��\��9f�Qj��B]��pj0�9��H�{�G,�{K^���R�Ż&A`�q~h>��S���9V�ڊ4���~�y�l����O�������w\�k9*Dr[�r�L����P6�z���<�X��bT�3|&������w[Ȋ\��9��RQ�aDF��#�_d�����r��6�y�j�И2��]��{\�'������u�)e��Q������{p[�M��t����<���r�h����#��E�L.F-rYY_ ,�\�{��F78O$�R-�4!��������}9�hM�&#����$b�v�-flj�FK5`Z 2��o����thl�]{�_�����5��6UF�$ʎ\��8��OEir �?����fG�����@�,W�M�ø�\�!����;#l��n-B�1C.M�!�u�̮Q�h��:=]�p8h7�q+��l�襦�r��7ȸJҏ`p������;���� %uZU8q | y��ngR>�R,3� ��:<J�b��12�M�jR^S�쩍�,jS *��MZwʪʛ�Z�B$�/t{�� �_�: ��KgR���T� ����@��NΨ���^��8d6��K�BS�,cɷ��ni�$zy�Gr��y�y5�f2@�~Or�!�(��i�墷~� g��~ދ���!,�#�Mrq���Z�E�>¤�Jp��nɨ���"�ѝ�U_�tDMw@B[N���7H-~�'զ�~���&c�X�����''�NDN��J� �}�7�N긂��YC���H�����y͞��L�J'[m��U>�����u� �4����0�/�A����[�y� ��6��|9�)�>���dI�fн�s��0� �堡��m��౷�+�<^ $A��������y2�K���G"Pݯ4;&hJ��>���B�qG����i��ᙪ>��D�19K�� ����J�Aʮ�@� ����{�rzr�G�o�Z�fjW_<�ϳ�Pi<��<�N|��?-*��6�8A�U�h�(�C9~*�G���I�M��l\Gv�M�Sm��~���G��p' ����.���W�%QÚ��t����N������!�f���t?��R���-X��: ���>��R��{]��c�ھR%d��B���,�KZ�\�j��i�K��+�> �\�]���˹�� ��c�<\��W��_[��(d�{��dy�cҾ�^�����i��[�'���e�('&�iD��(f����to_��D �뎨4�qV�k����� �aKpT�9�1\�Y �;Ojݎ9�S #@;�HT5����H�Oi��2�~��a`���S�S��{{�>\��J�n��lq^��Z���Q� *>�<tp�ؙ�� ���v�%c;�A4N3�6�w�s�'jXl �W" �����mV*������������K�F��R"=>;� zP�m���+4Uls��'��7g��ɯ�@g�D�gj��&�=��C���7����3�,��h;z3���SM�;q���� �Ba�Z_�0��Y�v��G�v�hu��� �ur�!�3Q�8;q����wx�La�����Eư�G�A��8<9����n�|̷��Ԯ�'���O�f}���A]�\ܼ3:��+B��+���ߎ�{� �L��K}T�l2�GΏ�[ťJ;��ec����;�T\�mV*iȟ�)�$_n��Q�����3�T)�YAGG�RĎ�{0���4�A�\� �Wf�h��~�ذ�.�M*�]^�H��Bm���5+�!�8����li�J��ɷ<�m��K�R~y���A�9L��:|;��"E��|2)`����?�2�� ם����O�$�����"ՠ#&b��#D�3���q��� |�^�Aq�5����x����������M�A�Y�����}.Lv��!��&u8��C�=J'�:�"�/<��ފ����d��[ŗ4�E�z% �8��� *�c���'^�Ì lamn��D�~���/�ٝ�is�t��;ni�.U~�������K���:���;.� �������{�,�S��cΕ�3�U�����_��U+���3Q�]D��hk g�P��M���+߽$XH�����2p^A��c��[F5�0?��,�:O�"��ٔ���z ���X�u�Z������)!71'$:��t��i�}�a���s�6w�v��IuZ��O����J�w_� ]� խJ�9���>)�GI���A��Ȳ�`�&g�^���q��a��:v&8�������YXU���a�IH��(bƾ~6�tu����/��I�N�����'u��#���!'B��Wx�;�XB'�s�������u�ל�<�yf;���Q��I ��8f@����7��O��|��m^���l�7�E�U�.��З'�/-$����>c�"�֫�x�#��W�*��i�}#�\"�]����`Bs�/%��ˠ�Z��A�#��NO�u�?�L 5~�k"�[����U<y2"����ߜ��`*���릻�����c�B=x�0M��K�p ��0�n��+I�Ӑ��nnf�u �Nic�̚��"=�����8v��F1k^�� �o��a�gu|�"ռ�1Cjd6'������p( A���y���V�o&`b��]lO>#��W%����Mۏ��X]�I;�m'$��FvI�mZ�����:d�G�x��M&�K�D�p���Kt�6�R����ʼ�!f)R=�:��:םQU�qV��<�w>E�(5��-&�OT�S ���[R���� ��,�Z��sD�c�i%@��.���X3�GI�݁['��(��[K?QQ�z��\���e}gt��2p�'�ϳ:hPM�v�y�]��ZW��� �<��1(�� �y|�����[.�ǐ��3U��?v���z��_ጳ�z����� !|原�;"T���C�ߣ�~��r#�e����#e���4{�פ�^�!�7�$��G����\�f�M(K*ɻ�*�(�>j�D*���"�E�[3o�Ԏ�P�5�1L�����v�k�� ��q�G�va[\oa�����ݹ��K���~G��d/�M�N��c\�'J�(�F�����+F<�
Static task
static1
Behavioral task
behavioral1
Sample
Byr723V3Cq1.exe
Resource
win11-20240730-en
General
-
Target
Byr723V3Cq1.exe
-
Size
5.6MB
-
MD5
8e465b47c0e96417d43e2ab6f4a2062d
-
SHA1
92db0a431145439c42c96e4a677ca1d2b5fa210a
-
SHA256
be967be4a0a18f81fe8a1ca958f310364b7a2e96abaa6397b64d6bff584aaf0f
-
SHA512
b8799b263b81defa710a7600af49451fd969de472df0902fd830293224274954732b51cfd316abc0138e31145241bb35ae3b55d9a9d773b64591d842faa92c2f
-
SSDEEP
98304:IzvRocfNhwHAMHHWNxv9PPj3/C6N/Qs0yZQCsT7W5ZCw2KurlfP9SXL:G9anMRNz/HNMwdsToZCHhtS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Byr723V3Cq1.exe
Files
-
Byr723V3Cq1.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ