~�y��ARʂ�R��e �':�� �F�&9��=�_ρA���̸�Ay^G�^�����ySM�����FY�N�����Q�'A�[f�5U+,�W�z��pX!�D��RҎ&-a��O??�@�[.Ĝt]z�ԗ�R�cQb ��Y�Nh�z��W��������6R �Sky��8�bdj!փ?��M���#�(��R</�T��7(�W�Oӥ���UGP\���r)�`�C��J�5�o�{����t�=u�S�k��>� M6��|��K�/Fk`�$��� ��� �i��~6 \�Oر�h�`�W-d�w��#�n>Cl�,��(@DX�<��b�{���5�UW&C�Lt�=�m]�\.�tz% �&������)��?S�!K�����0N��Kg�m�<6q�KaZp��%.���?�9Rlv2R�U8�k������R���]C�5�o��2'������"���HQ�Ŭ��ߠ0��Sɽ|_GN��_�"��WxZ�X���W�O�m�b ץ���8�&Z�u���du�SH�]+C��^�ϫ�=�2Ȫ�us���1�H �֒XP���D��J+�9��v��<�jjF4w��վ���_:�w�ˊa˂i�b�A3��%����w"����Lp�6�G������@5S�?�p��"�JR����fרhI���������;�?{��o��S�"d��d�#Zt����{�^U��N��q��*#�6p2��B� �in~�[�^䏑�m܌A���ݬ>�ov����('^�EMkJ��c_�1�m�Љ~*��j{)����8���a[���Ν��Yj��I�?j��3A�����X��2=-��k�y���r�/9������u)E�ĥt,�7铔F�FmԒ$�)�(���J��3��;�.�O��q��>A��a�����s�9r^dr1�����FA䪶n!z]��P�7`S��4U![�hp��L�z�Ox]5a�����Z��IV�HL�Wӄ~?��^�@�;-���3=�Z��(H�o#�M�e��zҦ�6̓�����yE��r���Q�/l*$��`Q)�-ȑc�@l�Ha�G�e�WV�S�������<VP��(�w��rY-t�Z���-GH�>Y��H�����O�.0��z��X�&�3đ���p0�Sz����]OP8�ǘR/�X�v�������ۡ� ?��S��7s�Ls����?ݚ�NIԖ��g%�e0n��j���E �@fyo�g#��3Ԋ>w!�?��v��O@�t:1fK��B6��xC^7���T��x��%'�|*����כ�]z.�5�%e$b���Z�p(Z��DR�˽n<�&�gm�cҺ2������� [�$Z��[�B����a��,��C���8h�{�|F���NL��y� �RJ4<�GM)�����9�P�s P/Z��RI��xΧ�14�����O ��J<�'�r�>}�\Y���1��1��7���A�%.��&��'2 �[��{��b5�.K����ij��������[��j�� d� �9�1E*z��/��5ݾ�}#����m+�$z��O<\ᙇ�93�F�; <�;8:��@�,�.W]�����N��0���n��Tiu��-�w�)utv�R���6����|Q� ��}�Úd���8���W��>x�����q�.$�MĂ��6`>�&��Ը��D�3������K����鴗���ף�.�a�xb��m]�hj�{·�%����g�czṏ�2$M*)G<L��w������zPo/��_�2O�A���\f��d�����Ѻ�8͘P]R=����L�����k�'����wC�� �u�'���k�`�S3���TL�י_��s�ts/�����4vW�X�C���oWN�Wd<�h�G-��R��=�(� Q �LB\9���5�V}l0���uBIsڜ ��a�M����7�� ����soݶ�c�*t2��Iz���9��I�U�Δ�nb�b���\L}��w�%�4��C}�y��b�,9I���w͑�[��xG9(�G.�o|i����%~,���P����B'5ɫ�WitW��ҧ�M�E���/1�Ӹ6�ɗo� ��f���}�v%�aod�í��J����(�\�xg�H�Y�hҰ��O�)�Ԅ�j��પ����eĹ~*�A*�|��C�427����#��g��0U>���O2�jR�mm\��b���j�nS ���s�$��od~�3��0���Pz�e��\T'�(���e�-�k������7��GAxp��T5�r��� ��=<���.�����kE/�����ב����\:���ݔ���Ő'j0ځ�^02r�֗�)��T�� ҉�S��;h ��vFsӋ�t�02���!��n7T���#�ք;�|����8=���ަ��p�L4�K��-�'�2�1���v �/%���^EI��p��#.y��w�f�pF{�0(Ƌ=��ˉJk7����/��9�B��"��´C�ԫ��pڳ�d�J�_�G5�(џPP7,��'fl�S��Rtu]K��^˲&�}QxL ��[� E��ٳ���sK}�_��A�9q/��8�E�M��\�oO�A�t����x��A8���� >��+;H�=#mdqa=�����/��"������Αc1xODF��ōS��r�(�qSc�r%�3|�c�����t�.�$�ly�/�'U�@#!_� <M���f��D�Y��[��5^���k[e�jDiZ� QM��H+")#Nn����Hb�0D�&���̬��W A28��a*�_����/m�m���M����V��)!��w��X�ĒǁXP%�~�ǥ�y�h�>��ut�-s��Z)C]�B�N������,�.���S۞���� ��(c��(K�>[~�+n�uݧ�cpǑ2����|s��4���)�U?&3m�j��u�JO��j�I��}���*qu'�~�r]9?U�ZrH.;�%�M��Ƽ �2��f����FŃ_�0@�� ҋ̐ !=GB�6�ZM�am��k%H���-3Y�u9�vx���a�����b�q���4{�z:`�
Static task
static1
Behavioral task
behavioral1
Sample
62c1efc24ee3b2fce69044be743afb70N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
62c1efc24ee3b2fce69044be743afb70N.exe
Resource
win10v2004-20240709-en
General
-
Target
62c1efc24ee3b2fce69044be743afb70N.exe
-
Size
6.8MB
-
MD5
62c1efc24ee3b2fce69044be743afb70
-
SHA1
9fc73b035497ea10b27dcde92f79ea3abee8697e
-
SHA256
4789f7558e861567102d892e3394a8f9e1425b26503443ef83494159834ec1f8
-
SHA512
750b5e2fc52b50f2b3f316ea2af058644de59d6a17344aa0d89a9518fc3c812ef60da28ea88e7f516cba3312144bb5d1335918c709c1c9f0ce2c6f182fb223d0
-
SSDEEP
196608:sQ9H44/Qb7xWsvHwOynTUuzx08DKCRrCg4or54:sQdX8kf9zvxN54or
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 62c1efc24ee3b2fce69044be743afb70N.exe
Files
-
62c1efc24ee3b2fce69044be743afb70N.exe.exe windows:6 windows x64 arch:x64
56577804903d04c6e42bbd3a6d3a82d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
crypt32
CertGetNameStringW
advapi32
CryptGenRandom
kernel32
HeapDestroy
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
CharUpperBuffW
gdi32
BitBlt
shell32
ShellExecuteA
ole32
CoInitializeEx
oleaut32
VariantClear
msvcp140
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
ntdll
NtQuerySystemInformation
winhttp
WinHttpOpenRequest
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-runtime-l1-1-0
strerror
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
ceilf
normaliz
IdnToAscii
ws2_32
sendto
wldap32
ord46
Exports
Exports
Sections
.text Size: - Virtual size: 693KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.\Gw Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.E1Z Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9of Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ