o��+���g�����`��&k�[�S����J� 5[@���Ć���z�T��yK�'�yH$�|.�`� �����樞\� �<qOOޖ��$�=t!�p���� ֯�ȡ��/�8�*�{S ��奿��0���j�0%p����;�Q;��K�,��X���//0�Y$��6laj�(3 4)��ڢ!\�>����/_��q��:�D~n�@�����k�B�D!d��V���gn�),��'EE�Et���@h��k�S�wJDr��m�`�c�ι`qư�ǻ��g��E=,��Ce�����g�hNi�͗.�x��㨹���ձ��:����P&��t Qj�vhf�:�&���םV�2��<O��>�Li4l!��������*������{\�`��@?{�B�[�߇":0�b��z�D4�}ޑF5��-Q#+�]�aW�8�H��p���:f�+Ֆ�2fr��GV�gEf�AH1�)\ CI��u��/N���v]!��4�k�{��@�Ц3x�۹�����7t�`1-��B�2&���,��@�j5s.�qcS�� E��ˇR{j4-�R+���{���p)���D`�V��� aU� l�\���>=��J�NS��يh�GV#� ,���]E+�\7I�����ٶ��\~ IN��4���p���6ۙyRf�"Z���2���vs ��B3���P�hU�xUd��(�k?}��ԃ)7�g�[*��T�T�<������o� ��C�Т �Ԧ�k�9$�8*n��Y��i�/�jۉ��s;��4�d3�ƹ:3��?��w�Դ��(h�Ɣ�A��}=��^)꤈��s�,zn\9�����Wm��915gHa�G�餬#*ꪊ�c��r����v����R0��z=�b�e�\M{�������_=?��x��I����$OOC��G����>�^����4����dk�k�e C�F���|3��ot��}�?,���d@ F⃬���X�.�dž�W5�� �H������E��;���& ��?�5�!uY�_ˍz�o����8+���ۄ��#Q��y��N�Ի�cVY;,�ץ ;�ӊ�H+n�v>����&)�z�(s��+�F��1�"UYzP�~t���^����4wB�����Y�.�c��!�C=(�u�k�I�MCi��L�� �FB%�ަΫ]H;z��h�_8Rܡ�z��Υ���{9�c&���+�ufW~s�%S�O�:�N ���F4���h1�Կ~�"��ႦD-���n>.�r�Z��4�_�R�Y��6�9@w��>��}��bg3��*�@_7H���[dFo^������FC��kGG$z��H�fr���\�i`+ח̹ў*i)F���(�{�i�A����Q�j�c��ׅ�_�.��31�o��6�h�_{(�8���<�F�1�Ե_��g3��U���^���R¬��5��k�AaN[ϕ�)(O���ϬN+̆b�<"�w�'s�l][9�^�j��fe�^���>E��^2DQi���Ւ�(���Oh��pv,��a��z�K��.c�$6 ��&\��vL�3�&��o_*�ʙ����)�T��) ��Bף��݇�����9ۗr�"!j/WKg���Z-Lw&�};D=9�=,=�wE%{�J���P����p���H����Px�̬ \I��JL����Di���ܿ�ƱV���:��/w��Nw*z(����'����M�rاKW�����_�����rvBI߬��w.Hdž�*� �����:��,�X�U��NX�9}����<�����Ҩ8vQ��n��������=������P~W�tnK�d�0�=��f����>�p�2ә�N�N���,�j0WL&i��6���2���'}��k)m��2i�أ569�{|��p��� ���H[����f��0�,<�9���?-��4�w���,�������� RhF�e��%#4�ݛ�2 2,�VG����4ͬ�q��G|�垻�<�SD��V� �Q�BaN;���3qG� �<r�U� ��rL� V/`N&xt=��;S�� P'C�+����{�#e�V�z���H(�?���O֮��`���L&7���)��Qs��|�x'�� �O6[[2s���>�=p����?a��N ƿ���ړ.�8�X1���a�Lt~��Ķ9�'����.^�$^*�'q�6*�|;eZ�!���`E)_�;�Ct3ׁ���C�<F`�s��}�H� ��_�r��[�$a+t��!��=�ƽ�C!n���M��o0��H��O�G]=���&����P��]�'�n��Dž��K*#����0�TC���������33h�\EA����+�s�_�p-l��}��%H���Z�jd>�gHb"&CύF4 -��.�����b��AQ��@��NUa�bc���)k���šZ$#���!k�毲�:��^��-��i�;q,�Yiڑ�<��M[����P9�Ɵ6+��h~dO����lurcI]�����9=C%uu��^�d��VE���(묷�8�Jbt�-C�(S,{Ө%h*V}�f!E����d�������,x�RNh� �\�c]��$�HCg� bwꎶ�࠹���~z�h�V�8����x���\Jqz�A�{��f�����Vwr���HXW���g�+�F��`�#�A���0��$�x��O�OE�6D&����v����o�u�n��JJu���.�G�k�pZ�{y�$�~xa�ɯ^j H'3�0��������>�2�/cl�?����;v��K�1Z�.!�~q��䬄l�����L�lbo/C���vV#��J��aȑ�ʱ�����ġ�(��x ���~B�����t�Ctzִ�s'���.�mjkL�#ڏb�|Ƽ�����b^�Sf�#2� @�[�O���]��Z9l'���h�SNL� ����>�p�}o�; ������T'!u�^$�V�Q���:v��'�C;۰P������W0.��/���d�Ϋh���p�$��o���-Wy�������x�7��|BY? 87OJ:��f���\�� `�aj@�#�-F"�8���dq���H���Y1
Static task
static1
Behavioral task
behavioral1
Sample
c81b69ef9f6d205d8c20e1e956cdbca0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c81b69ef9f6d205d8c20e1e956cdbca0N.exe
Resource
win10v2004-20240802-en
General
-
Target
c81b69ef9f6d205d8c20e1e956cdbca0N.exe
-
Size
5.5MB
-
MD5
c81b69ef9f6d205d8c20e1e956cdbca0
-
SHA1
12cf3fb0f41e08161674c82b25c50be58125e579
-
SHA256
c9a900b04254ae8032ec5ef153a2d5aaf4d511fbf6688397a30f2a0a24a767e0
-
SHA512
6bb7db0baff4c69eacbf531f0147e48b5a1cd137ad89a4ddf41c134fbfed2567c7dd1c62666a2c82bee43cb4d4684f844f6c7c4e58bcda11298d675394ba3e96
-
SSDEEP
98304:3WkvOzE19ARkYrnM2dSap0pK8k2J2ElhV/patb0D26bM5dvM4YQvnV0jK70WuID:FmeKpnFH18lfHibp6badvMMnV0zQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c81b69ef9f6d205d8c20e1e956cdbca0N.exe
Files
-
c81b69ef9f6d205d8c20e1e956cdbca0N.exe.exe windows:6 windows x64 arch:x64
9adcabd27a9d7ef75ffbf0e0f4ddacb4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetLocaleInfoA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
msvcp140
?_Xbad_alloc@std@@YAXXZ
ws2_32
shutdown
bcrypt
BCryptOpenAlgorithmProvider
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
_dtest
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 628KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 779KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bar0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bar1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ