[�+�p�H}�u�5����n����sgn���s����ʹU��m�� ��(��q���i��Q��I��5+²~ւny����)E�YRc�eq���{���@����-�.27qi[��G㏲]���a���l6��x}��'���Z����jO��1p�B�-@Ol�Ą8��ƈ�� ��a��~ l� R���84���`=�3u,����{IC�����ť�YƩ6���_� ���]5H���p�t���W����ێ��b�D��I���e��EWϮD�1����27 %��b{8���i������wF:���{��p_�+X�@�T�.N�z�+��p��n�#B��_��"�û���K�X�c�H����������wU�Mj����3�}��,r^薤=�s���*����ڗ `��4B��=�ZP���>Y��w��� d������2���?��ve�z���â�P�Z.h�..�1d�ܒ��{T��o����<�9K���&-�T���L�^ u�3� �����R�4�n:�ļ*�|�6�}�h�w�q���ȁp�o�lGĘ���zh����m��^��� L��`�ϣ�;_���~�F�BY��� �YMz���Ť���%3���Vڽ�^Z 6b����j������~Aq�T�4� ����|?���������l}��3���<�/�%���o.AG�ק��ljH��6���%��%2.ZY#u�*�f���� ��x%PK�x����{ '���a� c�`~��e�gC�Y:��?�}�>%����⡺�i�ey�!���� �Z$���:rD �{c�{~ɡ��i��B�MO�YTV�a{�uaE+[A=,� >a�%�m"���e����N����O�T�q�k�=��T��7��M�nV��%�B!\|�Z2Wl��x��A�K��0� ���n�3�����Bn���b��������m][���|�Q 9��ڌ���2/���������w�ҹ�+~��$rP�@�oQ�1���Ev������y�QN�2��������,���4���J�k�l'!���&��O�n")�1��}�(��n��m������J���2�Nu�0� 8��ط��VK`� �)/Qٟ��ab����)M k`x�cѷV���t&�3b+uF��j�;�2�'s~�<�'J�}�]! ax��2zb#������0w�@��a�����P�fs�J�j�z����ۮ����NM�[��7ۇu�uT_�]�2�A8u_(�=&,���e^�5C�}b"H߮o5�Lv�u�My��`��CFᶂ[�ٵ(��?�鮷�?�����N�[6g�p�ql���di����5�o^X[2h./�������h�o?B��g�]�ԍ_���˜�C4��荰�^�z�-��r�~b��7]�(���+Sf ��s�O!�8(Śr1����w�UsDz���n�I,fu���ˬ���V��J�� .�#��5Q��?�_YѺ��� �����Q����m�H�L�_�md�,�p��7�b�-!Xa��� K�e�4���U��n<���A��V��E�è�E�o�D��*ڛ�L}^$)�xrd �RUѸ�D?����G�垼�=hd��o����E_ih [��&��{�:�b}_ z�_�SZ�����r��6���Gf��2*}���.G��Hg�9r4�7O� -�UN,��ʐ���y�/SW���?w\�Z_t�� �e�/cu�N��c�lQ�v>�� ��h9|�4�i,8f����#��t�u��,=�d��HH�� LbJwDdܺ������^�Q]䂐v�-��ʲ�5�$�$����Uvu����A�D���)��K[@e���d\u#���d����\��<��6q�+��<r�� �P�턒�,W��h4���*�Mb��`�°�뛴v֠t�Γ���C`J:̠E�T���oC���(��y���*'$�h��h�؎�p���Dؚ�q۰]���v��kE��SMעt�7�̺��,�M�-�$��Ü�����XPީ���]~x`��+"R�,e�Pg�#�8L�s����\���[ԍ�?��9���LܳAN�3�I2y������n�֡.�, `W����|� �86�=����t��1$� 3�<UZ�&��c�]�i�K�b��%:�R3l�̢n7��k����m�o.�������x8�FO��l���ڵ�7�'���"�m��1�.i�p=���nڙ:�� �>d�O��c������O�N��5�4w��1k�J�f��(iػ4�j�дV�Pd�}���+�a&����<�@����ʭ���� ���3gW.C@�?���h�*�V���ϰ�}俭i��K�2Hf�گO�����q���=��N�y��%�D%78!Wg���6�dS(��'�)�$���1�bh�X7��3հ���7�P�_U�Ơ�E`�21�mdZly,��5j{��_�`ɴyb���kP��Vŏ ;�.6�l4��� �7��^a2 ��?���y ���J!�۽/���*����.�?%�Z�GՐ|K�A��|T��� ���V�j�����y濛�;7�ʧ��P��8w�uS2T����6����=�� �b�6��m��|MATK��I�q�+CS3ZB�n�$�Z�:㦍�ʧ�VJg~�;�V$��kC�� �c�3�-�~��8oJ)�=M^ �}+���n�r�����w�<�.�D�@x�A\��m�z=�=ûX�BH#H�Y�`���`|��U3�~�����S`3�q�� n�`��������f��B� �л���h(�O&���������.�E���3�%�O*�,�*���D�W"�8I&d���@�/��T�f��wa�o 4��4W���}���E�yh�lK�цv)��a+٢n�j�b}K����� �?�̑�>��3b^���fdN�t��RB��J���K�Az�Q^.��>M�ل�:�ک����&f�cB�*�=( �h;�,���H�B^��e���!�_�`\!m
Behavioral task
behavioral1
Sample
ed0e474db3ea1fc797b9ba4750f0301dc82072c4e5c25cac3c0b241f448c7853.exe
Resource
win7-20240508-en
General
-
Target
ed0e474db3ea1fc797b9ba4750f0301dc82072c4e5c25cac3c0b241f448c7853.zip
-
Size
492KB
-
MD5
ba476dcdad555e85b2b8dd669f6753f6
-
SHA1
a6cd4eb8580e379db51aa1a0f763a4deb705b89b
-
SHA256
b64ef7a099c28505e9dc05f4d195e1917884fc0393ef7433be9b606a73628554
-
SHA512
305f7750f487f89998ed3a30d35253388984a9435d8933ca7b30570656dbd825a0b3cd325984ed6e1302b964d8c7ffc17b70a1ff772d42e814971d8460a4edfe
-
SSDEEP
12288:n6zflMx7Pznb/BD7jO4rraQXXF9xka4GEoSr9XBM9:n6G1b/p3OiXBp4GEhXBi
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ed0e474db3ea1fc797b9ba4750f0301dc82072c4e5c25cac3c0b241f448c7853 upx -
resource yara_rule static1/unpack001/ed0e474db3ea1fc797b9ba4750f0301dc82072c4e5c25cac3c0b241f448c7853 vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ed0e474db3ea1fc797b9ba4750f0301dc82072c4e5c25cac3c0b241f448c7853
Files
-
ed0e474db3ea1fc797b9ba4750f0301dc82072c4e5c25cac3c0b241f448c7853.zip.zip
Password: threatbook
-
ed0e474db3ea1fc797b9ba4750f0301dc82072c4e5c25cac3c0b241f448c7853.exe windows:5 windows x64 arch:x64
Password: threatbook
1aacb940e1e344a531c545d7fc2daf6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
UPX0 Size: - Virtual size: 416KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 386KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ