��E(*@�N��8����m�:�����4�^sv~߆�Ľ,�Gi���#�@g(��O3��V�_IY���!¾Jz �;l��sE�M���/��T6^�A���WW��b��;�YW}�,����,�5X�g��F�Ժ��ے���Ef�W�t3�l�qBo�Z'v��]�0~5V�����F"q��1��!����)�$�1���K(2 �����B���*7rq$/�E�e��� �����`p��e�?��;NuѪ�Y���J1����s���,鿳�\��{�-L�Q�/�Nz��'��hX��&�6� 9k��!�<GD�R��e%IO�Xɑ��[��^�X���{a�V́� ���*��u9��%�������'��������e-����˿8z�#. �P�O�L�p%xF��i����������c1�އ4������9�6+����:��#��:#ʀ%�I�,���C���=�&���*���M��$L���z�yOD�O����zJD��S}\p/t���`&R�{<]������z~1Ht������w��m`3xh�G�*$���g��f�l�$��8�/�+�e����w�=��Bk�!�~���7"��qw��a3�C-�@�]��k����n 8��;�Zl�r�5�=�����ê�v��~�U��'���;��+F1[��W�:�Ǻy��xN��w�4��X$���oa %#T5����5����� 9�p��9'O�֩�қe�\G/�s�#ƶ�r�� �$�@�B7��C#��ul��B!n�?�+�����ߙH-Y ���Ƚ^���<��b�О����>"�u�C�,��A���SP��H���m�z��i���3#a��,I�Ɓ�=�k�B����KV�M˚�.7��\)��A�d�b����t�;���<�ʞw���?}���� �����ٞ�Q-c��?��IH����,�p�]��!���PC�jQOo��m�'�(by#�N��\f�]�l+�͋lX���s��^(�|\i��s��f~��C���Ϧ߉��:����p�Q��Ą�8�/o]���f�$�8��'���"q�Bg�g���%��)�ՙ0�"��?���t�Å���-�V��g�]<��>F��e��k6��&�\H�l���l�*0��{�����a�;Lz�� WӴ�((HE���29엔����,~������1����IP[#2�D�I������X�?u�o����|�����i=�L�� 3G�Z��bO��r�D �1�H�g)W0���A� � ��\\�:��O���i�Iηw�VX�!}��0���2��b�D�0��WA�xI�=��1b��nm���bI`��܋�pu�^��ҕ�Y���;�(��\��r4EfL7� G�TnM��%�_�%X_.���I��k�g����S��5��� �m�3\d����lW X�X���Q�b����i�2�I$4���E�_�A����c���0N�OX��LK�w�LR]��V��ܩIv���I�ij��ϸ� ��K�S��P��,�#�8���b���d4QT�1��~�<�Qy���=�w���eK����'Կ\ki1�BC���Q-kJ�Ok��e�2����,����E��1~L���һ#�AaǴG�O���F�ۼD������� C��S�-k������̀��ן|�nԮ�P��.R����( ���������Q�����=q+ Tz����=����<��BbZOS�����D�t��Q4��ϭ�8�|SI h���^��v=��lk����J��T#؞�sg��X�oz�\�����%��x�"a����,�$,���L�t�Z����а[�0S������ ������_���F����p����B���f7�� �'��ed�2H�3Qqf�Ij���M2}�pL����,H�uy��w�?t=m'+VF�0ô~�����EKz��Mgf�n�\-��6������(u���Z^�9{i�)�&d�:�0�K�4\�fe�C���%3�K{- �ԼMŁ"�K7i�$O�&���#� 8㏎��=�`�u%{&�� �����G��y�:�s�?߅fE��1�~�#�'�d����� .��2���Ol���������8��m�����b͉�#�8�W�K6k��c�g�U��}i�n?<�����*I�S9b���89�� V"mN�ô$R����������wSk ��4��v�/��K� w\���_M��d�*�dX��:����/���vu���'��$!����e�&M܋�g�@��w"�S���1���;*VE�p���<����G�38��X.�(��[l��� Qҽͼ���pr��GP���'���� �(v�&p�:�`+9}]�� G� #}\l~�]�q�| t����O�D��i��)�����l��sFT�A�ɩ����@���zy�Dz�˒Jh�� qvf�;��ޥ�:k�G�?�+X�[L7�&7����lihڼ����}P̮���<����&P�h��1;5 g�=��SU� ��`�oh ��P.� ����V�ڠk2�N��|w#�y��,6|C�(�t���|����Ŋf{ >-r�˹��9y�zT��h��M�}�c� ,�\:�åp{�f2q�z�㽷F/ؔ��@��a��b9�E�F�����4�V��Og����Qޤ���NJ�0Jo��ɹ�4T�ϱ�`��]�c3"�l��e�o�|����R�~D\�[�w����Ng�����Q �"D6�ֈ_λ8��-4���c�}DJ�]�j? b�gʀty� U��]��>ZUʦ@tx�1��-C����nNV�����C�h� rH�`���CY~�8��%$���?6�Oڬ��վ}nzǞk�|9�??�[���p^�k9|����w�9�k�0�&cd��R�QJ݀���U�w�rh��Ѳ��/�j����W�@!����V=d�AR.�G� �V�_5�����9h�7�vB6�w� #�C.��_3d�vUʦO�;&X ��64ꅥ2�_Y���P|s�.��G{��g?�.�T��v��VDћ��
Static task
static1
Behavioral task
behavioral1
Sample
send.exe
Resource
win10-20240404-en
General
-
Target
send.exe
-
Size
5.7MB
-
MD5
a852a489ec54bb1fba9054080561ebd1
-
SHA1
5e959e25072b3ece2cee6f3f62c79089dec9bb78
-
SHA256
db948e9522321f76b822b66424cd234edc3f68ea35f4c4abe4e0fb8af865f712
-
SHA512
3ec53a154c690a58f8c6ade8ce2123807a972ce57423a6ae9a366b757186802b26c689c968402fb187fa45b0f8ed88086e15223b0c9e8a6d0995ce91b8de65bd
-
SSDEEP
98304:mlMUTVo3UtZV7JtyGSWqjtnawCo1yRiNxyj9ks35YsxbeBQqQFZzjVQ:mlzVn7Kn3yANgZ5peB8FZzJQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource send.exe
Files
-
send.exe.exe windows:6 windows x64 arch:x64
67bb9fb2cd63879a3c29fba183bf9788
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
SleepEx
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClientRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
imm32
ImmReleaseContext
msvcp140
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertOpenStore
ws2_32
WSAIoctl
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
acosf
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 723KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 771KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bro0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bro1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ