�+��)����8mS��`G�l�M���8� ��0��C��U f4ei�Ƭ��϶E0B�(dG��E� W_���s�C:�9�9�D:s��Z�OvA�)(x0Zj_F��ý������K�>�Q�2nPJ�,X��܂ʹ�By� �O#�<h��XkH�`�J��הP 9���F(��18���R��Y�~=����L8'� �{=�ǐ�I�$��A� �McqZ�q-��?79y ��p���U4)�P�2��H�;�k��N�Om�������ڎ��;�0M;9�.�2��$����E,�n�@�NRwhN,��Z�ޣ �b�G�,��O\���F0[Ѡ6��5;�C�M�2�˝O��9�*��.�%�����1+>S�� �#��)��g�����K���M�����D�H\pnA��>�&4�Q[�Xz�)��%������|u�i+\xܒN=������{�+�S:+Sq�4CtB�=B���0�Q���~i���[��[����Y���x���l2��؎͟�,���bY�s �M�� �:?�?Q���iPH��7IJ�\�/��Х|2�����7{�]��m�۫7���>��,A;c0�V1*�'�d�E|��dȒ�$�����oQ��.64TL'4�nm�p���R�*P�?��<�ʴ)�Ġ�A����sy���_7�����a������ 8����D���E*��Y�d��B6��Q]�X9{ Z(�ӌ ���h������Z*��綃�.ۓ���%<C��P�L���ur�)��8�Jal�y��1K[��I9���Un_��Yz�%S���S�����C�!��Jnܺ�|gr6�>2��7�����=$A�����K�^�dO%�������P��s[V%A:j1#���i���������A2[e�l'�{je>�~|�� ��a6����W��r8�{��E!�(�vw���%�r�`����{�ʼ�����f>#`���E��>o��@P/߯r�v>ac�bRO.�[-r��/����%���|ݕ {�a�V����������_��f���1��\��}��אU�W�|.��Z,�Va�n�����d�f�9���%���HC�F�����U���7�=��3Hd�4�>��F�l�B��s$YY؆C _u�Y�U�6�I�A�%YD[���s}���;��vBR��S�;O_/�G����Z�[�7&i�9֬��M�1`x�moSW�- �Uп1E���N��"�xbT���7Q6�m4��7��*u"M �)8��½��/����`t����%k:�ꧨ����s��#�}�+�4+N.�4�r�d�ϊj����&)U��:��PJV�|C���^H0<�����,����n�@��id��IUkC��s��&IEU8E�6���Y\ ���N�t<G��Y��y��]��OO2P���i��B�OP/<�Q�[����<�B0I ۼ���5����.�nj�;m �k2U��|/@�E����M_�s�?�oj}hs�1�oE��;�/�[�9����)B<ߋy�Y`3����o��Nmž>�,�G9��8���M,&\�����s���^1;�@%ƇR?����bÖ,/U��/����s�g&�����7R��!�b �j�����+���w9:┢c2��_R����?�r|�U[�<��&�<�b�h����� �\*���m� ���1F�$Z>{�%�5��M2��B�L- �_W�sIA��-�o�v����HB,���T�`V)�.=�g�Jol��T��;}�i�KD�����q�t�ḙ�:�)fC���vލ��ɲ����|��c�^gla��>�ۅ1�o�G�/���b�`�y�|�}��8��C�i0��;9���MP�$����������<1k;�5������8h�2.�Pi��D[�y�ր��;,ݧ���}�N������$1���M.G��IA����{���,���� q�=�M��l�3[s��A5�>��/{��-.W��O]gi��H����V��H��ܰWr^a��1ArQ�6�I�����g $��["c�@��K�(��c�5#����˲�����;�%Ǜ��&�f'ԙ�֪�އ-�- ��L�%!�,��$��#��� `���� 2��R7}�LWQfb� /��_�O�[}B���n�YA�G�2/N;��++E��:�ь7'��+���3�r٣��\$���eǶ$�VO�ǨW(c����|�����-���Og�,���1�k0އ���P3B�|/���B�y��7t�Q/�^Ce�4k�]i�cO�@FY� �m�~��Ӭ�0�X�!/��J�/?҄FY�����vڟ�֯z@��Y�m#���^��~��&�����\�-�ڂ��e�iI��y�8���i���A���N��i����;V>�����v��$�h�ݢ�KyPp�N�ɥ�k���K���1f�q*��r��B,��n�?d,�Jxd*?������yz<9�f�-�Lk�_�4��m��3��ј�m���s;O\����c�D�OZ[�>0n/�J����^�i�ٖa��t�#x�H���{coM�=�>�yfDNG�]-�o�f�ZH��c�s��-�R�$@~܃�`b�*��E�����$�p(����������|��Y2PD�(���/��Xg��r��w��/���Ak�*������r��8c]�WJ�O��q�?�r_q6�$�,�,�Bߺ��e1Ϗ�c�����&� �/�wۘR���L�2��ޫa��� �-!�u�^hA��%n��#���q��;N]&F�7Pm����e"��;h��Ǹ7����g��B�JgK�1S!\;�m��ρ:l_��7v�ĂI�S��g�%%�@��*d��a�̡��cRZ�ε�h�������ۡ.��ſ�=a"��w�C��}Tp�$�e��V�Ո�$zDa���jw2S:tS0���%@=qﺩ� +��B���ٺ*ꤴim�T3>T�����L�=I����@�0T�-���O�.��W��\(�� Z��]�P�Gs�ߋ;�?���澦a�8��X6 ��=R�Og��
Static task
static1
Behavioral task
behavioral1
Sample
9154a780e8b34efe88204aae5f0cf52e2ee511e3cce8b4b223a022f961ba58ca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9154a780e8b34efe88204aae5f0cf52e2ee511e3cce8b4b223a022f961ba58ca.exe
Resource
win10v2004-20240426-en
General
-
Target
9154a780e8b34efe88204aae5f0cf52e2ee511e3cce8b4b223a022f961ba58ca
-
Size
9.3MB
-
MD5
57ce948c0d33d97cbe6178b24bcfe95b
-
SHA1
3d91897337c3339d1621740918d47a6a7fd75943
-
SHA256
9154a780e8b34efe88204aae5f0cf52e2ee511e3cce8b4b223a022f961ba58ca
-
SHA512
6f462b2057f721e8c468866ecf37c658335bca251a63081f6e1d41928d428ab941d5c2a1722c872ef35c2d14c91d4254e836dd995cc20e83646e3c9a7f3e0d90
-
SSDEEP
196608:eKnzEKxgqub7fkr5/ANx8jOvEoHOaSYjPF2yL4vP:nnwKxY76/s8jOvEMNHjP8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9154a780e8b34efe88204aae5f0cf52e2ee511e3cce8b4b223a022f961ba58ca
Files
-
9154a780e8b34efe88204aae5f0cf52e2ee511e3cce8b4b223a022f961ba58ca.exe windows:6 windows x64 arch:x64
6ca7bcf879db17f1ce36d680a378df0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
Thread32Next
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
CharUpperBuffW
advapi32
RegCreateKeyExW
shell32
ShellExecuteA
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlCaptureContext
winmm
sndPlaySoundA
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
urlmon
URLDownloadToFileA
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-runtime-l1-1-0
strerror_s
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-math-l1-1-0
fmodf
Exports
Exports
Sections
.text Size: - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Bb0 Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.!#l Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SH. Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ