�� �ϩ-�S��O"M����ge���-u�����tJ�z����M�Bf��6hBI�L��:�bf��Un��b!<��}�}��/B�i ec����n��y4;a���q����}M@���r� ���k[̾ʞ�F������s�KQPR�����p��s���Bps��z�r{űT�H3y���P��׆kH.�M��cAi�Y� X6��Lj��3�?��P�� ��W�C����kJE�*�z�_��+aX���'�P�|��Lb�����9��\�J% |P�k�(F@:���;t����Z ��гc�w����*�����q#�ţz�]�&�d��nS*CV�ze��\~�0�����αg�B�����M�x$ �=���j�7��濳�& �i��u�G*anw�҈I3��t����H�ߎ2�[������h�2�m��jܨe�}-Ȍ��_,�}[����y];�����v�� T�i�mr� ��n���gL�a hn�Q.�"c\v��P�H\!˛H}�c���� Z �}�I��8�"��X���r� -z����|���X�]�C�d�J�^�n듛3r�ڜ�_ۼ$W'ij�#��"+�9l����5�����9�w�0!�������V���O�g!9>.����^�q���/�4A������I.zi�s|[�o� ]��!�4���)���]z��0H�v�V4�|~��cBV�������3���B�GXu�*i�K�ڧ��aqWf��,$�09���k���ѧ+z����&�L�)�p��S!A!u<�#�w�%�y��ж����'n���2�������L�v랂��"�1 �������� _�4?��P�:�*���օ��5�jD��;9�잦��'�U/p����N�K�Mx1姌�8��&������;%l��FZE�FA�"q���.}���+P���� �Y�սEw�5<���e���������Z�41:S7hH�V�j���À ~7��7շ��LS���^� ��� ����!FM�C�s�!lJ�9wYCfY2��J���p����� ��>�lݷ��8ru��ڦ!.|����$��w����5��#���[o;�Lii4��3:7��`�\+ ����}�N��`��?2��wd>g�0c� �(��hqJvF�����4d���x�7'dˤ[�џ3Q���E�x���/��b�ƾ2����� ����Y�Hm.0�}A}w�!���p_�)١,'l�B�9�}u��l 9�-��f��6���fvC�t9ܸD���C�}n��Sֵ����[@�h^9�L�(&�ˉ��#���l�1�i�ٴ��BQH�������ɮ�(����?j��A0ET�(��P��v_��a�a�y������lL�3���I�bs�ء��;!"Ç?̈́r?M��a��ٕK*��~+�L�C� ����x��ҸY�fܩ7���k�Q�i^�����\拓��H�߯��l=%�!�G&����U8�Ҷ!`-R|��>q��z�f�'s�����N�\���t��>���luݧ՝EA㝅�J�p��_�m��/��[m<R��$� �k��H�@�=��r��0��� 98��z~�;���R�D���<��2b��H����WR�����ybE�H�$�:X�ك�������\P��`j �f%�}�"�q�>�K�� )G��O��#� ���e!�5�� ��k��|Q��\���� d�����I�j���X׳zC}��Vyf/ZNitg0G�3Χ٣'�McE#x��!��ʩ����xjW�nB-�-�e?��˛:! ����jLt<\��3����^�{� �Ъ�Ώ/!>9�N�L��i7S�+�D����c]6�)��mK�>`L �a� �7�9n��!zjc#�3F���]�S���riNR�B~O�q2����20Y�B�TU�O ���T�p��fAnw<[́�lVQf3@vj7��������G0b@���E/̯��?���^s�Õyf���{�L�hPh�v�[�de1��'�Jl��0��L:��rT�LL��*s���[�2U��;c��脠Π#������d��O�W�s��Ȉ`T���tJ��a��/��]kC��uT��J��e�v`ݬO߀�����sA����p$�:�ҙ0�KxN�-�~��W�|�u��d�e.�~�b���o�d�G�n7�(GI9��H��@� �)Z�O�8���]տ!x��]���A6�E;���b>F4��Ѱ2A9|-|#�T���@�#�/m���_��J���v�t ����\u��-w�!�1g<�oo��5�F�!w�@6�9�?�ȥ�x���:��1�1�������M&�P1� �Q�CL�,��4$LL�JA�2r6��ޭZ�h�ƕ;R9�^���_�nݜ�;���ފ(�X~\З�q;u��k�f[a�S6g�?W����sj#%��V�eS���.33�i��z`%$�R\L�~BqN>�I\S5dE��x��S|6'D �]�ȟ�|��!Ds��]0@���t��V���]��*E&��S�������a<��{�Bi��"�lq�e��Ћ�M��;�m-��"���|l~6�L�lξ��7`�N�0rZ�^������#V,6"�̏Ԏj�y]u�ڏ��r�Ѭ��M{�%���U��d߰[��zp�m�]�,������e�������V,����8�_g���l��+͌�O~|9��+"�:������i�[���5����q�m����)`�`]�s��,�Wf��s�G+@��{"�ؤ�M�{c�L����g�Xى�|N�t�0�]�,�V_��9�}��*��hor������>h�̶�SӴƒ :Fq�L)��6�go7,�C�ɬۙI���߆��)$k[����u�O��پ-���8mlM���c��߾xR�C��t�i�y����<I�NT�|�=��I� �#� R�W�)��]��VQk�T/��i���`N����SG��Y�[^Թ.��i�P��
Static task
static1
Behavioral task
behavioral1
Sample
7ac06dfb9793b5e41edfc5278b61da10N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7ac06dfb9793b5e41edfc5278b61da10N.exe
Resource
win10v2004-20240802-en
General
-
Target
7ac06dfb9793b5e41edfc5278b61da10N.exe
-
Size
4.8MB
-
MD5
7ac06dfb9793b5e41edfc5278b61da10
-
SHA1
7e4e12628d10b2ce6bfbd5e2f50aa1f956a920d1
-
SHA256
dc616e57739fc9c839433901045e736c570cd634072639662bbb1aa8125d8875
-
SHA512
77e9f6b0945f29b7567f969f51a163bc2a49ef14da53eacfaf58da7891cd67cafea6d9c5582d5d8f539778de6f7943c1c3cce9d796cbb537b74e47dfd5ff8d5f
-
SSDEEP
49152:Q7xNH+B8qffAfMlaT0mQUOzbTXNFLJ9YsJXQNJj2cXrzeoH2Ikflc5DdqhrOHNUf:uenGwawmQUOP7NFX+jzPBPMrIUb+OPf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ac06dfb9793b5e41edfc5278b61da10N.exe
Files
-
7ac06dfb9793b5e41edfc5278b61da10N.exe.exe windows:6 windows x64 arch:x64
8b4e3bfeb762d9073d97e5e1e0526213
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
imm32
ImmReleaseContext
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cocaine Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cocaine Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ