�������'d#���Pل�VrD"�t_6���%'n� �P�/�}SS!�{���;^�%,�b�E?�{\GqEٖ�6T:�JcfV�6���YIJ3��U�����MbS��#���r�kF����Ԫ'R�\��|��~��lK��@��\��>�{ZToWC�i'�4q����<B��]#o�`��<8�C1o��T-o��0�Y~�g��Ĩ�.��6�����D��]�׳��L��~�h5�8 *��V��� � �G:�K\<ż�����?���縄i�Gȗ8��.���w�d{�\�uF���?��8"Y�¶�Ƴ��R��*�>������I�N-��A�@��!+su������ܳoQ��âG/o��B�;c~��nn���[��_��ݗ��)�:q�ELTy �� 2j`��oN>��B�#��z�xR��K�m�7����g���y�s�,Q>�tr��F,�����L���~�����t�'�c=�R����~��Mzy&�v���D�=I�='����(a�:��\����x,���B�M]\�jM�8��b,Ъx����T��rH)0k����C� xrR�H(!�I̺�e���ևM�4�X���.(i�Y�$3�hq��غ��*X��e�Em�R�J�_��QC2ǜ룗y&˾S�X�~���h�?sR&�V|a/�q��k�N�d�)�˯��~d�H��k'y 2O��;�(p:�����U�⚘ b�D��?b?T�6l�i���/��]�q��s ��I~�v��?f����O{����V8�,i���>PGy�S����aivs�+rҬ�)Oui%:3�����x�*�#e�ly�S��d��.���Z[�eI���8�їph�V[�l4z6�����Ɍy��wV���Ha�+�+��-O�L�����S.7����e頊X*cO �k������'����j>y�ݕU ���sJ� ��Nۨ\�UG?�}�C�����A�M�~fP�3G��^c<wKz~D��Wuu�*�'���=\܁�z��ޜk�"�79-bF��O(L��J�x��2k��"T��d_����z���_��-�A�j�n�����6LL!�ʓ�=+�D�&��1��8��_��z"�k�����c��oE��t<R��XVa怢�6vi%� N@�C�5̻q�p4&L�Q'@ ��>i5pZOsr���t���(�Sm�rOwW*d�cjs��4��Ŭ�>TicO��� �B�Η�D!��/�:��X���/���MI���v2���Q���G�Wޫ e 4ƒ$C!�#����z�2n���^��m���o� ����*Lg�6L���`Z�����a���!k�ZD'�ij�gu{�d( f���*� M1�`���I{Au����pB�ctFAZ�i�efM�\!�G��o��O��D9rYA|i�wt�uŜLH�Ґ}`�6"z]f)��l?��,�^#�ͩ7Di�J��9aٜ�{��h,F�H���RA��v���C�����m祵i���k�P�KK�~j�$Ti�s>I�MTb�l,���<�ï�ԢB����Z*)��x��F�9$�^]����$�q�y�R���)��k��M�eK���Uj����T�j�=3�S��ec_v������JGR9t��[V�ns�#�V���&Y� ��Vg��� ���k:)��鴛rr���uؔs��i������F�q����u4���3����ol�u����bh`rLa}d(,d�Z�=����z+�m���2 ��kS�pK��cؠ�r�IYal�&h�tɽwt�T2_R=��(��0~{��[ �A*��������7fמ��KuXF[Yž�CC �4�S�꾌-�d/�@"�� V��� ���k�\3?e�TH�d-n��+�q�������v�_���3H_�RZ3+���=�����gI��- Tߝ��7��{��۟?}�пMv��Q��m��B�aj��C��(B���`��^��wK�b��0)�lh�r�9�JV�g�a��,)��(��^�&"o�M�)��S���Ǖ?�P@���l�c?��-����U4��S$xrm|�+���ɬȯo�NیM��R~)�2��`���Q�р��<�qq^A�mr�8��b�ZV��<����yD�մz���Xj�s��]E��2J��0B��,����^���$�K�s�ٱ��EZ��<vR*����em^|i���� N�K�* ���4.��k����k�Q�z��0N����fșX��P�q��y�����7�!w�7�� �~H���G�A|C�h���nx��mQ�$�p?.��@m��Rھa��Q�9T,��Jh;���@6pdl��3[S>g�61�ac�q���+��G��/M�*���(D@ێ}a�k�3���u)�`*�N4ڛ�Sz K��M*�FG 6��3%�b�^\��$0�w؆U&v�`@�)�TE Z$�K�I�R��%���Op{5@ѹQ`��dؖK^�ubb�s3Y7s�2�R�,4�Ptw��)yc'VՅ��DG�A2�qA��uZ�5�❨�"��M��j�Wf�����gU�aqPm���45[r�@������`z��|ѓ���6�-kb����˖H���Đ�0P&vjy����t�L4�&�4wU�;*�"���� ��:�}o���C/4r��+�G2.��V�ߥpJ��~G�EN��"U>�)���� �|�����o��0�,��D������F7|�5Z�\��p(rh��!:0y�Q�K?��h��\����t��>�0�8���T��C7����no��m#��Z/�����|A����?��u����J�F��ω\[^i�1Z`$g4x1*���H㚢h��Ա�?o�X��l�m<�{�^|JS��� ���V���)0Q��j���J�5w��.��F����W�P�J��DF��M�4 �#���A$~.=������O�㭬�����^3K�:)��(�S���Y�:_�x��/�Fu��m�[w-�7R�-b����:}"���Ph�h���C���~B�R�i�����P��{J�k}C�A�����Ҍ9]<����@Z����ȼ��
Static task
static1
Behavioral task
behavioral1
Sample
0wkimO6.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
0wkimO6.exe
Resource
win10v2004-20240709-en
General
-
Target
0wkimO6.exe
-
Size
8.6MB
-
MD5
ed6e858ce79defcfdd3f96f2e020b7e7
-
SHA1
54fde20a452d35369168f298a26a4d43b77c8d0f
-
SHA256
1d2a3da2608249ed54717272b0e5a6b9f66de696da509c6c9ac97f477f12e909
-
SHA512
7f96310ab8d49fa0d58810fc87cb02c2219a2b9e78a6afe9086cccb42f1c4e45cb8aca16b39e202f3e959a3c0f833020d09bbd432d48f7eceadf97f3eba5e2d8
-
SSDEEP
196608:3+eyvDxKttjOZSCmpwQf20niIU+iVQ6A9:3+eyrxEtqZmrpnVFi2N9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0wkimO6.exe
Files
-
0wkimO6.exe.exe windows:6 windows x64 arch:x64
f497669cf361833f615107eb9514885e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeleteCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
d3d9
Direct3DCreate9
winhttp
WinHttpOpen
imm32
ImmGetContext
normaliz
IdnToAscii
ws2_32
__WSAFDIsSet
wldap32
ord50
crypt32
CertOpenStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 846KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fuckoff Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fuckoff Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ