oe���';J�qr���x�Cl����ᩈI����J K��4�%bLӥc�c�V�!U��x0Ϙu������᧭��� �©�X�A윢��%�q��ӆG��E�q#rWm�C�wW���A�:pdiૹqK���jjֿ�} Af4�}�B<�`^a�^�J��.n]jJ�J�f���|�!�l�^Κ���l��#)q|�Z]�?)�;����S� �u0?\�$��H�1���0����Ku={�, ��[O$RK�E��Y<��=Ɔ|8Bb��F�/ƌ��'�`p;��������M(�R���:�y�Az�'�� u��r���Y����wV����GJ�H���4���D��R��$B{*9��`f�7*W;��qXw� 3\Yz��E5g%�j?7)Ch���*�n���Q����d��w��M�xB�ͬ�$��jͣ7�� �%6ˁ�<u�� �,q|̴4��;x�i�ć��i�$2�^س-{����^h�:n��|�NxUQs'a�ulE�����Y#J� �>�q��I�>ݝC��qZ�4�k뜃o߉�'�� OT<]E���$@�q��8��N��R]�Z����!�0J�*p&���Խ�\0�I�X���,��N]Q:�vxQ�C�]O&�Q��ٮ!�sp��C���:$�P�s:Y��j����d%���urNГ�}����ڍ t����T���~��J�C��@g��M*�7�_J'>� vUY־��Nk���#.� �G�У�`)1����� �m[�U�x���kGO)��W�. @����K�.��Ҹ�������!����q���=�a�[�>̥�!� D�� &uʷ�ڿՃ/2�7 ]ی��7(yru��8*9�'�����S�@q�sB}�e>��f����#��{%�L�;]�`Y�k0!6 ��1��A;�����1G�XSp#��C�g~�{���7}BVƵ�1\�i�+�>�A6�t������ ޥ�J��/�MT� %�p��mG�}�g�Nk�fS��!���ۍ5P��$*ߌt0��e�T/��P�"���;�0d�ڏ�?��./6;og���-��O��������2�G��V�y�����:Sx�\�cq�������+.Dsg1��^c�p��J������i�������bdl��v��G���F8:��O����JN�^�a��{������,k!�#����<������b�Z����������h��>A�T_��r�9���C�yo����K j���z��-���m9j.YHi;������g8�����N-�<) �|?�O��z_�x�<`;�Ei# �k\L�c��5�X����yJ�����\`�'KS� rC��%���5=����_�Ht Y0;WLY`'���uT-W6[]��.���os��I��Q��84e8��ٷI��e��������/���y`y���0�2�֔-zu��ʖ|��F�JN�H�ah�U��"�Ѳ �94uܛ��t7��E�噓��!�,��C����Αmx�k�z�f6M��]�6�w����I%PQH*STWv:�Y�-�����5�[�O���x^��I�E��w��.K�{ V��_�?Ky���9���u{�3]�WTCm���� 0�2��b��_���\���y-��X�|�?)���7��N�����zSK��W�i���\sal��j�#i?q���;0� U��@������&~%Y�F Ձ�k ���j�m-�x�V��9�H��G$Q���T��%x��ʿ�-������t�{�����c���moDφ�"���-�����&��!ț<mk���&�n�RN*��?��DW$�w�h�^��Ҍ��}���}�!��Fz����2�l�*Y�u�o:�H��� B�*T�}8�'��?��|��:�^��_W#/�9�}"�,u,-�h���:�\���/"ؚ�� Y�I�w^��wX?+5X�ɑ]ڦ��������[�I�8:8z���8��F�����'�\�髢��<��Bo��G�����_=��(����gD.�#k�֏z�0&�2)��>Y �?��I��y�������m�؇F��m:T�D>h�V��!ze�3* �!.�M����2��������T'I�b.������;�R�N��3;��6 ���K���+G�y�����f����H�� '|����b��V��G�'�����VMA�@�c�ȶ��Y���Qw9�����A���>~����=I���F�DL����Z���M�{bg�ީ��b�z������/&h����"e\4��]�ն�����C���#N�_E�c~�r߅^�z����Z�Z�v ���h�l�j}��G���;��Ӌ.M��U��9�c X��E �Ͻp}w4���̗+�?����כ��yN4�'Pj��:Mdԇ���C�B�~�}�t4�9�j�v8�����u�l�ݓ�˴H[Z��6/)Y��5ħ?�^/8�)I���;Pd=��S�������% ;u�5���BF9��CR�/��_�jzxad.����og}����d���`y��1�N����^��m0O�j �Q�]�<�Fs �c(�bDt�_yx� ��/Y~�,��j��u�M��x�����>�̤F ^�Ʉ[0T���mYD�$�-�S���������2 ���%cA��=��C����W.�K�������n|��dU��+L:�>�S�D��}bz�Q0sWe�bv�c]Q��� n�'^���.-,�l̨��\X�1�u=�?/>�+b�SM���FEL���^�>@�a�4ls<C�P��B��ݼ��� Ѻۡg���N'����2����́�5�!4��IJ:w,���+:���%��W�Fm�ѧE�@RpZ��X�zy�-�U���H��ߴ��o�>�ŭ�x�ć�] �P�p���'>�KX/c�E؞G��j�n%{�����oK,=�{��ȣ��1��:�̚��Jڬ�qM6�'}�z˃��)[@��@�$_��I��)��VQ��b����Iہ�C�
Static task
static1
Behavioral task
behavioral1
Sample
bJeu73V3Z2.exe
Resource
win10v2004-20240802-en
General
-
Target
bJeu73V3Z2.exe
-
Size
5.6MB
-
MD5
56e3e9a636b9694f8dad8be266941e41
-
SHA1
303bd579868acab369d5c9d7f8dbac027b1e6400
-
SHA256
799150a14a7a7d8e95d7dbd96cb6c9b182d884438aae8d4366f286e192205fc3
-
SHA512
504b2f7e568cf7dd96154d1e4daf7b6b1609d0bdeefc4798f4f80f665fe2fbee7c684869ac23dea6959735c6976455406f745a374edbd4d9d0d520e38de478fd
-
SSDEEP
98304:yVQ/sE5eEN5swAz1+SSWXoaR+di+2SLM1ypAiyJJN0HrrsTSFae5RU/X:EQ/LEEkwO1VYq+divWMkpenNwxXO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bJeu73V3Z2.exe
Files
-
bJeu73V3Z2.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ