g�2ж,���Ƙ0��(�5�↯���f.@[*�jR8_=[���mu��+�NKی�+������G�]%�7��_�"<X�<����b5���m�m����l7[XO]�~>� !&���vnlQ���y0I�t�ȮΚkڴ�#��3O)��0no��m����7Qn���sW�Q��mR�G�6��Mʉ������D�Ou.f�,��↖�� 'C��xX���&/����<+þU>�{p�]��c�`x��w@��JE<�/S�G��Z=����'�(���SA�M�D�LV���+��|P{ !���p@��z� p�}�����;�@�(��8�ox�����y��)���?Ǒ���TzHl7M��U�]���xx�0��k!o��Z]k�����e�|A&%� G��~��bg��e\��a���Y�y��T��#��ġ����m_�[��v�b����N\��u-wle9�롞�S�S!4f��k˦[rD�n�����B��N�lko�p&a��� ԢّH�i��q|vہXO=�=*�������a�Ѻ~�SmE �y˽�]܊C/Tv���I���A�ږ�%��C~����������1��M6���L�N���|`X�34�o�ч�:y=OP7�ɂ�R�_2�a�]$��|�mF�����1��(19j�Tטy'7Ֆ"�֢.��=*��"C�T�������?�0�&�ȁY��N �9v�Y,�,��W��VVl`�w��!�O��2�w�a������y� $dy�F��K������|�c�i@P��9�2\[̾[@s��e��3�wHwr$�}�eAR�+��;� �?e7s��_%y�,_ � X����Z�֙�%����Q�B�iq�뤉8�3��{�x:���e�U�/��ns8�����6`H�VO�f��!�bY��Q+��r��V��m��%/v����]_�0��ʌ��fMߖ+��b� �G�V3�P�.��r�O�)VY�Yq�!R�p�7`��U���1YK����< ��� 6g�6����`*�����y�LE�z&bi��u��㗁�Ce��E�ng�8\pW\k�y$sU:D5O(�yj�h����]UH5Z-�I�u?�~��4M�W̨WӒ������\ ��m���g7�F;�WlѾ�f��I��NJQ���B�\Ov�\f����稂�P$�w���5���d����:^GÙ��r_]�vz��h?C�h�.�<t�K�>y���а!o��� ����I-s��!}�0��/���{��Zj��O���ro�4/c|��3�n��Z�7�����#p�W�b2q�a頲�K��6A�=]8�Q���bOMR!�6�#����9��Xq6m�i���{C�U�1ܜG�P�Ѱ�--�)�z[�E�%� ����1�:$@f��6����'�x�����je5c�%�2JE$�z�אx��Q���P��֊�xw�rU����6�8W��s�Q�S�rdņ:����,��d�=���@���r']��wy�2[)��U#��3M&u���T�& ��W�L�)];ƺ?d"W�u�ᵣS��%���1�u ��S?���ؾbc�dU�I[?k��(JYZK[ �R7^U+}�Vz�X可�r^ K,�AF���Q�+��D<��@�C�U�-�*�<{�笑�u�D����CD�z��_���ڵ_4�np�;�&T������T����1Z�>��m�X��d@����V#h�,���̺�m����"��I��z%/VFu��<bh�,D�<���x�*k*��Hhn}�����\2Xz�>X��C ,�ӵ�C����8t~����n�!�S���O��i¿�ú�����s���>y���V��4"��߈��4�m�����x�\,�"�����Ȗ4=�P�]XdO -���=-ӧ�݀|��Q�E|Sz)����.�F�j%*��`�_�����U1��9����"��w��mW����8���O��Uj\l ����B�x�K`lX«��FX�<"gbT�N4���c8^�?�!�����O���!I9��U"*vh5șۖ@�\0�sN�:����km}��x��{��e�>�g��O rDZm��{��K�c��gJw�H��9���b���E�>6}Tۥ��e:�w`�bd����ϱ�p���I��,vm"U"�ADr�C�����Qޟ�TFc�-��k���p5�詨�gx� |Y��$�����!�f��*I�j{@�\��Xvx�#@��3L��R�6c��n쿞��@@�I����RY�OΩ%��[���#d�K��DP�j��X��,�fKX��qn�b�S��! �2o�V{R��3���^RO������ۭb ������9�BP F���}��o>�gYQ�ٵMȊz������1M5��`s��ݑ�>&�D�#E�{7�B����2���ţ�.֝~��y�"LS6BrB�=����Շ�0�5�ͫ��f�#�s�M'Omr�[3βy�x]}o��v&����$EaX~Q��:ڻ8��~�ZȪ�P�襙K��ݿlL ��������;��!�b�qfk�N� ��+T5pE/<���� ���b��j�:�2w��W�� P�>��xbU;�Ŷ�kP�A��!Z(9��x�����a����~�0� �d����v�m����.�*ͫ�$#9�@/��o5����Ѱ�I�:�K~��u��w0�_�w�x�j!'c�d��<(V꺠���I(>��F�:>7+!7~��'yן7.9��b������Z��!�ߚ�����C�PKe���3�@F�`���� �=��VT�(��G�jK���'�O�[�jH+��VذQm�J��>����o� +;1r�6 ���Ehd���ca��x��]=�5S�:�*3�{���ÖYh�9����b�Y���>���4��)����*�[��,64�T���ц`~$̌�Tgo&�u��1��N� X�ǨB Pϋ܋���f����"o�+&�*bN�}�Z��,:���}Ԕ^gAY%u���-hB�
Static task
static1
General
-
Target
artifact.exe
-
Size
9.0MB
-
MD5
2df3c1fd2c392b653b6473d86f073970
-
SHA1
d665d328d38ed92c65b8b317b362d6daac687051
-
SHA256
afa72e87ca2a2ec0696a233e6d52334787752bd932f8a5af3fd155d843bdbc8c
-
SHA512
50d261c8691fe482a7299d0706af74aa0fead30671790faf323c71abe5819adb120ad5abfe74f6ec48c9e151e1ebb016549313224234479096bd99c670246ebb
-
SSDEEP
196608:JT0CuqWR4jCP653AtX9kUyDCJkNR3ZjeX4bAQ9:JT0CuXRGCP2E1yD2kv3te0AQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource artifact.exe
Files
-
artifact.exe.exe windows:6 windows x64 arch:x64
77bc9686142052899c97d01e2b54c342
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleWindow
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMenu
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChain
ws2_32
recvfrom
shlwapi
PathFileExistsA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
NtRaiseHardError
urlmon
URLDownloadToFileA
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
Exports
Exports
Sections
.text Size: - Virtual size: 441KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yYS Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.TOO Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.(TR Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ