�����^�>��㥮ˣDsŸ��e{��£x����̰�3��M���ҷ"c����?�/\7Ᾰ�ˡ��z?��n%��|��@��S�E�����6�+���;g:�����z�Y^��9��"�����F��u@�Ȉ$}���6������iX��5����[�i&��a��y�L�n���J��ȿ�nQ����+ΥQ$9h�� ����̑���Y�:�!R��H�j<�RA٨H��7^�(,�$�ޥ��ᰄ*mC�bX4Qٌ i�;�ʣ�䪟���K2A���E(W�t��qyV�[�1��[��������t�A-�h�#$��#V�����j���ǁ��y���b�E�������i[����mǭٺ����j3��,�n�h^F�>�P{#�C륏�������Cq"3Ve�����TH�ȱ�b��-�@�ɱD�\%D"�6,���]N�Բ�<�JZ���m�9Meg���ڌ3��HN��G�k.=��6���Zu��2����&%P)i}j��?��)��>q�] ���u�6n~h�+�y���Hî;<�d������A��I��3������σ~�9�x����E����B�8�c��+H��ݫ̔ʛK�&!'1��Na26K��u��,���#���βɗ��,(컅�� J m��Yp�s"!�oX5�����,���QU�����췿p��ϩ�s���7�(�̀�� >U17L�P�c������@+&���~��\R�|�9M�5�c�I����:�{�O2���۰���2Y���[��g6��l�ErD��2*=qM�������8���W��&���#��F�M&S�չB�f��)�~��;q@��u�j2�����x��rī�ވ�OG��Y֞��é��X�z�Qrt8^m��K0�ǚxd6��C�u=���K$��~qgMx�r�����7I��i����̤���z�kXDl��ηl0�<Hi �-����gY�B�Z��ǖ�Ͷw�4 ���H$S���p�*���e�q��r-p�eڲCN���k�zI�P��6q#�=9,�r믑�!��R�������4�cL�bQ�Rb��_��+|`y=[��X�f�]��̼�5�9�� ���)� F��0�3��)��6Ek�G���Z�*��븾}�j�ǎ�4e�������uC紣���%9�`�%���v�Vr��k^q��~��뚿��+tv����W���^-K�W�ι��'�w�t3VRa\�x�ɋqRfl��nm㖪ҭh�2~��3��x��^�ҵ�HK�e"��sD�;��������A=^�a .aw�*Xȷ��ϝ��y������5o?��&����e6o�b)Ɣ��;q�[7�C�� e���[����~��Z�M��BВ&3�/p�!��O��a��������hf��q}��z5�����W�����v]\�~�� ���rF��n,�4'�A*z���6Y~-WSc�1�>b3��`���dp��$��'���6i�ϝ@gr~ w0"3�B��|x�Ӓ���-^���)b��B����wլ����`��u*�����;���h��+v>vCP��u?9�Ȍ�)�ْ��,�<��#mOcL���u_�Y����b �����X&�a��=���a�c�ZN}��!���Yu�����R��6uޗ�p��h��6A��1�� ��"-�V��s�������O�`g��`3����I����S%d�i���v�Kpz��i<�����<��# ��ǟ��T����H�� �Yn�6@�1���&�S4Р`��}R������@:�zw�)��9��������@���/.���a(�gU�Օq������[q)tЊ�B�D�@)�B\�;���X�N3�ݶ��~3'�Ͽ>(~4X���噶�^����̪,������k�5 �U��)��m�����\x1,��/�:w�/��@����E)��0��칥W��{b�of)ф-��u����|�Oh=���|0��W���a�G\�Ŗ\��Qj�"�^�u��Qc��0��Tk-����A�������s�ш�|Z�Ҭ��O�٫ܝ�,@orA�c�aTQ�{�n4j���^��Z��6�%��5��͏6V��ϓ�;�=TWQ���g��s_�~K������5�K�2a �V��2����ݘ@Umى)\���n���0�.��֣�A����DŽ�"��?6�����̟����Y���p'&'����e@�S�u�;g;��H��ĵ�k�����:&���MU�Ջ^��lblJz'6�����t1�v��-����E������.i�x9��>4h� a�Y�Gdr7�X�Q.إ�)-S�[��� ����_nW(�fiy�@�,�Hz���s!�l��V����#����T1���J�2\��G��{�bFO �B(�&�%���ױ�ybm�S�p�v�\�O3ߒ\�U���P��Z�$߽b�t8'(T��fʁ�l+����C: ��'vŋ���3����u��L��T�طBz�>�y���Mbs_�;����̑]�� j�v� w�m�of�d����$�L���A\)���oWaїrų�z=��n���������ȡ�d�F4,gI��h���3��3�UZTD�T7E]SY�]M�_�cE�+!�b�(؆�SB���E��=�0Y~�.�!t��8�IP��K@go��& j��}�DD�֛v2���A��鏊K�?��W>1������2 +J�0 X҇��3|_�Ō�F:͉j�7R�w�1��4?����r]ݸ��oQ8�%�Y�&�����C�`�_��7���Ϥ�C1S�+��6��q۵�)��BKTe�)�ڧ��D �f�-��<�e�L�wTB�Q=�1`��n)`k��E���� � ^]�}X|�s�Nޘ!�?�Ѱ�{c ���t#g"��Sd�Z��Ut���xX�b���"�����@Q����t�c1�������[a�Y�iB���� 9��=�w֏��Ӫf�=�z|D��|�Z�Tw��k�\�?��7=ND������~* �8i�kLn�M������|�CP�Ͷ +{
Behavioral task
behavioral1
Sample
2db88a14007d18ceed35fcfdc1b4da18.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
2db88a14007d18ceed35fcfdc1b4da18.exe
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
2db88a14007d18ceed35fcfdc1b4da18.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
2db88a14007d18ceed35fcfdc1b4da18.exe
Resource
win11-20240802-en
General
-
Target
2db88a14007d18ceed35fcfdc1b4da18
-
Size
5.5MB
-
MD5
2db88a14007d18ceed35fcfdc1b4da18
-
SHA1
f0562ae6ddd4f1669ed539f0d54c3090e55d0c2f
-
SHA256
0b28025eba906e6176bcd2be58e647beebc92680d1c8e9507662a245bab61803
-
SHA512
4509e75eb8c3cc8d3bdea2ae463ad439a148f85e5c37586b8bf59dbd6abfd09f749dc094a5b010f0dcb407bbed3b9b5e214f95e3d4f0e5045454051853730236
-
SSDEEP
98304:qkC+0NVtBmFNjuzk9GpGz/xh5iAF/7zMMYs1YdnMUfSnFlUU2Y8t:qkC+SVt0koI6/xPiAR7hYs1Ylf2IRY8t
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2db88a14007d18ceed35fcfdc1b4da18
Files
-
2db88a14007d18ceed35fcfdc1b4da18.exe windows:5 windows x64 arch:x64
426ec1f9e7b1c7a08f3432fc4e11ab14
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 730B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ