�D�%��l¼�����R�j[/���32�W�}e��"��lj9gc�ZP��?.=L���-L)Lĺ[�i�ƍ��ڋ��MWp�}I�ܨ�T0 ���b��=�x���� ��y�������Em��;HRI��k�)h���0fjE"yf.�SIr3��?eӁt+� ��~�t�iۜ��)9�������3�ʽv�w{ux�+��^ ,p�A�������F�s��[,�H+i����������=�9!$E��e���k�Z�^��8����O��rP_�&��s�\�fm�;l4�\N�=��u|du� �Vxڷ��{d�b$��xS��R˪I5u�-G&B��1F���P��q�)X�Zl�!���#j�&� ����L�����R��hɝ&�"_[��kAu;�|����B%'2y]�dB�&��yZ�aAUϐ����x���/��qģ�ti��w�����M���A�Y-���0u��B�5�����@�0k��bŘ����?J�Ǯ��gޒ�?�+%�2�;q��:b����9j�u7u3]��lzʦ��wy��R%QPKA�D�i�Ba�X���GeB�����{��n�?�S�9I1{���Q�㣪U���w5k���]"#@"R;Hpߨ�y���2�M�}����U5�2F~�Y8S����"�@R��"�MW�s��*IE��Z�iU�d���x��'��stw��y��e5 9�Ca�[��y.���w�HS��?I:�t'�����t���s(��p�Vd^�7����*ՙSLʖkJ37B4��R��q�=}���Ǜ,{�[��[�"�Lk�Z)�F�����U?v�pU�L� ������$��j6$�D�ݪ��;L�&��K�4y��X*F��[�ǥ쭸;�6P���C9�;?�6�j����/ܳ���6]D���Nv �>��� �,y�����Q�v����y�f��D{�mW֫^l�s��z��I�RMC�{%}\�VT����V����ɪ�jL�s4��2����@G��Z��9u�s��m�U*�7�g�����M���o��dn��Ryy�v���J`U�C��]��tm�S b\��Y� Y&`��o�'B�ԑ(E E���"œZV�E4��O�5�F����{����� � ��-d�6��c�%:O���J����❀����t�!"�m��q�'�&Vu�B�P�l;��g�`�g�'ۇ��18�w��ɺ��Ǣ#�*�{�cc.����Z��)S�z{�}��]>ϝ%ztq�H��:��tT��f"P����>�q�n��+���m���FI���W� ����� ;�S�̈��p��nG�Zd��\����ݦf�rI5Vh)��q�nR��tW�Ӝ�:q�o������G1��D�'�J4s��V�T)7�i1��1~I��.���. j b�"<����h 3�0����粰C�H7�Ķ���}���[��"Ε�a�'*{�7$Bٜ�V��U�� �ˣ����.w��W�� -c�e�\`[�,��d���d�rc��i1�����#�&u�pG �2���<�q��rI����ƴ��/s�z37A��Y�->\��X��JA�hj����?d��� $������ؘ1�W��/�*����s��u�����,]�";c>x[�K�um|�D��:���5:���k��ͭ-���k�5 e���i�Y����[���k-n^_c��.��^D��ھW�����jp#�F'~�.�<?ܶ����N ��6��DƵ�l8�9H��_�AnEY|8��ڻ��В�'��3�����3VH����[0 ��6=Â(=���(�ki�;�&"��G�����:�\4�� ���H�X�7�}��� �! ����5><�SB�V��1J �vTlU\T�J�5�����n�퐳�ڻ`��x)ϭ4ɕB������!o�p$x����J)�Qg�$ ��0F�w�%�צ?�X5�:5��^���D��^�}�!!�v���k�G�;�C�꜁�e.K�3���*;3��S��7���xr�&����\4�+>IIYr�5��XY� ���@sR������K���|/��z���{� �-�蝦:KߊcLn!vh��� <�g��v�4v�6z �<�͂��9��a7Ԗᅢ��>�������N��lD�6�v�9y���Hv��o��'�m�ҝ�i��R�������\�p)�3�5/��A1����S�?�N���������.� #ļ��wITz�5��[<rt�0����ui����j��PJpI����,C�#c�4�����_̯2�l�r��������F��C�b氚g����l���|*�����j_I�t�Z ��=R~����W��G�_d�&���hD �T����4D���(�3�$�x��ݷ�|��H[�}��q���8�O��@?߯L�:��I�y3�sbx�B�� ��)^�FJZ��2�<����Nw��s��ɐ�3�p�� �NW��9kTo���a~�4��N�=��\r��:��/J������?��n�r�P���#r��%ݮ2[�2�3��-�u��;˝C3��ĘQ�����Ai�����iy��8�#H/\���I��ᓻۭ�� lj2(� ����$D���댓�o��&X�ܟ � \�HQ�k� \� ���������{�rc�}&q����/E9*�JUM��'fNX#J�ͦj�_J���+vk ����qRH�G$.����I�\��H��#����(A���!�4��D略O���%�'>�/������<�izִ��1�`LV+�궊ʉ�_"cpmUTu**a)*��QJ����P�A?����V,5�������Vݝ�^��p�P1�[�#rW��%�����^l�R�UD�r(B��Acx�9��1?�^�m�[rëŇƣ�Tw:h���J9o��Iq5{�労��^@f�L�nG�u��5G .��C�Lq����g�a�w�:y���·�Y��d.�Éq2R��![��#��LO�%CyQ�G;x�����zV3e%k��zX �%�_&�d�<
Static task
static1
Behavioral task
behavioral1
Sample
Byr723V3Cq1.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Byr723V3Cq1.exe
Resource
win10v2004-20240419-en
General
-
Target
Byr723V3Cq1.exe
-
Size
5.6MB
-
MD5
aaf5a040886785f342286c88bc0bef9d
-
SHA1
714267f51b4bb3c4d0405f7c62a99eac1bf315c7
-
SHA256
b09692cc661dc47e3288e6950bc66ae6498e461a0b29b3409a2f5cbff56a2f4d
-
SHA512
339bc10c9c7f32f916c66778482fca6cde83d4a12a0843e4270ee79ee8826715ed6cddf087c6981cc5c9edf3cb11e2d493a193f4de5525e0e53da5a0b25332f9
-
SSDEEP
98304:63RkFQiVd4xc/zdMqSwn4xpfpqHW0RRd0hqMqaPYeDIrr:6hkxVRzdMqSwn4x6H7dqqMd3+r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Byr723V3Cq1.exe
Files
-
Byr723V3Cq1.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 461KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ