��4yfr�ű�#?Í� �Ϙ27-�sP{GS���h�h�W��yF�PU /��pQ|t_;�3�u@D��Gf������1D����xT��ί��ޑi7����}ݮ^g'F~��^VF�������\U�� ۓ���tz^ ���[�OF�`�1B�DD�M��4C"[@DĤ����#��<4^v㑷+|G��ڊ�6rj��pz=A�\K��>�I���J�Β��A�&��zT���'*�!����k�w� c��M�9�d8���o�}Ѧ|�:��!����a@��` z �;��j} ��L�[�Ԭ�M�B>&1�;N�R�S:P�pZ�a��AY���R/��1�`hD �Q��0-��k����'����k�`�J����^ m2�M��j^�~~�����F��dE�1��ܹ\q����s���-%���`÷��Me����iʡ�ځ�d�_+����f. ��{鋙��O���������͇J>�9����z[����k��"�Y��g襫-���_��T s�F�$�Y�g��~�����+�iJ�Kt�tA�Q�����2��ulT/�džb-����x8�ɐ�ж�oc���8`��n68�f�Ha��#NG5 K�����N;ukj���"��ؠ���U�|����� 1���G����N$�p��u�ߟ�O�h�s�{"�v���E�5݈��l�ޛ��sC�����h��m�E<�E�������؉85���Y=�D1�1�O�')����)!�6���y������)D�w�N��e]�~Mg ��,,F��SA��f���AJ��٢���l*�"E�'?�@6ڦT��LJ2j��Z5\�N�#m��y�� N��#o:8�J�����t��1�j�S�Z��Y��M�͑z�X1ν�0V�A ��vĮ�1�N�sYR8rC����rm��@���H~5����Y�F_�~��5�2��Jpt� �i[��<__�ya��CKὮ2 8���6E��!��w������o��*םg���֊���|�j�:Օ�eլ��o��KIܜ�[�M���W�Y�P��~t�kE��W�BM˂y�t�@!?�$�/����E��A�k�}FoH&&5�� �%�@��b��H����\p���Q�C���+��6J��|�h�V ���ރ��vaRNll��4��C}[ʾ /�{`��p3y�Dcm���Ko���2Zg���zYđ��{�R�-M�ڦN`� �+(�����VD�������#�������b�Cgdf 5�j6�:��ʕAY=�7$��k�t2v����A��������Kɛ-3��n@�N唔�n�VA A�JdQ�ob�U�aX���v^��Bɒ�>s|��#Yb4�i��È>¾[���U��/ˈ�0��1���PY��jm�����6��RŮxҩ��d����a�P�P?�_�jy��o���}kMh�]���:�t I��N*V/��{��ų��{���Ն������Ӊ�?�k��Q����Rb�K�u�)�"����1�GH��R��rH2���,t?8h��v�X�v���#^�,�5��Ƌz������D ��Z��\ֳ$�HS��W� �߫ 4Vj������Y�(I����V�����d ='�.�\QJ�(�k�5����Ȃ��0�xy>����$�Sݣf�#8��I��VU�P-dǮt�uk����%��v9��/�2P8�b��2+�3bx�GdQ���$_����L����I2ũ�t�a|�֑3� Bd��U�jF:��/�#��x�"~1��a��ew(h7���$ɼ��ꁆ�i�Sy�t,���0�ۅ��� %�֛/y�}�~�'x` K؛`�@פD������&�k�������zޜ�"�H��U����i�p���8� �%�H����@�Q��|��J}~3�ŕ�/�Jh�f#y�����B��o�-��ar$�or�g��(2��&�]Z,�E���@ɛ�m��c�9�������dS��uzMr-�^MO����,p�%�d�H�F�:�4�>�B h�tua�ru�����,o'uދ��Q?��k�]_ē��r{ ��Q�����|A�Y��̝���Y��1�}y�I�ۏ����D� �����f�1�)t���&�y�lϪ��Y8Uό��%l��<��Bn6�r����ᔍLUj��A��Ex���;1���� �݁�'��`�B�����3 ���Vi��������`jk8�_M~�.7�ɖg4��]��ǥ���s WOѽ߭s�/L>�>����%<3���T��UX8xI���~�ܷ�PH��m����LBX��>���^���I@A�����mQ+Z��4�748�1^24L%�e~�g�y���<�ϜG&t&�lC#�}�Z%ӿ�NC�8N�̀�Ʊ~�:��m�[�]Yf(lD�lt��^���ћQ�P5�\���Tծ��G�&wqUK{Az�B� ���K�Y5���hQ>j�GFs�����@��[4��W��:y��'i9Xy�A��j��-��Q�ϗ|r�L�IsEzڃ.�G�fZ�M���@�\�Ť^Ѩ_�"s����q���>et��]/��h�g�:�r+������{V{Q.������[�R�2fU�Dke�寀�=q��!}3P?�ڇ%�k5I������~�ߙVaT�jES��TWyiƧ�9��we,ၧ�������K'�<cg���H��0;�{�I��g���0'3��M�ژ<H������;�����>7��ռ�)��dY�h��S�Y�% \�)2��̶�����YX�X�B�>Xפ�@�&�`�b��;"��cb�lF@�����ia�~���8y�!�g��6�',Β�Ek6�y-���m{\SMr=nX�Z�Yv�b������X����p�C��'��J��7�5y�J���w��F� {��\ԥw���Z�I�w�\��܉p1�Ǽ߸�n�t� p7���L_�eCl&�J߉u O��9�O�A}u�ez�ܒ�<�J����5F�N9��t�M��Q�����>�����]pAB��-O�.�p��1����<+N$9ֿ��`(��\�
Static task
static1
Behavioral task
behavioral1
Sample
FastLink.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
FastLink.exe
Resource
win10v2004-20240802-en
General
-
Target
FastLink.exe
-
Size
31.4MB
-
MD5
a36a0b7e3713ef864e919cccf453614c
-
SHA1
cb3f0d600f4e553ee171f4585ed71321db79d490
-
SHA256
745b74e18da18a6727683222ff8653a60b745c3a2ecf2440f2b114fcbb523299
-
SHA512
223c50b94fafc50d556b46c22685406553f7c9bffef00acaeb89b8d22ca8018dfbacf2a8a1e10bef9fc83f0c9144c8ca2a97361e1890c4ec402f49307ba3bd06
-
SSDEEP
786432:SAkHG0vTN8maM5wIn0BYcNr4fhiknH9VDy6wRSN9wETCKJjgFkn:Sh7N8lw0BxIndVDT5N9gijz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FastLink.exe
Files
-
FastLink.exe.exe windows:6 windows x86 arch:x86
5a967e81fb395a252fc13d611261e8f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteExA
wininet
InternetReadFile
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.k92m00 Size: - Virtual size: 15.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.k92m01 Size: 31.4MB - Virtual size: 31.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ