��,�w�oJ������Iluv�:W��O*K��Ͻa�0H�E]���8$-T���T�?Q�_�����Ġ���]�u�`��}�]������>pɸ���&��H�!��>y�`�m��<��V�,'S�F�b�0�<�x��b�S�bjjœ���G�M���䵆�9-g��#]#ӭD$��,+��-�����͔�͓�U0'x�R'�1uV&ͫAy3��eM��Q�.|�~�6s��m9֛3�:B��=�g�ӧ�vC*���}T��7:����'�t͊��^�O��ؿ���++�V�5Ya���z�pĶo�#��\�����l Q�8^+_J���=�eN��-�5����5w���=��Y��ɶ;�µ��U{��~�8�0�j�r���3�Kxΰ_q�+P��5��,�g�7-<�*g`�o#m�"0|�nLN�o���*+��E5��Ef^,���S�� �c �}�Q��H$�A����n����3�[��)S]6D�t��[��J~���ϔJ�_�Zz\XXO�:�Ul���8u"����D������|���Qsͽ�*}��s�=:,��^i���D��|w^���cy�C�/^g��x$��G��ŎWݜ0�ɰ�#�1�F��u"��qP�7m��dp��f!'5Д�E �M�Ch�ئ�Qz����Z�1��I(�S19JV���͝;���ܣ�]S4Q�����|�<���1�wv�ߙ�n_�=� ��89�-��L�y�����?����P����]�9���u�!�5DU��� ����?���s�u^�OX����vȬ�"εwnK��z�M�]�(�����(N�O�R?Χ|�(��1� �?Ł3�wL2|n�'$MNg5�D�� =����>L�m�M&�Y�w�4bX!9_҈�K2+l��t��=H�)K{���ո�kyAl��jx�c-;u���.1�I��&�2-������8��K�6`�p��xxta�F��/� oG�NMj��0��������ξ6�;���K{�=��t�h���e �5�#����H�C#���w��cVr_�J^�4�)�u���%�Vg\�It�M��P�;8('?�p����hC�i۶E��o��[�5�IA������]� ) gN�'��p=��R��Eք����<h�s���(��9bAa���N��;�~�������0�߃v_i<�e�f�;^��R�<+�^W�8�D4�i&o��E���#=�W�`0Ĵp|YV�m�P-�E_�oI����7�]�L��xG �b���:�7�lo�K�i�C�L���"�v(T��A��Y�/��x���>{��'f�Oȸ���j�L�X��ޞճ�˲��J5uȤ���s��jGZ=�v�q�p��� ��}k��n/�'����L��=��Y�`J�Ai%�-d/Պ�N�ι�Gb��P`EBkbٚ�IIZ>q��B�nD�a團Pb���S�x��7����d���J�����&������a�zi���ƅ��D�g �T��G������O 2t�N�C���.��']��*�K��~͑Q��a��ֿ֑ze��P�oF�9F ��K���;��|�m�tk����A�{���q� ')ʜY�h��$u�(�zAe��?�Q��"����A���L@��E����[�q�xe��z��6 �urJ��ZWA���#��������SQdήڃ�+T��x�ɲ��K��3���6(X���_�G���m�4v�����r�k���Az<�?4 �z�<���M�q �w�t.��Xv����?E$@�`B $�`�&��Z��ה�Eeٳ���|�����Ĺ؍���x�h��;��=�i �y�yO��� �j4*�����[�G:�|��E8N*���x<��iE=1�~Y��d�gtJʧl^蓀��ciN���v���+lz���� n� aA�-���e�+��+g����ٍzUx�O�H?垼�bNL�6�@HX�~�*��7wT� /����ùV��1�hM���`o.��M���F�1t ��x8:$0�b�IC,��^!$' ���i�nh3�@n��(š 8��L�]K3�(�d.�@��X�νS,̢>�7t���Q=�yu��R=��a����m�'C���|)�J_��g1����y,8��R��)�z����}{Im����x;�!���Q䓻}GH^VXGJ�pE�na�E)A��6�P�ۍ�0�G6�IG���ڹͻ��mV���O�.�+ )s��{YM\'����o�AB1HvgL"{� ��� ��~7�{�^��fD{�Q��w����KC(y�9�f@�@U��O7�����;z6U�kn��ޣ�?<˷���R��K���3�VѢ�B�B�`8Mo��W��ؿ��<7�&X�J�)��\���E���\�/������$ҵ�[��T�����|%���9�/|��b��a�����M����ͨ�HW(���['��I�-j���W 4@��l\���y��%����v����{������'�ٟ��i.�}�V���,4��NP�/��ڱB!0���7D9 {������ߩ���{�h*�#�4'�X�˸g��0+���� ���X���R� �}���&�� N���!��4�^;l��}f�M�pl'2��r��a��Iy�MM�� {t�P6ɜ�Be*��i�t���E#��g6�Jn��Rє��� [ 5�l��~csV����*��v[\�6K����P����<S�W����|����F=�~�<�2��v�|��4�__��p&�B���¢"�/F�����9�p�31#:�ߴ�;T�� �s���LJ_��A��a����~�*�1��=����Ȭ����mwJS���@թ�τ���LU�O�3 ���Lql��OQa���ĸ���F����$c:-� �ئ}�`dj��q�,/��\�N_��S�����"_�QN���E�� tv"=�d1 wu�5����yI��+v���}� �2�-5"ܩ%֩rhM�8f�����g�; ` ��'�JI��*.zN$�jW{� � ���h�bצ!�Y}v������pa5P[h��� !o��6>B�����@�����uF����0H� �ZA@q�8=.r�����І�C�xV�?߂W�3�U&c���a��3��r�?�I�#�a�/��X�<P��Խ��b�:�y��en��<�B����tk�ľ���ɽ%i[g�C4O��W!����S�2k�g��aq��pd.�C8���&A͕�b~�nB�)��n��7U���L����J���QU��gՀ���9�������mnb�Y��R�2�T����j�]������Z(j��'��`�#/(��2���Į3ٰ9$��-�T4�� 1�W�*M��p#�L:yxJ.�U�d�{��Lo>"�!^G�wL꘤Y��O�0��m|�P�"{l�6�~���Q�5 �d�&��vm�T�&T�����lD0�Zʵ�bN�M+��ڴ9�&�
Static task
static1
Behavioral task
behavioral1
Sample
Thaiphoon.exe
Resource
win10v2004-20240508-en
General
-
Target
Thaiphoon.exe
-
Size
3.9MB
-
MD5
ceca3001127e0672a63ca36a18b5029b
-
SHA1
8f95177e95cdb53e10c9a7a476e4de68c6517642
-
SHA256
cc01fc3d50969ed97607bf5b44df56252650cea906583549bbaaeb7ee6d61fab
-
SHA512
2aa8a5012b05699b3d68a89c8b7ce1783fdd11d8b1ae9ebecc3111e4115129329ca28a5f7577ba59fe347a071a92c03a803ba26f8b837c247717e1fe7972c065
-
SSDEEP
98304:rZi1jTOKMz8H+xMM3i2hZHic/vi9iCm2Qm0KU9jNRtxoCI:lIMz8+MSnHicXcmS0KUV3tx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Thaiphoon.exe
Files
-
Thaiphoon.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
Size: 895KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 99KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 210KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 357KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE