����I!�@Ċ`�M4����0��D�b^�����U���ئ��}�a�sg4"#0q�����<S�� X�^��#�z��N���hP����i �N�/�)_ڼnd��+��]k�|�z�Un��-�t�;�z�@?�F�ڜW��ba���ȝ��I��#9Dq���G�d8����Ƽ�T��$��@�Ԍ.�j%�w��O�zsjc����@����Z�L��R�t��o=���h)ť@�!�d1G"\����Md�IFz>t:�v cò]��,�� ,���B�ώ-�������/Ԩ��Z�ws{�ډ�����t��B���~lȞ�a���2O��)�~i�毞C��y�g ������b�C�g��*S��G%eci�e��]ޜ�AA(���=N&1��S�o*�5�����F�M��Dp� HrM!f��bf$ge&�ϻ�f��,�]���z�u~�o��8@s. V�+.R=��b��l��#�w���Kꅤ�$e�I�� ��ú#�����M�Kp�q��<�1�h{�X��H#DS�<mdBz�p�l� x2AP�#uqx�P�y`0�{��f�J�`��<�"��77]�i�1{�R���D��",�X��m�qk��e~{�����S��<H� =>ұ�H�g�f)�-T��Sd����U@Ym��B�gTi�V���� 1AFyHO�,�ђ�W���r �=��l콄�U�}sQ�m��Rsg~�議ٖ �J�ݳNX��1��u݄L�6����Id��ܓ���W���Q8���[��5�M��=#K$��0K�~ ��z�0vhrq��Bf��2 ���1�yB�����7��U����� }>��K7w��*�߷� ��dqQ��e4����Δ�v��N� 0��J��?W譝T��Df���fܙR$$H�a��o�P u`g��0D���bQ@YȻ�k�xjv4�$7�7� f�,r�~}��#J�e�w�? ��?d��l��l�ؘ1�w��+�4�]���� OL��V��#���+��y&�M�\-F2�<��P ��V��3.Q��a�h*WF��#��ݨ�y��Q�����d8��D禭�)�3���({^��"���J<�WC�̮�˻����D�T�EZJ��Jcj�x�+x�}@�Om&CV�[!eE(1���۫]�<}�韁>��n�иrF�EH�It�H�_�jRȘ���Ȼ��ޙ���:�U��L��X��+J��=�P H������k�k��-�� ���X�'�9�:kTg�R\���ǼF;��K�����Y�0�ǃ(����� � �YI4�tA��a�7.~&t?tŶ�$��@��65���Ke[ ��5�lA<j �y���k ��[�HPÒ�QI�l%+���y Վ��м�5?a�nC�����f�ZF|rrnf��C��?V� �B�È��i N�Y�#��)$}v�w�mc��<��vjV����:��QGП$[Y�� �,h���x`����g������-��;���.;; �o>^�[�U~�F���җC:=DRI�� k�_3�,��1`��v����8Ϥ�V.���L&���e�&Z��Bd,�x�6 B\찍 Z0���;��v�H��vG׀���P�"2@�t�Q�����kHX�+�O�!�B(H���t���XF���zZ��1K�Jx@�<�����s��v�p�P*5��h��М|ƾ� �wj���Y�y�h|K,�v��X���K�4D`���^F�����˃� E��vμ˥�/��V�)��~�|� ,�dT�{}�K.9\N<p6�r�� � �i�7V��t��#oSpw��*����.�4.����f���-+������ Y8�9�����#�՜��6s�����[ ;)*1��SD�n���7�������*L�j����㲶0���A�h������|�>qt�I�ҡoati�l"�����͐�%{��h�+)y�w�^��,ƽ��Ֆ;��}�p�����wn����*� �ڣ �ߤ�|rO�v�@���-� ~�S��.`ߦ��!�����e.6=�����j�sT94?���(�`n�AX<�lr�B�00D�ak��*�rHny(~����i����<Q-A��6���,��\̓�A0�G�4��a@h]�R�ݘ=�sύۦ����D�C�{k 8m��Z#��+�ԨW0�э�3�0/ʊ��o*\�|���v�D!�e-����-�;~gF���۔�����kI��D�}�G?��Hq��d}��؛��6�#(��My�L��ȃ$�{$D�����R�r� 1�ϝ֣x�}�=��������"�ր6�J�υK���������'���QY컮R���d��,}�*����#(��"^�#w�ܪ��f�L�P"ɏ�� �Z�O�O(WqA�a �J�����\��?���`�ʪ^':L�S_~�� �+46������l��K��\�z�'�ą���}����('�Kݙ s��h�!�R5Ćy#?q�����'&�L(�y�C���iA���γ�ܿ�H5?Z��E��Ȫ��wrO���r9��k{�r=Vv����w�y���������`'�L-��/g('�\ʤ��G�o��XF���a�ja!o/���xN7��J�G�j�-�zBV��I�k�A�\�h6��I��8���A�����221�f�������@73���Æ6e^� ���K�nY��d^a*��}��i~AKg�[7��6b @���~Д%��s%���Xπ�`^!����; n�]����k������k�~0b��TXǐ qdr�P@�R��豿`\�%N�uy치;-Z����2|��A&�y�e$I�D{�Z�[B�d�}��w-b|�+6]�Ƒ��V��z%H^$t<��YW������=}�}��)�:Myl�����l'/��p�� ���c�j���9����4���!�]�On��|�l�֏*�@��G��?Ŝ����Z <P��-���BA�?���뭌�^-�WW|+_� �x�2�aq^3uvF�Zy��$�<Q�9�b]��j���"��� ��
Static task
static1
Behavioral task
behavioral1
Sample
fatal.scr
Resource
win10v2004-20240709-en
General
-
Target
fatal.scr
-
Size
7.0MB
-
MD5
99402bfc8e94618cbc01b4d3d30453c5
-
SHA1
6c5b333797e0a74c626a7326149d20b467c17a2b
-
SHA256
85ced908327b2c712bb8af13cda80fea1bf3d4cb82de4495c49acd222dc22889
-
SHA512
f2b2f54f7148d48ee694aad89f81d35d4f9a35cb4d4fb522d9a142dc95fb46c9597e503c7ef6b57b9a85e41244172d55de8107e1ee9c847de76ec9849519c29e
-
SSDEEP
196608:49i+g8S/04BUPHjKT500YeSgyfbFMAvTIHOwJzMH:TP8SM4B9FYXTLOY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fatal.scr
Files
-
fatal.scr.exe windows:6 windows x64 arch:x64
30f64faf7d0df02ee0d1e9e189b93f3e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnhandledExceptionFilter
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCapture
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
d3d11
D3D11CreateDevice
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_getpid
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-stdio-l1-1-0
setvbuf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-locale-l1-1-0
localeconv
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertOpenStore
ws2_32
getpeername
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 723KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.???0 Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.???1 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ