{�Yk����� _ZҼ���hbzw�{�j��R���v�u�u x� ��[�6'�ـMA����/:]�� �A/���ߴg�С^LR]� �L8��5���@�'�� Fi�A��N��n�I�P�JP�2㙔䯙��� L���A̞ͧ7�ؘ��8@�)Hnt�?��'��$��4W�8J"�K���m�g�ضOO[ 녎�.y�qi���M��h������~cV1�ȧ���ٱW��feV=��̋�k�?�J��(?���6sd�*k�e����M��a2�n�L�ѭ,}ӯ ��ԣ[����)�#1�4n�?�s�� C�_� � D}a!R��?���.&��nFo���!_*� �����1س��:D�'�o����~z]$q�T�YdX�,�HS��B5�-b�K�����vO��mg�i�?�(T�~�G��4����P ��M��\�1�nq�(��$�+�C&s�V0@p?u���� ۮ:��uZid'��_E���+;K��1Q!FQL�6tg��s/�0��-��yRH�����HJc� ھOR#���}���t����H�� [����'��Q͏U�2�=*z�7/O�+����}\9��?��?�����Cr��o�= u������Vk,���=x�!���0� �o���N�v������#h\A�[��u"��*rx��P"c�� ]��������сN�ݴG��K��N�e`g�T�`�m�Y���b���5���e�4��~��X~��`�L��<�Ԗw0�d:}�dh*k�d����E�l�����?[�����N��O�� r ��Л��)/![x�r7�?3���h��G��j-��r�'��֖��� ]�~��PeV�E]�`�j��5��W���Dv�>QJ��x��Z�W�6��1��*ߡ�˄�&�W웆����FD�U����4�Ex�i��h±�����̠��[pܕ&���BM|J,�%q���TTM�ߘ`�FAe���͐��k��sZV8 hM�S2z$:)W�;��N����J��Pe�ޮI<��K��[��=���(o<Kg�7Z)�>Q<��[T�������ON���aI�b���!�������� �WVt��<�=.Q��i��6c�������jQ�t�� �q�ͭV�G;yA��!`��>B\�y� g���a||;.U�� ɕj����DTxO��k6 ���T'L<��V~`CJ�t��A�Cd���j��|�N��V��D��Rӟ�ݫ���+���#1�ʹ�q��qJb�?ZA������v*�s���O%��Y�%Fe!��j=�|h�e�G �Cd���Q|��f�fĭ���7�m���|�7>�2�$���-l�L�p>�Ż�����8��?��N�=wn�ik��wphO}9�]"���I {؆�lG�w�9)�M��K�_�o��O� ��Gʗ������<�Yh@��36&I�|��dp�o��q3��\�y ���Ea �Ԟ���j�8O�eƨP�sj^�X���ݭp@4�ɠZjX��.,���=_����isV��w��)ou�+�z�9 \f�z>u}��2�@�@�=���5��+7��^�n�. B<��ks�v��Yi�]�(E[b�/4����,��Z\�D�����������9�ڎprs��~�R��x2���&R�����;��!D]/7:͌g���+��6�؉g|x,Ѿ�ECXC�]�a�yRl$N{�9�8�����@��'>M�Y��L� ���C��s����~��$b\L3�����5�W�Tw��/a��w�k<�K��syAv�N[1=0��h-vGV U�v�i_c��:�� �γm�b3��-��.��zo��W5v{}��"��pFh�aH)�`�k�lo1�-�:�B.ǍO����{������5��ۢ[s���qz_�� ���(�0�������\l63)Ch�gi*�����w1C���U�9����l�'��ۼb����{����#qwb�7%#�|Ӕ���=�g���������O��?C���$�@��ߓ���Y�N�'_�������H?'P��MD��n��u���WIu���;m,% S��Cϵ^*-/��F4)�A����,7o<)|����Y2"��dm�:0���q���@9X���w�3��w��?'(���k�lp:�M]������d�����Nj�>]��Y�� �ID军%�l4?�X�&W������N�̝�i<�Ḯ,D��mCɻFwc,s~�Z�v�Փ��A!�Wfb[�1��Y�P�/�ɂ��#���ɵS8�mI��C�h�X��W�Z��;��}����z��S8_����\����O}�\�s8�^6+�?�(���r��CH��1��zS��g�� '(�#��`a4S� dV 8��=ݠ<K蘹C�m�&�-���$���>�Ŷ-�S �?D��=0��kWW��]Oz�P�I�R��RW_9��Z�t��:� ۮ��ی�)Ll��s�,̹9�6��Z^? ���C�v�����|�}���fў���m��6fOx�U!���-{0O����s�D������-c,Ni��� ɚ�X���O���@�ܚG�(���y�ëj�͂e1�Fm ��ł�o�Ag�`�����{��]�*lD�h�lT���9dT�u��ҧ�T��i3��ΎB٢��������.�s��ꐞ�!H��i��C���>���d�=[� �V�>���A����"� N��-����_�K������/v�8@OG������z�'�L�}y26T�b-����s�2w���}vC������\�˫�s��,`|�{3 W�cl�y'�iji��հ)�#y�ː:��S)��j�%3MDR�p0K���^N��Q-T�kt��X^�̓D�V;��!���lO��i/� �(�~Fd��e���A��p���Hs~���K�u<#ȵ>N$<]��3"��5����薘���8���7���w��?�D� ���{�힞(�'\l��?�����ȟgЪ�5��,-Mauur�i�H~<)a�`��ٚ0�h�k�s��yD�6{<�&��:�% f�3^���-�>�*��f0$�
Static task
static1
Behavioral task
behavioral1
Sample
Byr723V3Cq1.exe
Resource
win10v2004-20240802-en
General
-
Target
Byr723V3Cq1.exe
-
Size
5.6MB
-
MD5
05396b1d29a97b383fbd638b1f9355a9
-
SHA1
34123ced194bfb10bab574555784e4bf43b97c8c
-
SHA256
f7b154b559d43433246b75a5294f260ecf11a1e03a77264b037c9d54a14315da
-
SHA512
b4de31b07c9dea35c37ec4ec5ee7eb4d46fa6a25801238ee36e859166f7f46dd033dde0abcc8184a63209e9d69a79ced5103e2a97f1d0dd4827706ee35c503bd
-
SSDEEP
98304:ETIF0v7xEkVfXhspQU9hP3P0yM5bOxetYqzxiU6WCTHXqj97sWl+0xGL:ENvqCfRsa03PZMceDMU6WcI93zx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Byr723V3Cq1.exe
Files
-
Byr723V3Cq1.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 461KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ