q�W�y�+�^�'�2Mc$j|Q�c�W�x��.`����< l��3jf�qޏ���rè����?$s%��Kb��+���dy�7�@e����-�0wqU�.��<��i������)7���r��l�j��ME�D�/$p�z��w�kk���o{>%>�B����:RA�xDu11��4�����Qv������9��vI��l"�xz�_M�7�ؔ=�{$^C��E9�����|���<ĉ��Y�����x�m����x +��ֈ���[uw_%���Ϛ+�?3F6OO�}Y�c�X�*&?E��e����W��]�8]2���duF����)Hg���G+��Z�Ml��Q�T���3�K(�R-H�����yJ6@�A�?җ�v�R�x�z�S0N!�&���W�j�V�Or#=��q���=� Tc�PK7������ �p�"�{������۞1�)V�G��k��/��qI����>��@�ȄQ�{��$�_�t�"��7V�'��ٌvzh��^M�p�'z�|�Ǎ��^� +c�-~/�0�G&��,8%n\�� @ ���kg��]�f�� ���f͐�P� �(�����\� h�������v��,�� ��܈�mʞT�� �A?/������x�i\2�{\��>ι'$�Z������@��cDU��Z�f Kc�=��7�5naڠ�p����#�fmJ�����T��wi���c�ǘpo���� �-�Ĩ���/s�Cv M9�ة?���U�]Z��.���g���U)!�?s��X+�����~���l/�m��3��� ^�vq�si���� �N����h��0E7��-HK=Ff���{�t�X0[+�?�R ������b� %���n[[�����˓=<&�&w��̺�BS7ǀ[Ok:�>FB�&�b��L��ZL�}����]JW���/�eib��np��sa�;/TX�HiB�¿���az gM���&�7��ryIŅw��;��*hIy@5ƮA[;�H�H�!U�v �a�Ǎ��뢶�L(���Df���;�Z��O,*���\��tmp����;a��4k��,� �jޱ9/�.���0�Ы���@Amy0(�fl9��T���/�6k�+��x1XHK�7�q�1Q7��gO|46C��H�B�+�n�զ��O4�BVw�+�8�ܰ�����S[�L�Qp���kF��&�1h��_\��y�w��7�x��b��U�^D��e���Υ+o�E�R*��u�*xi(^���W�ld�]�S���H���-8�U���q�%z�c�'ɰ�6��n8;0��Ž�ѪT>���#W�4s-�������ґP�\�0����m����=N��������f�\�� �c�[����b�1Р��������?ݕ$ަ��]�v�1��)o�!���zM�U�(�n�T���6�h�����7�����Sk텟�T9��� �A�T��ۼp6�n%<�� ��|��\���~��I=2�KN͊��Q�;�:g"5W�3�y�5�1,�ؤ�'�G/^��թ'f��G���~?�� �����v����/ �SӜ&�#��I�j ?��沠v�N'e5�������J+n���t8|<֠�t,�s`DI��)^�K�>{�b�����#���t���Yd����( %�^c�}^��~%"@Zv�]�F���˲� �Lb2�A��/�om���{��|^v�X��:�}P�����wۢ<� �K���oN�Z�2�6d�<�D��ξ�5���%&���|�X_�Y��t���'���dC V�uYC�=����%�L���a=��o]�l*�.4�0)�' ����+�ܸ����Y�^Rx�3���y�(����%��ݿS?K+tA��&OR�C��i�^���z�2���ҝ�:ܝ ���B��ϛ�.�.�vrA�����;��h��z�N+^v"\��S虳"�ʰ���?z��Y�>T�����qDt�V���ڲ�Aʯ"�A��>f�?t�rU���0��`ҧ���Z̝�F�,��ʜ\?�4��ʽ���&~@G�.P�7#���ѓ��8�n�f�D�d���������$����clvs����5`�}3�����?3�К/��!!�-��s��K<ij�K�F`h���q�2�7�h�1�ĺCp4q�.'��{ W��F�v0��8�!ً'1�k�Q�4�4l�7�� +tD�-���)E�B��2e�<S��e��U�ڥT�N�p���`}�C$���/a�G��9o�P1�i=�X:��Uer9�e^�1���3^��d� ��q���X�(D~�0-�0��Ez�`����_�����p�ţި/bR��ɼM��J�Z�GA��;�P��i�}�\�m���c<q��[��[���M����E�J֢�f����[I�.�g��`P��h@XL⟝-9�'MqA]��?m���K"����"6],I6�)��<�Z�*�g�� �aV���������(��� ֕��eF�ax�0N��=���S���*�뫽##�h�$�~��`�?�Bp�T��}ALB�QGI'�� t�%�t�̈́0�HOJ�{���tLAJ"� �m��e3#&H�� ă*'�I�:w�,5���n�s�� ��r�*��o5 ����E$��*Pيa���Ώ��_� )[�x�;��O��o����±ۋ`�2-bs�����������F�����!E}? ���;Sh�ɕm��ºkH��\~����P�p<���@�C L��ȸpVQ)x���(s�U� x�]̅��I~{��g�ҙ|�h�g�xl�l�pg4#�-���k��̟`�v�����)w����h�1�^�]4����jH-��8��,�v(Nʼn�3���˲�w�.Gh���d{>&ϣ�ݲY�^Z�jW�F�6��@�9?t�r��t��=�Fk%�4*���%�xU�'�0���k_ﱯ��(�H�9���{��I�s/����{� �L�pq=�z3���:���-2T7���S������uR��y>�.g{�3:^*%�i��n�5`@���p�x��pq$���%8�'
Static task
static1
Behavioral task
behavioral1
Sample
jkhdkfjhkjh324j.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
jkhdkfjhkjh324j.exe
Resource
win10v2004-20240709-en
General
-
Target
jkhdkfjhkjh324j.exe
-
Size
5.6MB
-
MD5
db6dba6e2cd6fcb0f144e887d122cf55
-
SHA1
45a56a725b921abf7daca94330f3cd7d2ab46771
-
SHA256
446f1faa1a66639757107c27927e11255d267d8a01bc6f0e452307f61392d181
-
SHA512
abad91015a0d646df236787ba366bde18e3e6202a73fb919eba889a1bbed130bfe0c0535aa4c612a3ad475c0ec45675667c36d86100badbf372bea5873cb0636
-
SSDEEP
98304:0tHajn56+lz9P13VudzLIONoLtSvj6BAXvZYd/gWFgpkOnkXvt/8ASeWXfyc0J7o:0EjZlVgCtl2Oj2pkn/tEAXtDjq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource jkhdkfjhkjh324j.exe
Files
-
jkhdkfjhkjh324j.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ