��:��x�y`��=G��KrU<S�Շ��}i�s��\1"uYуʔ g�d�g�A����T����x�~�hѭC�@g8Qx@C,�Y�F�}~eZ�4r$�hH[����J��Y�6����� z��YVCh5N �Mw������k�0��0�=ؚcz����n�m�uo��@��a?R%��B`�X��ZP �T0)[�yG ��w�o��PLG���H�%$�g�Qתv�`���xi��fK+���������j_������wrtK��X <���nV�Eڰ�BF�h,��|�ȫy�D�̃J5�f��6YF�Q��Z��U��w�����u`"�Ř0q�T�@�v�h#="�ur~�̧���7�2������0^����x�����xIIğ$*����_�q|�y��馑����n�·�v�@ M���c�����Gvg0lw�ى� ��Cwgv^�����<�9� ��s<~5����d�o��v����3FT�������,`��Y��mRY�E|d�f��Iq*gŪfw8"�[�a6ą�s~�AO}��bz5����l89 f`��a�P�� $��N�|��8�j��{�?B��=��H}�V:��9�e�r�{�9�� �4p�ǵ�����W�Hv+\��ѤN ӄ>�J�q�p8y���C?vY2��������B��@+2��n��P��>V�_�͑���J�=΄e�W*�xy�K=`����<�~T��݇�X���ƔF�i53�VgWa-�a\J����CM�H+���b ������5���A�Ց������ <Dkt$�,� �<��j����YK�?DTKz�������/c%���U3��W�k���J� W����C���p��H��j���\J]��]B�s�şA"rts�:)�u������Ղ]��e@zkvB����v����K�� ��飮���se�/������C*SK� ���q����*H�~��5�4���&[��~`l%��@�ڢ�&Y�U��J%��$�����G���Ul�f��lI�t�,�)gN�)���M��^�����=;�@�S8ӎ�_����.7��ɟ��,=E�rx�zj �<��SN*J�M�r��:U��*� !3 �G����CXZ*&ߒb餥�&�)����|9�E �U��xj�u��]?�[���c��_�vN`b��^�F2���Լ��(�M��`�š�d%� �N���3q�ӏ�(��i��нek+3͑:��@\�*�k]�@Yҗ�P��������"]<��fd�h9?���U SZ����Y_���s.��z��� s}���?йY���Mȝ�]`M��������;�F��ؙi�G����8Z����s ��4;�d�B��>d����^Ұ�⭣:i)\��I�gP�oO�Q��F2��S�C�ۃ�`+�0�>�FǨ(~�mz��o�K�u�6�4з�`x�Jg�u��vi�_*S�nf�� 0ĕ�d�'R�G9-z�weyi���v�<�O�~���-���� �Pٿ��Jm5�x�ɡ=:r��0��2��er!f��|*�z##��R���z]���E�S�*�أ��̭\�i~'�ԙ�8�"��Za����D�gK�~�_�y ^�Ӵ4�B�kt!|է P �C0��g�y˲��ࡘe�����zt-�B�;��8J~y������?&�LQU��ON9�9��7JP!�2��1�S�K,�e[���Ǵ�W�)�h������'1&>���!��TІS&ŘK��&��"3ڑfE|g�'{/�b�&qS�|�;��IM%]J�Yg�P$���3�H���l�4P��0�P�sD�X�������}V��A�mYE1�j� p�e;p��1F�*�5����Q�ƴ�{�q�����J=����>N|�����Հ/}��^�}`�Y�'��8/��ak�����U2��0���JNP0�=L�]�P�>.�����@!�>˂T�W�M��=��.���4��p������<�5=i��5�6y��Pw2މ���do�?]&lcZe(�s~d�;�T�� �ݴz���~�i���9��'�s��"�Q �v�ܴ�X��IE�6��,��������� �3�`��ށ�Y����`eD,�I����[K��8���q��|�9�c��E=���L�I� �����W����\H��;#�c�҂\��Qc��7�WR���/�6O��>���.�I���3�Yu+�yR�mT��z�צ���s�]��xw�#y���T:����L��b_�*��¼���*uSe\���eh��nG������� �]L,FBԬ�$t��P�V�� X���@z�X�'h WL�tϖae��a����7 a�5��e �������� ��h6N��[-P�<�8�P���p|����:'p�O�G�"+��\Q(|ɻ¦����T?E���̗�9�Q`��Ŏ�Q������K��Qfgr��z�p� h��ތ,�f��91'�i�&>���'�r�l���a�������>�CB=�ߋ>`�n���S� e��"�TG:��7��W���,�\��z����\��:�e�X$��4�c��Ú4�e�Ќ�H ���žǼ�@�i��I���6������(i�;�A`Vܦ��5v����w���##����fc!���P���p�8jKqL X6��s��B�W� �N�!�+�D�P�"�A��%�q!��5��]F��1|��M\���FN������#�۳墀)��c�����˂ku�����0&R'1���]U�p!��}�TWN&�v�s)���mN���k7]l����< �)������P�T�3�� �Ř;uO��ĩck+�<S�-\����N��B6a-����Tc�i��q�ò[�Ub�e�Ez'��YGc���J��s��BapĢ������A3�3��H����� �J�`�Mi�p��Fv�K�!� ��2�1ZLToQ�f�]|��v�Q�������~�����|0��VϢ!��-��d]O�L3'�ꚁ�����C6Ʃ^��į�A��k��7Νi%r@�{���O�?� �Kg?w��v'�$ ���.�6
Static task
static1
Behavioral task
behavioral1
Sample
6b5fc34d2bd6d6d2f578.exe
Resource
win10v2004-20240508-en
General
-
Target
6b5fc34d2bd6d6d2f578.exe
-
Size
8.2MB
-
MD5
8c0e5b4828d4688915e4aeefeaf3c797
-
SHA1
1fe107c1d1f163b5b68a3d826f9bbae752d8604e
-
SHA256
e0972112c4966b9a45b77418258a03fb0c6acd316eecf6e85b0d9c5cf7be1d02
-
SHA512
778b478959db6f42aeb966e6e0085c24004c6aee42ab9757e40bab52285a433c1849d3bade9cc8b750e576bf46b0dc5739fff587edc705921f31db9fc9f68e9b
-
SSDEEP
196608:A3YgPJUs9/lCwJJfgJYt7We+LHQS50LNM1+vw0aufg:UPJU+lCwJJoYNH+LHQLRq+vxjg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b5fc34d2bd6d6d2f578.exe
Files
-
6b5fc34d2bd6d6d2f578.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.LBv Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.;ZW Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ooC Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ