�n�j�KX�e2�d �M����� ����@����iF��Ӭ�T'����3�Cr�^���T��K"����Wyyx7�dYAkl�������wD��)}��B�7���-�jBB� S��=-�m��Г��Qz(m^�}9�[�?-Tbۿ/'�V8�"�C�$+p�l���30n�B"]�L�I��8����Ɋ[���%���T�#E�/g�o��ř�} K��t�!�yP��١�H��i�r��]�p�/�g���c���6�sb,Y8a�ЭQ��%���Ѽ�̴4�iU2��Bx���G^�9�F?���C��7l�tP���.�nj��VmlLp��r\|^���^s��, 9����'`��Ϋ��p!srf��,��;u��琕�C�>������Y�������P�|���T�o��%�gV<0s�+��<�a u(~�J����lS�?x6Fu�Eh���3���6/�D���ȭ����+{g�W�L��cjkc�RL����3�v$]^��8S�t��Օ+�pz���'g�k��e�9��\�$pB�mJ>��ׯ�\g��q�6�����m���~̬����i�R����g+0�e*�z<1J������As�l ��U@���u�"��_����S���P�=����'@TD~§��s�d�y���q.R����q����37�D���'&D�"]��C}�b 4��Ȱ��7N�n���fdW��X5�`L�U ��B�ϙ��:f#���4�=ui-eQ(�Dn�w�;O��7�aD��%Q6�0ޔ�o����^� *)��g8�������r�¶�3��;b�7-��Z�>����Q����f.�&'�ׂ����f���c���%cD��M'�.����y�a��N��Uk��m�[M��?�8��Q�Q�%�.�$ىpEO@�0q�žl+6�����]�d�V���$�SO���r��y�58mb����[ss%�M���V� �1e�3qP����#�^.<"Yv�/&��cR1�*��b�H+�d)n|�x�K�oq�QK�N�Ĵ��� o@���"���b�Mo�?JE��("�����H���8�T{��_�@�?(��*�[�8�N��l/ԳH�@�ڠ�7*��7KUͦ����R����z1�8��M�n�P�����%�ŧ�ru3s]^�9�D�1�ُ�wcp����&�yF�fL��L�u赦�M�K���H�J�y �A8_/�ax�"*AZs��rl2�d��p�&�N���ʀo��?���j����O9�K������1x.S�nȀ��+`��U��������w2˼N�a�am��+y u;oh&���hG�z\��,��z��>F�$mI���So]�� �֬/Fl�K�>d2\c�W^��e�@��`s� P��9�g�ݶ�P��q��O�u��X�_6�[ͭި���4]�8~��S|No���μ!ҧ���]�C��Z��������j�>a �I5�SȾ�%�>,sm�Ιrj>�ӈ��`��Ww;��7��-�c�;��|��ƶ�<�!���,� ��b(����3=v�Mu���*j�O���ҹI�G��?*]�����TCC�y`G��P����^͊��㹶�T�C��z�ܼ�֢?�j3f\_��y:Q)�Q�*t:�mE��hw4zBǖrLix�(��ɪ�~�'�?�"Z,��@8Ёϗ��_ҒI1BAP�=�a%����6���1��dwc�}����K�v�w��65���]*����GFBJ��^WC��./�e�E R��������Ĝ�H�R�窂r�5���Sͼ�qo,jz<{�Ű��������GB���d�qS��T�֭C���3l��ɚ�i��;*��p:�U�AKFu�V@���߇e�O!���bIA�x"=-Uu ��l'�d��tO\_�� � ~�q&h^j���Z��m3��mͨc�ih��I����`���u�H�FK�;�h(}�k�?%l^S�cn8&������3A6�#��Hhð�}�ZN9D���O!����o ~��k�����ix��;����Ӟ{�`��'ʄ�n��1��ؗ ($�K'�����@�<n�$����H�=� A�� $E�����r"��5z����!�:�M(����je%�\���,{n$�Ճ�;>���E*�$[���%�QU�ϟ�H�ļ }�r3o�E�hVK�5���P������F������1���x#�TX�3������)��A�;�y��g�����2��z��-���a�e����+u}ۇ��~C�KHOk����v����];��TZ�֝Id0|{�6��C�ai�c�i�ls��䡴�(��c�s����HO��5�m��6��,�k��a�$7? L_B����� ��s,��*Zvt<�``K���4�<������e�ra��2�e��x��8n)7�����RF��z�6Τ��٩5h1�Z�o߹���:ЎQq�9��n*k I �E�Xd�.�*��l�+Zߔ�O����Dc�E:���Ce�\�����.g]v\Ӝ��H�b*����w0��ƍ����G�����F0�٣���If�u��i�3��1���2LP���;n2٥[�H/P�?z��p8,<�Y����q �% x��y���tG��fHOG4�=N��}�މ!Tʈ��kn"�~7.@[�0ǿ&�9�8�E�"η�nQ�/.+�`4���-��I�èn�#�yt��bgnL��Yk��� R�p����`�l� P�zO�����W�&d(��H#�8/mvP�.9������r�{<70e%Y��{4�������` FM�[%�>���Rn���pJA����ZA~(��ε�o���佼L��P�<���� ���5�L� �e��Q�W��95��G%�P�/��l��)���V�� ��� m�{�Qr����B��Tӊk��E�Ī ���e��Y��=��AҶE�Sқ�ۏ�~�j�[dIE���-���P˩#3���J��mT���.j���fF�)2ښ���A֠ƤP�V������:��u{��/��;"��L(�$�9���.ְ_�0@���^�
Static task
static1
Behavioral task
behavioral1
Sample
Byr723V3Cq1.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Byr723V3Cq1.exe
Resource
win10v2004-20240802-en
General
-
Target
Byr723V3Cq1.exe
-
Size
5.6MB
-
MD5
cb9a871f86ba1afba62b89a42d749b03
-
SHA1
08f40e6264c7d89765eee00a6401f56296d81c0d
-
SHA256
73075ddd8a3fffcb8cf648fca59ce4c83387966f074c591887c5f4d8eea4eff0
-
SHA512
eaefd3c17f4389654622f9d01489847759cc7f1c389061922152ea1c3cd9447de912fa42ef7d83b4d640bf1d82a6443786d102ec9257c0f65e57d98dde3b7b2d
-
SSDEEP
98304:mRdO+wXq63s5RcvJHnJ5UQBqiOzxjlhINM4lUe/hsVNjAx/0SNVI0kdW:OwXqL5SKQwiO1TWlUe58sZVIBW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Byr723V3Cq1.exe
Files
-
Byr723V3Cq1.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ