�O]�%��'�8���$�c%���/��6�F8��vY0���sߧ��Ғ.�� �6y� ѡ�ݛ��� K}8���52�ځ.���C�'�OX;���a�����6�'D}3 C��mH��<|���T�`V���h�k7���'�1}��t�?^&�������t�����R�sky�o����2abQ���H'�f�g�ct�|�;5�ٍcp&��ƨ������?��9���^mF��"�-1GP�Q4����D�����;�l�y�F�� �]E��{S+l�|�S��i�p�-R�tLbޗo3V�Y '!�l��ƚ�d�z�ۈ���.��D���&0K��W��ɰQ�� ԉ'8 �a�F�X�Y4��9F@�2{��Ky�p��ȋ�a�����YY�C(�L 2��O{Yq���4l�"h��ަhO������/y�9�g�0��<�S�G#�d�t$���Ej���%�ޏ�\ln~��e|Y��t��[<&��'��Dž��ה�5�ؼ+iĖV����[7-�{�М�KcW��t���n�2���Ԏ���� #���,��meʭ��9��+O�S���e�C�^T�Rz���`|ne�����;�8�]����~�ӌW^rSH�^�S�I����U�\1��� ��"F��=(�F��o��:jn�[�� (��&Z4^����vM7�%"w�������0�Sn�P��8R8�/��|����<�7��� ��J�z�k:OȲ�(��EB����b�.`]�C8�Y��7�'��@��!��J��o]��l��0|\ږ�I ��D�Ld)c�dԑ+��#҆��bO"����(T�9��$ �On���:jpm�˘d�z �f�?B� ��y�Ca+����� d3�AX[��]����(�ǽ�%� ��C#��0#j�o2����V�"ۋ�ղ%�,u7%D���m�?���1�X��"�S������S�ڦ���ցKe�3nd���§J�#��^{�����E�k{>_�P��\4�Q0tk��o�((�u9��g�8Q:�F��7ԟ*�P٨���xk��.�$�����A�����ܱ(�H�7T�c���� #n�6l?-wt�ڇ���Gk~�[�2�9P���[m���Tֵ�xp���(=���WO��D�pfM�|{�1XY}���U��`6��>:�b�}�-�;M�_;n#V��x[�$�J��z�GU�ii�/3c����[b�Ϟ��>�w� �9�DL��c.<wX�a���`M}�J��K;�l ���t��ɲ� �TE8m9�P�l�I=������������K�aA�H?�x��^;E��Y_"H�b�훌���^+K%6ra���#"�=yGq�>bG�ٿrO�}���#�D�jx��s8K�Df?�"��.�r̼����;��E���)4��4���Ʀ^��v��0��s �}:����i�u-��T���N|NܢK�E~d���G�7e3��9�ܣ3��j���Ŗ��#5 �ʳ���=�~� �У:�m�W����i$��g�A�e����}E��s��s����z~�?&�O��)�ī]p������������!i����\����(�����+�����^3D�u�l�ٓ��/Z�~+���X3�~�b���p$��L�k��5j���GE�p3K�?�S��!���ȠP��K���ȇ����a���h��B����=J��.WI;�[N0��';���e��*NKx��i���e>����P���n�U����簀p�K�C�O_4�R�Ms��Ƌ�4J�.��pmYOO6e ����]odW@o� %��~)k⢇a%��ĨF&�ׇޛR#�X!dž����0����P��o�X����G��ڶܛ��n�;��,,:s+z=Jxs����Hv���~y�?n����N�mw��o]e�� L�+J�}ә�3x�H-��QTH��ÌPyo��*�Fi~��Ǣ$9�)���ùdrNO[�wau:P{K�4Vka%M�I���~ �Q͌e��rhR�x�WS�ie�hk�6���=������A<��7IŖ{qL� ��4�l^T��^�;�Q��=U���a�r�������ڛ����w=Eײp�5m���7�w�� Sx=�/��`J��{Y/1�t]�1�� `� ��ƠbV��FX���w��V/f�9p�ցq.�<�U���qF:Z?�cOrb����%qR��R>���p�6�Tk��1`����i�� ��������c/� >M��k ����B���q�Z`P6r�0�Ô��R��j���^�z�Ѥ��Q}�=}�NQ�$> ]��i��پ�]OV� �������R�����Cn���c�)�w�@!�7k��9E��$���D��BL:��G� ;�s�����|o �8�Go)�ϻ�R}b��a�R�e�K�� ,|�ư\��&f̅5�/���)40�G֛����wy�\1v��@4T���b�Q��U)Ʃ�����Bt���c,L=.-�P0PW�)�h~��u�b��"s$��,�0��Xk%B���ZA�s���y$)���t�w |��j���.�rz�K�xV5���o���Z���՚6Zfb1M1�c"�-��c���'~�*۽d�0\�?��p�Dh���R�������>��:ˤCHP�2a`�S쪇Id�Q'��&"�撀���&Y<j,�k'����� �w��S쪻1��%BM�{��K)3�����$��^Xx|^f-�������R�SͯԈ����Ј���Y�}[}��x���?��8g!9��Em��s9u���.X��@�0)H�����g�օΊ�@Y��-���?",`^s� �ג�/�I�e�O�#�]x0�8���K-��nRq�����%-S_�m8fN�����<D叀U�(�{�� yI�Do�)���5��y���(N}�Yh��G�� ��)9+ͧ� "���z�����eo~�v���AjW_,��oe����,~"j�a�?���L�a�l7�h�X(��O̔A��@t��r�D�O���P�t`}�@�B���a�+� (t��
Static task
static1
Behavioral task
behavioral1
Sample
1999X.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1999X.exe
Resource
win10v2004-20240802-en
General
-
Target
1999X.exe
-
Size
8.2MB
-
MD5
24790e160ee441c20b15aae0d823d700
-
SHA1
22195a33a0f35dca0d3a4ae0ee1c5a4158eff111
-
SHA256
07472a30d618b3d2eaee4d4cfbc12f0c8175b3f5689eb8d9cc91c22ab386ec71
-
SHA512
3104e614c719a64962b6f83fdd13a9261eb382468da2f9d58b7abd7b2119df2cd6f27dde8263153781aa1f804aba423f285ba3f32d27bdd7700a864ef8708392
-
SSDEEP
196608:G52++qcv+BesqK+lKAbXWSQdAKXx73bkWwol:Z/jJlXTWrbh47ol
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1999X.exe
Files
-
1999X.exe.exe windows:6 windows x64 arch:x64
2673b72be480bea5c760f0281c9f7ab2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
urlmon
URLDownloadToFileA
kernel32
SetUnhandledExceptionFilter
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetForegroundWindow
CharUpperBuffW
gdi32
CreateRoundRectRgn
advapi32
GetTokenInformation
shell32
ShellExecuteA
ole32
CoInitialize
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlCaptureContext
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertEnumCertificatesInStore
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__intrinsic_setjmp
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
_get_narrow_winmain_command_line
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-filesystem-l1-1-0
_access
Exports
Exports
Sections
Neto Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Neto Size: - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Neto Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Neto Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Neto Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Neto Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Neto Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Neto Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Neto Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ