�]��R����Ѐ��Xw$��x%��)@�y�ݪGc���BG��Ԋi�'�!6\�YHj߽���j�E��0ި��]��:��tP"h_�$���G$�r@!�Yq���NŒ��g{~��r����Y�>���Ȼ��Q�c�qq�guB���,��h�uv�(W����O־h��y8i�sJgo.RN�kf��*4�^{�{Г2�}~-�4#BJB�o�T$�r�n���+|Q2 t���L�?��Z��9�>����x����H���Vm�i� ;=����}�*���7��b����ϞOЙw�a+)�|����1���ʱA]����"�=���H�B�����o;��nxL8G�Ի{�8�(h�Sj�Y��� ���a������:�V^]�KQ5��BW;�W�h�� BE��~���RW)�+���[O�!'�1����pL���L39ɄRY� ���Hh��QP�@�ĵ�k}�-$�U��:�䔣�c_n��A@*��_�gM �!H��Y�t��md)N 4b���*�h��h�xO�p��������%��Qxp�H0�b݅N�9s�Jk�c(�py+%�%��C���r-�]�aNL���,�:!BS-w��op Cx��m�����{� 2��X��l�1ZQ� �nL�.v������ h�+�����b���,�h�#��:�샮��O�J�A�~��5���<<�6d���7��þŬ� 1�a�=��<�����D��V�:T�m���O�U\H��9T�f�w�9ŭ L���_� ��NN��v8���8F�YK P�@[q�3Dz�I�y�M�.c��ۀ*R�-���t,���Sx�Z�*�}��Y[��hH��,�ۭ�0E����2�)[��ȥE��;����2/��'�W�ym��-��/J�%�E���/.���0,�e�A^���b: ��1Ťx�����{m�O��8_�mK�!P �I�x� �Ň�ö(��>�"���;�A�sFQ�_2�][�����;�A&?=��Y����D�ߘ���=�F�RB7��n@�����S�u�2^%8�t�sm���J�Y�[� �R�n�4���6V�7G�Fy�y�av�[��l��t���W/d��![���\�J��� "�֔�Fǹv��@2�G"�qʂB�}�}G��TJ�5�y��Fm�۸�U�Z�rݯ���o�����lW��x�Yѡ��v�O���%A�Ӽ�R%,CC��%% ;�fI�����������_z����!���@��x�Ԃ��ۑ<7�Q�O�gǡ�� ��Fg��G� �����z6|��;7 6pF����q,���[������g���;4����[�c����X;j�1W�{�β3�#QY���k��P��^�-J1�i�� ��Q�J��柢�W���� A4�ӣ7���*E@���pq������kG%���[����t�6Qmh���}�9,����]��<HZ�J�j �X�`���_/F(�Z2Gj������"���>����r�Ⱥ� ;_SD��TjG�+P��r�d���*s=X�E��t�a�$��������߄�����ې�դ�z�c/��QV�|�#��yҠ�/��)W�ҙ�9��̬ ��Ui�3P֟��!�~��W�hl6��l(�2>���l���G�E�XM�7����]@;���%L�"Mq��N-�H���4�� �:*�� �����~W�_�"��[|)z#E��w��sp9m�"_J;�����N�v����;�]g:�m��j�N ����`�hXY�R�H�"�c�!pݟ�lW�v�Z��\���W�.Isۧ��� {����" ��O���ߊ�.fp&h3�C�������ɭ ���Ix츚�����~a�f�dn��������'M2E�ȁ�K��������^�YF��y�D@4:�G$�b�k^�=W��|�0�6�M�%It?��hn������ &���(a�"��b�⒍�/@տ.�G��1��553w�R��Í�t)@w��C���ЯɵY9���X�A��ڶ�C"�]��Z�R�р�=C~���n���[Ǖ��8*<,��F0�� ��X��RK,�O���}����ClJ�"ͼ���z�����/�<��v!1�tJf<h�H���le&��̍Դ��U,�.X^o�(���uO(X�Y`�K�������$�q��,S��c��� ����`���e�g5�ڢq��p��s��;�jv"�S��D���T��� ���7�k."�샎>�$��x6�(K�0B���jh���ef�������_,���J���aL�k��/��=繷n[��A���!�bG!�ij��%s����G�%ha�[���?�=����pJ���@�ȣ`��ր�;�OcH͜k�Սt��P����OdžQ�_��i[dD���[2��\-01���(���w����i����� ���� ��_�����=磇��R S��}�O.zN�<�M���V�N� ��.�0O-c��z$����f'|��0��;��ɬp!�p���3�M6��+�D�� ����;��_���������x{�x�})ܧ<��xS�u�b)NB�褶������T�E�ܹ�u@v�s0!2C��}_&mZ�(��8�Xza��!�,� � &�#� �)���F�C�s���}.j����Vm����̏="��f@�3%C�\3�����`�$��VX���˔���Tc��£z����$����;�QJ[��r��;�U��V��3�h LO���ڽ��,N �Ks5K��9$�f�ȍ�x2L�[�Q�`|�Ii�0i�Dw>��������b<���Lr�Jy�t�V�#@=W� ��NA �w%�S&� ���hH�5��~ȣ"��x�� c�"�%�2�`5�2�����nx3� �Y�WyÑ*����Mo���rRK�a�Uƾ�x�?]J���.�F'�5)��a��}����� % d\F�U�E&��D��w��M�O袋�#υ�V����U���J��!{�ꂢ̥���.r7$��p5$'��u=� T���)f͵�E}�
Static task
static1
Behavioral task
behavioral1
Sample
DotWareFN(1).exe
Resource
win11-20240802-en
General
-
Target
DotWareFN(1).exe
-
Size
8.1MB
-
MD5
24ef6b0bdbec084317e1c4f707d043a5
-
SHA1
997dc5631e31a37c9ac06c0d64dfe1c18ac75a4f
-
SHA256
3f0d67f211dd2cdb8028e70c7022b2083ea05d3648045ae53c0583ef3edf1a6e
-
SHA512
ec30308414e2458fd99eca8d9e26d02777d65f6be169b2c51b9f5becd17123af7249bb2c9337121e3d15ce4f3027efb603e94ae416d17ada91fc16670e3d4987
-
SSDEEP
196608:dBdYSoiefqndeMot+FBFrDtxgGkCu10LCPv2atCi5pi6Xx:dYDpgdlrB1a10uufiXhx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DotWareFN(1).exe
Files
-
DotWareFN(1).exe.exe windows:6 windows x64 arch:x64
5ee1e926cf0c7a8d6f6df6ed3efe1dc4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
listen
wldap32
ord26
crypt32
CertGetCertificateContextProperty
advapi32
CryptAcquireContextA
ntdll
RtlCreateRegistryKey
kernel32
WaitForMultipleObjects
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shlwapi
SHDeleteKeyW
msvcp140
_Xtime_get_ticks
userenv
UnloadUserProfile
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
_strnicmp
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
_dclass
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 780KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dot0 Size: - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vlizer Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dot1 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dot2 Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ