�d7t�H����f��q.n@�<&bA���&��c��tv�%��|����ZƌL��a��Z*C"x�'"f�.�]�)����${������3����8��xf��7zi� �"E�+*���9a]^SS ��A��+��V5�fЍj��F/�*r��'Ú�Ɔ��?� �x��]�����?�чn���p`��=�WAܵs����/��K�u����܀4�3�mc�[�-��n �j7���w����X³�ޓ��AS�a��N; �%�[��D� �Q���u�)������P�-�r���sة�]]�-[���rԅ�.�q��as+e8��9��fv�w� -W[ H ���Bo�. @����������|6W}��Y�r�qDo�R]@f/�z��2P�Tt�V�&fz�:��xm�#x�8μ�[��f�aJV��bj�V�N/UPeʸ"g�9��r�U��|9���V`�� ,>w�� �h}��������6&6(Y��� !@�`��r��n��Eb��@��X�1G9X\#9F��l_�W�������d���W���6��Ȓ@�D��$��&����6+�t^<�<������R����@W��14�[0ۛ�:q�C�&]BS��5ٳ��� �����/���#���IvU����rv�"�]����kZy���"�x�]���8<BmZ���VՎ9kՕ.������ n���P��r��i\~�^�_�"iҪ.f�̤����=�%��������ῥ�{���)��*�q���B�9�����0Y'۶�}�#�-D\���YLǃ�:q�/�B����i������1�N�\�i��F�R����'� �=�F��/�cC����FNy&� �5�������@v���9�Y���Y]�J%�5�<�Al�܋��(y�~! K�x�v��h�f�Gq��|�n��q��:lc�#�Wx/�0nb�7��Y���8:#t��� �o��7���㹢s� pDZ�WVz9x���Yٿ���P���I!E]0�q@���'��xU��Q`ZL4D�A�Ϟ 7vU�rJZ9mJ@\�z� ���*���hp����q�d���a��G���<��6dߗ���̒=Y�J�h�ɧʴ�}=�+@;jK5~<�lԈ� �Ϸ͇m����8QVs�%��p������o�Q}Ҁ�]$%�ވ5�o���|X�!�/�;������g�$��lֱ�ۄa�̊�(MSf��]�������B� p��Y66A�^�N!Lć��e�!�MǍ�X�(���b8���ƺ����d�ת��ꬖk���-V6��UY������T,�,B�z��ļ��Ek��>,�Nf��3W���^�����#F*�t����>�.HD����a5֙�81��c�/�1��DT��+;O9�o+v"^��{<@\$�"6�/r��⩵m#�D�l(U.�Y���xЍ�{S�������ɲ{�X?��=2���?x�DT����Q�w��ջ������0c�O�B��v2V�A�`2:z�Q��,�{�����e H��F�����i|�)q` �C��b-�� =�����ZU/�~oD�A�z|L[,��vr�<8������-g�D:��?�����a��x�P��h��h���=G -�s�ͼ��y��Flc4�'3��_0Z���l��Zr���7�x-/�glrm*���eacM�{��e��Y��3��ٿ�#���#k0p��o�C��� ��H����3��1��d��.�&�dz0����L)�Xq@�M�~$3WY]���t��ы~��dO�8�Ϭ����O>L�D��:��R|w=��b����o3 �z��Y}x���Ii��-v+���m$j���t�A��%�t�ܺ��������ѽs��z��r��xirn�%�6cΒTS�}̷k�+hńV6ٝ�[�l<�N=�t{�^r���'?v����'g��"k��#�Wͤ~|9pd:��} �R�CYL2����j0������ ��)���g�y� ��$��=Ԙ��a�7X���j����x'04�3*M��j8�����ٶw������?����ꢍ͞��ף�ԸYH��4�������q1+�w�����u ``��>�"��1���v5���b:��o�K5��Zbڦ.�?j�~��$5��j�a.�]�Р�����c�P5��X@Q;���b���S��Ԭ�GQ�@u���")o횞�z��1_��B�]g��#����&Cŷ$A��}]�Hh9"ş`���=�o��_��n���@̙�#�����\\������:��c{����A�f�#ܞ�r]m��/�# 8v�W��CmUY�q�MӔz�a�$����d^g��I%��<%k0������� �BDZ����sl^S*~Ew���X�,��+� 1�F��P%�K���N����M������i� >���3+�%��Q�|L��X���^(�zNsuX�2uitjxr�� �Sl��_ia�B&��^[=��~N˰��Pa��{L��3���~q�r�7�#}�1/NX�<�n ��|Aw�{4��j+�2\ͬ�1r���FV{��e(�a�������Q�D�)�2��aj �� �n�V����L�GMƎq��R"�^����ƟR·�"r D�!��+Q+a���ԕt{���M��X�i�����``k/�C"k��hUJ�����)��pҝh��$|��}�n+�{4��/��?Y�#����T`Ujųu�T��9QZ<�.O�����y��B6���<��s%����ĺ��k;�4m����i<�����u�?�����i�Ba-8�8z�-���)ۉH~��Ǿ�Y'8����3�kKIm�3a/5"�I<I��e��c�2 y�Smg���sZ �w��݂���wչ���8E=S�`���2 ��V���V�g:*��ς�|�]>�%j�BUq��\k��Z~���`7�a��P��Y=�_S����w� ����&*�Xp�>��Ŧ^WEz�[Ԝ�_Rp ��=P� ���
Static task
static1
Behavioral task
behavioral1
Sample
u237cgatAh2.exe
Resource
win10-20240404-en
General
-
Target
u237cgatAh2.exe
-
Size
5.6MB
-
MD5
fc6e0a934e7fb7153ca700cbb5fffc35
-
SHA1
efa3a695b85e6ac893ddf645f0410007f2c70b1e
-
SHA256
b6608b524654d2dbc1d726cfdc90906d0ced2000966937a4744b1d0f8e45a8bc
-
SHA512
aecb6b5d0001e820f18edf70148d7f042d4e53dd0616e362dfbbbd36443f46b0be4457956207c0a50f00f8ef0f06a78af0418f027b084e3e0c24d56954b7c92c
-
SSDEEP
98304:HAyKATA4r29noELU04nLD0/DwyH4M4DHoOcV0cohaZLD+xvGSxKjPBEo/c+Zs99f:gyKWA+Ano2U04P0/DZ4HoOcV0cw4Sxv/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource u237cgatAh2.exe
Files
-
u237cgatAh2.exe.exe windows:6 windows x64 arch:x64
Password: 1234
f75d131d22af6fdc1e06278ddd14334b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
Sections
.text Size: - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ