l�]8m�~[t'�ߞ�M�U����l�L��n�wk�7z�Ƒ)��yP�v6'W�Zo��)��������+>�EeW<�u��j�<�h���%$0�c��PL�ֻ�DLP�i@L�_�:���u�pn}�EfX�:�p]!��}]&��5�!I�L�L���[gy�k��܄t����oU�"��>"��2bf@M��H�� H����C���^E@G|�A��=>4�����9�%���H ���� Ts��b�Ni���h��r���g�D�nT������O��ptΖ�c�%�������j:��W�H�[��YP_��C*D_t�7(Ж,�B�Yl��:DC������}NR؛��bM�P��� �)�*��/� �g����S�Ϟ{Q|ʗ��|��'ӥ���3c�[�!�?��2�z73;�q�Ԁ(f]�^���g$������B�����QV.{�F�}��pڂ�1\��XYJe:7��P����L� ���!fh �f�r�m_���ֹ��&���[��6��!�~��K��R��Y����@/��i(N�g�A7]�o8����V�g�B� �lEZ �v�/I,�l÷}��>b��;��Z"��~��;NHF/��}���_�d�q�b�ba0'�/(NU���r�jh��tHU[��B~9�r�����o����s������D���>yO������u��nډ�⟽¾rE� ���(�k��ڌ&`��@��̏?R� Gn�i�/��;�o���������15kK�����<NO�K��p���C��v0On�:�������̷�7�2c�l;L����.e��o��<�ɖF��ƛ�� �{�Zo�����M5��)�����(�>� _a��5&���W�Y;���Lj�?n��k��.{�����Ʃ��Vɂ��� 17�U��=��T;�+:��o}DO=}+z�(�U���јZ`�h߄=��VG*�������Z�U�o�v��7x�9�jô��|��*�*�3�ݯpȝl�}�������<�(Ķ�����I?c�qo�q�`���a���T��}��E�I������Q�L�Ug����A���A^���fE����?{���m���֏�3��A��B��-�f��J��SS��z���h �x@�< o� ��?��O.���G�6ꚕt[�c��7��Ӏ��"r%�7�e�>xKϒB]��lI#O���� I��]T�"�G4��{��$�W�����V��ϢX�#:�� +�F�J���8��s�RP� i���^vҞ�2� p���%5A7���\�T%D>^e� ��E��[@g��y#f�M{;4�?m|B0�7��d�� g��P��5϶����S�_��"��`�yQlw��u��� |$H`@��tEZ�]�]���{ m�q�@:l��v��W~��|<)J2`�OF8���ޢ���-�����mQ��xp�Л��0H�a�j�zsSUMVxM����F́'� ɸ]�#��3�H�`�*uP��BV��c��@�mlw]s�,�@ԯ�e4�N�T�6j�[�Ε� ���?I�#|(N�)n��V��6�Z"�O��GJ���@8ϕ+J����&�5���;�z���.���"T��*���|X��:���2�^G*X�o���a#KF�N�F�Ғ��\�����E2���gh&������&m2�D��-��t�zR^_4=��Z�D���>��.��p2��z�� 9=��v�*��r{�_$�Ң����.�+�2��>��:�.�,Æ���,�gąx}�Ϫ��tzv��ٺ�}*�o���[M1z%���KS8B�������*gkQ���Л}s��f��D-Yg���8����Q�u���H�?��:=�=�&6��д��7U���Gt!�b���D���p3: ���w���e4c �/˘�^�" �>x����LQsΰ@ #��Qu�/� ��6U��Ca�xSyİ��c�q���s��W�(�'��DR�,Cö�x�������n*6/]�g���/���oj5�F�����7�(������K�R�X����� �[�s��[yCw� �7��9W�U3W{�BX�T��a���f̶�s%�O^��R����%�3�)!�m�1��QD����-��V�k�2����ۥ}=�G���4�D�!���~`t!�j̈́o��fnL�=g?e���S��� 9*�(E*�Cx&�0�{��Ya�>�����r�0V�9���*Y�of��+ݲCL� LH��g����l�\��EVF�R��e�&�}� �D(�mLo����Nw��D/�g�À݈�[���JF���P������� �n��. �X3W�_E����J�� ����e����,p�V����!���8]/�)v��K�.4Į�W�Q�Js��3X]�g���Q4p�Xqj%����]�Ә�2.��|�#���|u�%ػ��3���;"�#Mt�AK�qS`� OQ����d��c��hr J8N�Y��Y�b�L�A�sp��7�?;�O�I4f@��qi���� ��:�ږ��;3�"ӵ/������_(�a &k��5����)�EI�tG ��;�������J��O������WƳ[[j���&�U�8��%�a}w/�^����Z�T�r�H�e��s���oOa��'���n@����TG���A�ބ��g�|�ք7�]!�8&��$ڐ�sF�Cx��x������gu�u۳�8yg��^y%�1���1� �;!,>u�6=_���j�Q�eC���$���0k/7A�^p볊�K�9��h�MG��X����ӓ�V)���}VT�AF�m$�РIa(1j�eHK�{�vsL�>���`���!Ӂ&^�jK�ܻ�����)����1P�{�.�m�%�@A��]�p��u����#��7���G� ���|!Z���?�+���;鎼��K�/]iI ��}%,Z�sd�W�x9+�_�͐U� �u8�_ycT?9},� �T�Q�a�9N�2U�n)�3vV <�nx�L�%7��O�D���gո���ZR�ʀ���Ywywqb�}Y��2�>�������{���e`��fj
Static task
static1
Behavioral task
behavioral1
Sample
956cfe75671296ac9aa4b309c9b36df2a2c92be4c374f103adb603d54910a844.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
956cfe75671296ac9aa4b309c9b36df2a2c92be4c374f103adb603d54910a844.exe
Resource
win10v2004-20240802-en
General
-
Target
956cfe75671296ac9aa4b309c9b36df2a2c92be4c374f103adb603d54910a844
-
Size
4.9MB
-
MD5
65d161846e9bbb3fa429680aa631f183
-
SHA1
29cd76020c4e49d55644c2b7d5832b48ba4e8c95
-
SHA256
956cfe75671296ac9aa4b309c9b36df2a2c92be4c374f103adb603d54910a844
-
SHA512
9a3c03c2a2755b7f8f0acd3166be7b92132bca4753ce68b65850f58cc4613ee8d4d7bdb4cb61dd057331f274b36a067f41e18131059d130d39832709e9a75b21
-
SSDEEP
98304:DHDmQemJ9B86LW9YqV35NNGwIUcGsno1I9D9McZra0XN:DSjyndLW9YqnNkBnp97ra0XN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 956cfe75671296ac9aa4b309c9b36df2a2c92be4c374f103adb603d54910a844
Files
-
956cfe75671296ac9aa4b309c9b36df2a2c92be4c374f103adb603d54910a844.exe windows:5 windows x86 arch:x86
873edfff01eafb8a04b0f8e283bfa622
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
ws2_32
WSAStartup
shlwapi
PathFileExistsA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ZXDCFBHJ Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ZXDCFBHJ Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ