Qг�# ��F��|x��ʙ�K_�L��9_��`����S��~��|(E��j,4ӶT���}��F]���L!���l`��h����� �_� R�_oC���5�,�U��ě�q����j�[u��ӗ����!��|��s�l�g�I�^���������q0�����7#^d-̖�b�I8���1T}��fϟ�� �%H�ۿt�a/�T�<�����s�..H�y��wƏ$��#�#bU)1���op�j!����(�b�K燾5���Ys�[����,����ʝW�s�w�;�3��?p4a�`�c��g�"$��BLEٻ��[����;���7�5V%����o�M�~�]��C܂�׆��u�e��%]���|��gX��J#T��.�x������5���ر���*��ܭ�RW�0�q��[#g��Y�xl̡ q�������X�+��N�mR<���(��d�3� E �y��&�4y�%�y����ǫ�\j�:�ɔ$�w�\�m�l�� �8� A�9��RfJK}��̬zR:���l�is���<�y�d�5ޖU��y��r�~�S��v��(�U�0�F U�|0������>�aK���T�(26���fh�xW ~�E!&b�qD��*L�y�'o]+��[��=\���%��lx���P���0O�K��i��Г��}�+�Ƶ�]�����d�?��VQ8?T�Q��8���h%3�Jh)n.��fx� ��t\r�I�y�`�?D��f!�~�� �q���y�I<I�_j�1�P��n*8�*�A|U7p��v!��a��+��#���{�8 ���gᓓ����e��B0ƽL�%Q���0�R+9����q���/<��Ġ������$�mxc�a8�o��Ҁz�$�i��͌vJMy�J�_����o��Ԡ�~���B�'�I�FM����t�Q~FD�H8(�o�/}�\Qw� � _� Qa,[����U �/�k ����'������L��Њ~�ˣ��d~1ňć�i�S�$�x4 :��n+|�i�� ��I/uv� %2����/�|X~4Ź��I4��dCICU�\��&�������Ǎ2O���[�g�m'>{� ��~|��"؎�������kl�u���:q������a�h_:����Z(��D�R��ƈڊu�g��r+�"j��kdZ!�AU��tO|�Y�>����iHIP%��x�9Qbzu�D���xx�����ˆU�Mƍ!j��M�_��0���\V�}�+��Ghi֚�����_���n��������d��z�Õ9�By̏O�� 1cq�ј$�\�/����z�2S�g��p�@[Ơ{JAr�!2��4��m�����#��D.%�U �,���~�����2f�lj�m��������ok}4�f-0O�M��r��i����g��RV�]��0LRs��x6���:�!�ϗ�=�CEįw*'��:����YO�&��x�U �C �cz)�'Y������1�վ�Dk�y~�*E���-�1Bh��T�Q���^�/p�f*�vl�,����ߏ���ʽ��c�wZ����]ު�"(�h��F�l�b��G������o�t�Lgp���d� �����R)��(����&������d;���0y���Ť�{��(t�]������9�1�Ic!%�NB��fӭG�l�fZ����V(��������d2o��I^���Ү�'0� �����S��/I��|=@�O�:�#_�0���$��i�%���*�83ܝJ���Cz�4��*1�e�%�C>��&�����S����-�9I+/�(V��8��=J�����L��Cj��\9��C�{S���x� E#�p��%mT�@T����:3��?���$CU �ݤPZ9J! STC?I�[��2'�s�8Pr��hk��f�uVl)~\a���?~{�zo��8t�Ewb#�c}�vf����0\���Z��m<�_p�ۀ���(b0�D�Kn$'s #�!�ى�=����^'B��qc�=�p �JZ�X0�ܬo[��w�kw�꛵)�]��$*���� o�d-�J5���ť���O�c�;�4�)N);q�Y�K~_�p1�XB�� ��<�h#5#k���xj��+���T_O���(iw+J��{��K?Y��Y!����B�1:���0�O�������Ѯ5���N�S�uy����%�u��7� D}�ǫ��9��cq~&�x�ɀ�T��:��8ai�9�^�A������Z1��?�1�kש��j%w���ʴ������{�G��*f6�s2#bO+���CP���\�����������4�˔���2�͝1G��1mFl*�˥6* NIۜ��x&u�5�L�Cb�۰9���i��� b���6�DH�x���-�+����R�$7ڣ�@�:�c�.��Mk$BL�� �iIf��!�]�ogzz���"�\�T�bkX���������V�o��V.`e�_����>�i�+t���|}採c�s�~qs�e��vq���.����}d�JW� /�H ���qoV�U;�+L��:�y<~����E�����?ll�0[������ve���g��Z���+F^4��WN���q>u1�k\ ���IYlG��J:r��,"�WËwl��ۋ�ҷ;bă��������|��M�I��--�a���~�R� <is�6�~�̾J��K�2Y\EpR��+��`0Qt��\�m�E�1���O:�5�D����`���j�(j�5(��x��3M�%�X�e���K���~]�O��B���]xTD��.Stm��uM9�+R�C#gw�����q2�ʄ�H�ȝ���N����|r L��8 ��߭4� ���xhʼ��h����8�P8B���� o��X�O4������}�Upxtw����;�\��� }�E"Du�����$�zH3�pA��|��;��z��q���o4��9�mɔQF<<�cx��c�$�QsƸoN� *�`�Æ�l�� e����ڝJ�_c��%�HP>��w�Ed���O
Static task
static1
Behavioral task
behavioral1
Sample
346ce564ab0255d0d9274deeec42fb26.exe
Resource
win7-20240704-en
General
-
Target
346ce564ab0255d0d9274deeec42fb26.bin
-
Size
5.5MB
-
MD5
346ce564ab0255d0d9274deeec42fb26
-
SHA1
d33f8685a75b0d4f19621bd938826b30a0c8f935
-
SHA256
3d6b975962e9cac43df3f97cb3244fb30783e4fcbd2a97499f44f9b77628bc48
-
SHA512
3c60907bb94839ecd97247d0128b89a62005f47bcae56753101b382dbc9cdffd2f8307ea4ff25a311bbf4f25aba39e4d4b1b2219722986cbcf772bfeb90b359b
-
SSDEEP
98304:FZ31/NG5kOb1ixlP1IOYes9n+HLDJOi7G/En2Z6Ftl:nF/EkNlPOOYes9IhRnO6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 346ce564ab0255d0d9274deeec42fb26.bin
Files
-
346ce564ab0255d0d9274deeec42fb26.bin.exe windows:6 windows x64 arch:x64
8286daca00712832271f734098cc217d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
ntdll
RtlLookupFunctionEntry
urlmon
URLOpenBlockingStreamA
ws2_32
getsockopt
mswsock
AcceptEx
wininet
InternetOpenUrlA
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-string-l1-1-0
isgraph
api-ms-win-crt-stdio-l1-1-0
getchar
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
fmod
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 381KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.skid0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.skid1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ