��:�������ڗ��/���)���e�����^�D>4>I��-�`�mZkhr��pdC�5w������W����|�W��r�ːl���riF��M�@A���]1�]~lOw�{�*U�$�>�[��P7H���̢}����5{QӅ������j��X��$lH��ON|�?��y/���(�x���Ó�V-�6B����{J�v��C�^R�Y06�i�}�_��Τk�����b((�n���[��RP?�, ��L*P~���b�[��*t�w7ݷ��E^����}�)��V(����,��y��^�: �D���^dC�X>���Z���,��<��)Qs�<w��xUq���@7�Y�� 5���)�T5�*���ׇ�M�V� �W�����9����kc9��?����¤���Y�q+#�2{�a�:���|,Std�>�����Km��>s�w��k�WM}��^Xj}�idj�"�eJ�9��y/��r�Whu��>��<���dߍ��'�����0�w��%(�o7u�V-< ��Ǒ�W�Gz�P�����R�������Y�f<\�ܰȎL$���. [s�}g� �y��x���IH\�,�WabE{4_���t j����#(�5�ߠ�*{V��>g���#n�i)�KB4�H���h|�)!�yD� b�����c�V����3o�c��o�����9A*u�eP��/�].6e�:S�,��69���/�������w�K_���ȏB�.�_��{���-��{�����4��|�jQ���[M>>�}��^�C��ds���])?����^x�$Ә��r�O���m�X)�ј��a��C.<V8y[��[M�����M�o���0��n���Nx�h����<���eD����P���p���D+ڢg��#����;�ܨ�ֽz>���� &sP���M ���!�Sl*��-܁T�uqY�2�\9�p��^JB84ǵ���[~�kA��g�*���I,y�z��X��=,�щ��{**��5���CԻ뻻5�YO����^%>* �JG�u?�3�Us=�$�ɅD�\��dO��m�v-��1?������ާ`rZ(�����n(����p/V���ZD����L�Cc;h�� ����.c�d����c�\>ݣX���<$����N�<V��z�?� Im<]�H�eƐ���s8GdE^�܂���?��Ļ������j wc�0�& �����>�*W�@����ˑ�%Y���1~g2��;�]�ј縻��i�])�,���+4!Òg�Q�g,(6�3�J���*b���i��:Ϳ��� o鎡%��;�\����_*��� ���*�t��$�i��H�6�[Yyp��u�o����oT�9 HXsv#�,� �[�r�^���Dc�In��v��=zcO�)�W���ܾ.�ů3L*���*��*�����32d�Pkk>�a��xv4�Uó�c�A��x��N���� �i-:f�Z�eC�{��y��v�c��J���^�+� I����c4 ���$k���}�csڔ�u�)�����$�]ڸQ�iH�!�,jS��TTS��=K3U����a�!ց"�(�K�@�J[}p�b7�k�O�u#�Xb(�F���s��?��4�!8��p�V4�Zx)}2vN6^�bV��p��^3��31���(����ȅ��� K�W�.� u���5d��LpA�'���F�?�I�-ȇ�a���C��5dq;^1��P�:CbB���Q��ת"���;�M��n0M��A �/��@ C,������4�a�r\"�.<�)���%�gM}�{7�$�:���Ԡ=B�6m���q���f���\9ؔ��o�T�C88��A+�N�%j�0���Ѱ/�YŹo�����ԟ�#��(u�(�����#��J�VZ�]��.�ݐ^4D�w�6��U��8VYX��r��؞:�o��.Tv�b�߇"�!o��k1T��2yT�Y�HFc�?�^�� ���G��֫g��uq���ƾ���������u�1̄ҒohT;3}��20(��6}�Nۏ�1��c�8S�����Q`���f̤��������}�ҊL�]����F�f0���X�c�g<ӿ����4z̭�f��Z��J�0��jr�z??�#�TC�^��S�56�>���xݑ��1�d�l'����E��j.Kx3��WQO��Bt�H�����(Q��� '�m4�ᵺ����Ù -�����_O^�jS7��~��*1J��#`��C|�XX��=��_�i{B�p?Y��6�d>��>�Ĩ��>2J���%ۯ!����=���U[�w=���W�kQ�A��ֽ��"���r'��ĕk?xB�hh�v���t,`�r`b�� y)�Bib����h�k̻��{�����]l��, ������gcXB��C�!���1��/|�oU�מ�H�*���&�l����s�Qǀ!�68��<ںJ�f2J�K�db�`����O���Ձ"T�U��cs�ԗX���#Ź[���[����z�9s���9���ʩW�:����#���M�o�tPޑ�����zm`�������_?� �q(�N\�M�7�e���W������1Q_0��J��3؋O��n������_��M� ���طco�M{�<A���+z�R9�`��L��1�@>�%փȡH���9_�&;�����l�f��:��G��c�f����ɺk�2̨3��1Be8��4VҊ;Q��yMf�n�3���ϴ�-�s�IU!a�N�1*�i�o�z��l����>Wq��FB�uE\S�6&�L>�h5Rx�� @�Ђ;cv��XўsR$�M�ķM��p�Q���z}���&�9�/��r�+��D��Wu��8䕹�Ȳ���1�(8߱��]!��l��P{��,S�0�C�0ބ�����/�rnR4O60�+D�<F�zm�����0�-<�-� ~K��C�����8�^�j晅�� � �yf�S�.�������,�T��c4�����0/h��*�R�w�X�9�_4oD��y��w��½���1-�Y���� 5x؎>�������I���UL�� U
Static task
static1
Behavioral task
behavioral1
Sample
bJeu73V3Z2.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bJeu73V3Z2.exe
Resource
win10v2004-20240709-en
General
-
Target
bJeu73V3Z2.exe
-
Size
5.5MB
-
MD5
fbd24d557954f2c19b268308438bb881
-
SHA1
2afa16290ad529d5ddb97713074407ea1d113d0e
-
SHA256
de8ce9df52c2a791e5597169fca6cbb0a101e341f1b0213de1a01e0e6fe7af2d
-
SHA512
beb7551dc9586eea0c9e1c8aae1b81ec5f40b24a477f1c784ab757cea0b8accf0a4e555d63893474f1ebaf681ed78f0d83c4dfec4eef9130a6fc0c4a7bcc88d4
-
SSDEEP
98304:3PcV5iYudI3KQ39kAz3YJG9nHNTO6UpCSL8mMNhjTp6Q0iy3jE2lTEi0:/cVoY+id3KA739tunL8x7jTp6Jztn0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bJeu73V3Z2.exe
Files
-
bJeu73V3Z2.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ