�����K�0 C�GO�JY��� s�k�W�������r6��Q�YC�d�fܾ� ��p���v�KBq㏵~ ?���W��o�N���zE�m�F5���hr~�Y��L]x�!�N�]�b ;�ƕѪ���������[��3VR��� ��'E�L� ��o)���%d�S���T09Z� �Kd^"���*c���7 �Ϧ��lR���q�73�U�N��7�UYR�h�F��jc8 �B�Ȟ����m#C�$��K�p� ^�-�ã�� ��:37Qn�������?gy.f<���EI,�R�;Ӟ��qL�Ű�q��]�����j�=��VW�m)&E�ˠ�#?��&�xOYMO*����� a��B��n?|`��p�ƻ@KTk�d'�C� �G���Y����Y��:++�!3��IX��[��N�qsi䣶+����p)�iU�e�a�|/�0���D�ͬ��ir��jx:�HZ�(%�9��ŝ.���ݠ���-jQ�:��\���K��c�n������p\�e�� ��]�!��}�f��O\h�҈�k ?/��ڝ<{���g���,���g���G���/q��Ќc'ic�~]�a�>�^�L������k�6�=a�2�����l�t���M*��Iz9(hgqie�c\�K�(l��y�Ǵc`���n�m����.�%�n��Se��U��� �l��N#���f����C(�OˇD��g$�T�a�݀�?/j'��7 �q�,�X��C��S'��! �� ��2�{ob_G�ޯ�X���_��^���+�jX�v�s� Ӑ���ns �%<��aҳ��#�����d���/�n�=�s0�P�A�uf1F�-���(���q|"G������!hBm{)����8�g�O��}g9'��[�o�Y�[X�a�p! ��G��wdh�v+���Ͱ�����$���Ț��$7@��Y�,�����W���{�x�����듥gO�PJ�)���a��ݖ�B��l�?���I�>��G�6y�!mԵ��u-�$�����W 5��c��4���Ԥҕ/��<8�u~T�۪dI�b��*��l�tތ�<0��26��-V�G{��MB<������u�oz�x��S�R�)f��2��BKv��.lk����(o7L�(�w��}�"�ԞlJ��ƈv�P$��J��<�����-����&�E������n���M�?�C��s����IdC��T6���/b&�:s �NC�ź��Ƨ6~���`x�{"<�B �n�̙��R}F�A��c^���XwR����W���!Y3�__g��Oj����_�r ��{�)�s()P"@%PY&�E�S��� ��s �,UQ�km��v��k�p��t^|zk1�������$� �>�{�<���@�wU�Ug��Zy�]+(%�k�ٽ���6&�곝�*���R�{[�.?�:���w�����n���cɇ�"#�z����¢������w�3������������=�Ǭ�����2�́�"�^��ˋrR�i��K?p�Q�5[2n�~-1۷ ���-��D���5q�:3�s�3��TC�����~i�U�U��1����d��B(X��M2ʣ�U�r �tf4�p�}� ��?��*�~����Y���븳Q��k � �g��R��a���iR�?���m����л]V����ػ*(Ye�C,� q�Jn���>q#<e`ɂ���r[l��>�q{U�S�����z��T�[?����t�Fc�>_��Wܒd��G;I9vUw�967�r�V�mWo����5��@�@l9�����6���G)�ydu�8;�L�x���R���b�u���jC�+W l.��,^�E}�8����|��՚���:�+u:hJ@���&:f6쨝���<�cNє˵n�qk��#�A\� �@$�L��]�k���h ������)�\� ������$I)�2U���صT��;D�3�&�l�m�yoPtĢ8O��g{5�*pd"���}�fU�c� ��k�q��z���`z��0R��˱�[x��n|�gs��eaM9eI��<���$������Bmw�!�I����Bg�������kA�U�-ٸH/����;0@�<�p����P)��@�C Ü&g��=��=�+��,�l�G�7�������J��jxPO؈4`j��m�szM>���>�?g�Tg|Z�z���ї��7=�l�E�i�vD䕥 w��à�}�@�S�sM���:�긓�0��#�qI�|T�� ��v���m�t�N�A�����e&-��n3��n N%�Y1>^o���2��VX|Ŭ@�V��>�E&��aK+0�E#���#�k�/#���Y���(�.1+�\J��K �>�6]��r"��ʆ�r�J"��j� �Fyp^�|�C������R���2⋱�6<Q-J����)u�e���3���^Y|�6U؍^�sn�������3��]��4�9~���[Y:��Vd0�{��ߩ~V�-T�9��/k�4���OnY�3������=U7 �;sۗMWÂ�,���b��,��+����+;p.3F���6��Q�"JWe!}�_a.���w�3ǡ���W@�0�R�Σ�A�G0�4�a��"o��!�q��+������*f�粛"?Lܙ�7�s|���k��p��F�����6����@�w{�S�N���hi{�֨z�y�XjuDŽ�45�F�r������b ��)�y[��9S���?Mu�CCݗ�]�������o�p�f BLx��Z�|cd��*�#�����������Xղ詗-��!nl�"����u8�P4�vSLr͖({�_�`hO|w�K�PplI�!���8�)1?�ԍ���P�]�k�L�T�(ኹ`wh$�+� -2�xz�&i6�'�d���؞� ��}u[<� _@�&�S&:�#���p`�H��f=/��S�>MOZ��kzb��9qx�9I����Z u�S�+�g[)�3��I}�6� �4�G���&綛��. �, ���aޝ&>�-w ��c�����u�^��˷��1��� � [�7�=���c?_�4U�7��
Static task
static1
Behavioral task
behavioral1
Sample
308d1035e075e49ceb4b117aa3e5ea00N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
308d1035e075e49ceb4b117aa3e5ea00N.exe
Resource
win10v2004-20240802-en
General
-
Target
308d1035e075e49ceb4b117aa3e5ea00N.exe
-
Size
5.5MB
-
MD5
308d1035e075e49ceb4b117aa3e5ea00
-
SHA1
388a5c1ad64892972a8c9c0e0479921c7fe7768e
-
SHA256
8d08b53a3403994fadcf2689d8b1727bd66553a5011e38c029fbdea956de091c
-
SHA512
e75b4e45d1b54441f1394d11220dcdd416285d30716395a770619d225fd3ab02bb0b589e578038f5548d780f95c7f04ab5c82494fc81f6df6e98db4a7bf48e70
-
SSDEEP
98304:VYjAYGqRd2JT3MPOTlPGmfLKRep+Ex27qTSr9aNQNYeJCcRTZRf1s0V4ZP2dCE++:VY1Gid2JrMPatLKRs+P7iYYeJXZCd62c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 308d1035e075e49ceb4b117aa3e5ea00N.exe
Files
-
308d1035e075e49ceb4b117aa3e5ea00N.exe.exe windows:6 windows x64 arch:x64
f5879e61cf92fff949fc070d9357ca42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetTimer
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ws2_32
select
gdiplus
GdipDisposeImage
comctl32
ord17
bcrypt
BCryptGenRandom
gdi32
SelectObject
advapi32
CryptGetProvParam
ole32
CoInitialize
crypt32
CertFreeCertificateContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 684KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.200 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.201 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ