9&�cf��乚�Ԫ�P�[ks����g���贰�j8��F�^�xs�Ϟ߃�wV�Y��%y��W:W�y�'OO��6 �V:����'#i4D�W�<��ù��7���9��>Mڕ��i�����o�����<W�;ģ��D�w�f7j���_:�M[ͬuje�f�����@����*>��a�������X�&����AԂ J�ÁA���e��4��0��/���Nc邳1R���x9Z����TW���Y��Cb��̔ߖ�g�Ќ�y�=�N�!�7�8���0 ��[X6��p�X��A9HK����peTwz���'O�&!��){!F �( 4��ad������Ö��k��F�>�|K)�r�7�-���ɭm�/6S�7)[i�r����`�Q ����4� G���^ե�㸫v����`)�t,A̅���4C#f��)�?W��a�^��i|�Y�=Mjr���UR�|l0��x�I����и)|}���M��e�moFŮ��9�y*qHH_�p���]}�f�w\�/�D0e,�����R۞LJ�źr��Q��_������b��������Ct�� �n�枚v�J`��Z �8�=���䱩�J�"�SOT�R���2��8�9Jg�S����`�����8��[���F�;�B�!_j5�h'���d�|{4w�����}��0~8�� Ʌ��/������W���UM{���W=� ��n��^O�➸����a9��-z )w�)��]Q��1+�������@��/�I@�'��+R�MO����1�jL����,���:��SD�ԑ�4��!��I��(]y���N��Js�W,���ێ p��ι#��O%�p?E��u��n��%� Q�����Z�{�GOˆ%|A�b����.�C��cJy4���WPv���N���m ��;��W���!% $����>������o���Y���!�r�P)�J��RWGi\\�<�a���b�w�G�0�w����9XZr�xؗ�H#�������(�:�����i����6�㻟�r�1[)A�}�J[�(Z6�w ����<c�C-�dD��Щ���螲��uqU����~iA:��ްF���+��~D&g1��X{3�,\���.���-G�����>�J8.�s��S^7�\�Ar�2oV�}� �q2�(V��A�E%���?@��G4� S����r�L��ԨBwJژ%9���TGOT����{�9v���<6����b1m��� T�U����F���A�݄ߖ-����wf���+?Q��~��j,���Yf�_�jg���L���&�S��mL � 8�²�� �;O �/�p�e���.��p$���� �i�f,G�nKݴ���2�V��i�bA��jO"����7��-����w(�?{����$(����8iȿ��M�F�VіP���f�x HQP�t:��<eçeNK����u5ItIY�W*٨�U"4���2mx?K�㸈��|���(�f�`��p��ڝ*V��7�FKB��Z,g��:��{;&��r��6�dK�ӡ���(5���\|��}]��W��;����R�/���,Y�aZy����~?����7�v4I=�|�Y`�7b� �Is�f�:l~�I�%�C#�,r��R�d�{;\�Ma��z�rtv���b^�n�L����to$������~�#=&�Xqoƌ_"xc��P�r3�B�ķ%��&�KTQ9�$G��[�kNT]O�#˼�zVVz�e�(}���N��fQ�� ��\�`����7� ˕�W��ǘJ�#�<8��U���$�(Ԏ#���G��% [wN4�_��;^�f*x 2l�
Static task
static1
Behavioral task
behavioral1
Sample
5a29d82ada18a592.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5a29d82ada18a592.exe
Resource
win10v2004-20240426-en
General
-
Target
5a29d82ada18a592.exe
-
Size
47.9MB
-
MD5
1a885b119af9ad5a0f21d7a4f1ff9f3a
-
SHA1
4b7db1ae9c7729da938a158f88f4b51a5c6b5ba9
-
SHA256
2755254040f0f34ace3a946b775e1feb1aaa30c3864e0a75234c33c818812af7
-
SHA512
6c72986c4f1c375a21d28549747e8d7bef72f92a8dee0576a5734f4a62cf0dd335da9afb2dd65a0c4b5f1196179db096d3fe2c28185c30317694580b59e439f5
-
SSDEEP
786432:0PeZGq4n/36w/jcAoKKT4jjb7MbjK+T3E8TOvur1DErzbglJg/3djt+R7j7R3rm:SfqO/1wgK0jHiK+TnSQSrH/N67jl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a29d82ada18a592.exe
Files
-
5a29d82ada18a592.exe.exe windows:6 windows x64 arch:x64
abd462c6e69e53800641de8d1fc7cb52
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnhookWindowsHookEx
CharUpperBuffW
advapi32
CryptGetProvParam
shell32
SHGetFolderPathW
ole32
CoSetProxyBlanket
oleaut32
VariantClear
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
normaliz
IdnToAscii
wldap32
ord200
crypt32
CertGetCertificateChain
ws2_32
WSAEventSelect
shlwapi
StrStrW
wtsapi32
WTSSendMessageA
rpcrt4
UuidCreate
ntdll
NtQueryDirectoryObject
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf_s
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 943KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 437KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 43.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 47.9MB - Virtual size: 47.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ