t<�Ye3۩�*5xe�5k�'��p��D�o��܁JՇ&A��ek�����ד�Hz��D�8�4_��O�R����T!������{�1�}A� ���6RΘ�"�s�O@CG��-}x�f���Ky��xo%W���m����}9���l囨iC�0�6q�A��(�3�> T�7��I�P� ��/J{��yy���¤0�l��o�!�����7<;�������y� ���C�*�����L���O�89h1�vr����B�s��ߛ��n WX��&o���[0��]�A�]���Ȩ���Z=�I���t�p-��e<���9��}b����c��@ctX�&[����&��d$�����#̢���⍼��?0�h���랑��ى�-��w��@}z{ �#�J?����W&#�'��������&TD�6�X1�.Kӈk��� @7���P��ow�Kh�� �:�X����Zl8@��|�NW�t�$'ϟ������i�t�_�4�S�����tk��рa1��v��v���ag�q��3��:�O����7{]�Sj�ʊ�?;��Pt� wi��p�&M�T1rp�x��C^���!I<�g��k8?��ɠV�C�24���Y������b�s�wR��h��Z�P��`L����EC�,�J����A���ah�P9ЛOn6.YKM���1���b���{��Īf�#ϒr��}�0q�,9I�=No�_�]G��(�C(z�PR�)�t�d�M� p�BΙ��e�;����{Q|@l��8�n�c5̦L�����E5�G�'v���3��<<������d,�3�cÃ�#/ ��=>d-��^D-� }�=|͂��Q�me�X9.�0PhGHkѰ ܕ�:R��}9�)H��f1� ^P6���a�$&es�4e`�4\�8�q�&���a�(㓒��3��[@D].���ZK���S7g�c%�7��N��� �9�\����������B� }.�<J[���j��-�FUlYA�F��<z�#��$*�C��v��a��U�����S9�\o��7���N*^� ݇y8\F��{��=&wMk{d$Ԥa�4' bk��`8�#�>�ǟE��]m����6��K�C�n��]ɽȁJ?F�p� q�,&���Hr^�V�x�w\*bRE�T�K����l ��-7B�W+R���'���͒�����Oƍ�;��P��B�-�~lw���s�i͎����F�x����t�3ȢHu�,�f%��99F����u��_&�8��A�2Ev)~�iW��B�&]0�>��r�[�N{����dX^�i�sy/a|Kg ƹ^��5ьǠ���Ib��Zze�G$�CB;�Af���e��L�f�3n��7�YVi����a��q9�.|�S��yĕ}��۲EWt��[�#f%�H��W��M;��Ȯ�8��J˞QwFPh��|O}h�24�Xp�?�����J�)}>�_ ~��rS�s���Ջ�2�+H>����9����_�X��$c��[p~�HJѳqÝt�[��u� �B�#t���`0�\�*���/�i�2V�W�U� h�ɯ�q���̝�����J]�������l�*7i3=�"Ӵ�E=�����v�B�I"�&D{1�����t�2L�����bc�nN�x��` p�aW��F1�9Mu5���G���"2,.���S��ݧ��q����w-M��z�� P��7���������ݚ�FM���&l�[!B eNB7�����pq��D]�E^�N�x�a���h�Äټ5N�\3����|3�z�[x��ˇ����d� ����ˠ���K��h#���'L��')���]�����݆���*ť�"��q��eM��y����/l�U-�CEMH4�c5�{�o4b�u`s��F �Թ����T5 �,�$�x��X:�3���w�лC�r�(^�i�ػ<��q�:6>6Ez.�B�:�58��?�GZ�v�)��{����@P���[<�/�߷�(W��΅\���$M��,�떠�'k��oQ�96�PI���������%���1�6��¾� ����͛��j�Ag�i��L�-�x��V%���Ь���s �A����N<�,�46��鹜p��u�t�0X�ꭱ���V�o1�(�����xq�g�E���� P� Pv��0'E�~�n�zQ_�@��qp�����$��V����� ����<�J� $z���x?l�仱�y�2C��u��n�u�"�r�UX�EO��Z�����Ptي�n�G֤���ղC�~����1t�GC�B���W�H�$��?�F|$`"��� �5{?:ϵQ����X"c�Sw�tLᗋ0E?�HOy���t�T��`�_u�A~���i͑�+l�X�d��&���՜sf�s���gs��� c�i ��X��Ӿ �E�?\C��S�R���x�uYxČ���gc�P�\ :�ԂSf$�pS�M����nu������UM����ƽ:���)A9�fVX�*��V�B��Ilj���kJ�b�k1��Ϯ�%ݝ0����K%�Gcs7�N#�r�R�����S��x�ҭ6�N� i����^���d�oޑ&O7���ELZ�N3řW������h�T�탾R`W`���H@��y���`�+�(UA��ʭpT� �2�4������+�8�/H�cd4��Ź�p~�����w8$:|6�C��K�\�~�����R���!��j�|w�WX�rZl��1��jL�MH/gM!�cd�´v�GGoH��@=b���2?�Dc�I���#�-M��,�3Q:!��}�� HwQ_�wl]�c�4��] &�*�9Н����3븱!�*I��WvG�9G�!�����&c��e?�r�s��O��}�Ԇd���ڢ�XE��4HL-\�e V��� ǡ:1��9�^LK�Ԫ\�2����K�[Ԩ�����F[�S�o�q���t��:Y{�4m������С�'���m�3r�������#B�5�Y�
Static task
static1
General
-
Target
a5c4fef751b9d90dcf99.exe
-
Size
8.2MB
-
MD5
266c86b21c13030b368f2f7fff939088
-
SHA1
9ace51afeeac558cd9a393e5de4ff13de1183e2b
-
SHA256
bd205d01db4de292ffb6397f4dd7a15935ee529ad32b43ce28a234cbc9860c0f
-
SHA512
4fb7e76481c1a8945baa603149e5a50d65b1de10b439068bf327fefc6d414df0c58930ce4faf7a74a03d414518ec1024d7eda47e3cfaf695888b474f09ca89b6
-
SSDEEP
196608:sOj56EWXJUsLqv4nl1N2+Rlqi/vEApQgCSdIdfE/CZQbw/2w9SlXw5y9Sc1UTh:FUEWXJU4lPXlq8cgQolCukuSmi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5c4fef751b9d90dcf99.exe
Files
-
a5c4fef751b9d90dcf99.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.[f< Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
./!> Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.`SU Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ