����* �h�":u� ��!=��W��������)aq]8����%���J�Pq^M:���8@B�MV�����4C�t?N�.#M�.�Q�+aՃ-ɻLgl��"����KO�<�����U T�)`7�k�%�A�S��5�MB��_y^�w�lgr�`��E�l�:Fg�5��������A���<Y���ۻ�J����L���eV�r!1��)�)�᳒ֆ�s��d{� �n*A*n���Xc�zs�]�4�� t�wΪ������u�ov������F�W�1 �KVUm��l���>V�d��<���z�Ȫ-�A�ԤE�\Cu�_7˖I���6Ϛ'��YC2r";Dq��v`+����5��*���ٿ� Za�Ф8�8M��<��q���,�����a���d[O��E�S������A.#�'�Z�ԀTH;M�m(���~�����,�l��NC�uw���M8��v9��X�.*��FA+6�O2�δ�ɤ��S�qt�R�$Pc�S�f����zF_JWX����Ց2�T���X<��J,�%|Z��6n�����u�p�: �����dvf�w��.�Bˏ&��pXrʻ�r���7:�pV>��q�m�6�JFgm} |�5�j�E��sa����$~u��E�ե��eyz(�"i���Ѐ����J�����#L��<4F�#��1���q����U[D������T ]���R�c��Y���9Р����%%6}�;U"������a;�E�����=�," K��jX4h��Ȉ��5�v1 �R2�K?�Ȁ¼��1��~��q>[�@O3ޚ�K�}_��u�tS\���\�K��r{R�˧Q �z-��.��������o��PC~���l��sY-X������ܱ�c�'��.�鏫kW�?�s~1��ٝA!��y浩��t���T�^��}e��@|��5���h�DK��pNt<|a�EE��������0ֱǗ �v��X�)�)jh�jKi���ip���וW&9�+zuw���ϩ�H���`b4_�^ ��G�2����0��P�v�֥n3�9vf`���n��r#J���o�����h[� N9���Ƃ]i��aUמd�ʆ�a��+����=@�M@�^�`Z��, �jj�$ e�x��W����WE�=H��Š�~������DioQ����4�ù<�uV�r����s���v�&.t�n���r�ɕ�(Q6j���%���[A� �V� �S%���6y2����)x��N,��Ev1lľ�����t_����\�}]=8j�*�������Ö́�ˊ�����df��k'���E����!4+���a�;�a��Z���ȶ��m��g�����E��J�A|�������A��B�u�d�@�L�ǃ����#��x�1y"ʥ���n��� ��������a}�lR�>f��P�Tɛ�ʗ!���ھID��ɽIٛ������ �?^�uۈXW�}xTN�2�!�G6 [w�%�&3�AD�e��Ǜ�b,l��#�? 5B��kcF��T�o����@�rH8����R5~:�x�SA��;�����=�%S�����N�JJ�n-?����6�5�l|xd�����vT�����g����:d:���5�PS�&q\�ORf�AY�0I���8��R�7 ϑv��>� ��š,�iN�1m�����B�40@e�ک�h�s�I�ܥ:�YQ�/�]T���<�$=�E���e�Ț� �i����[8U8�t���z�*ևظ�������E���MG��%Y���&җ��� ��_/�δ����@H�-9�x?X�����-0�G��1�FWIٻ�0<��v�z�t+����BD�����\%�FN��&&Nt�$;���C"K�T�܋��D�ݚ�t�O���+��� ��ET�,�#=`����A�����V{8���e~�1.�E>���,��j���Ur�joe�k�՛�1+K��B bb@L-D�:2J|�f"�v��y�ud������LC8;���t��Ey��O�-P�/oi <_Aꥇ3�V�My���GX"��֙h���n'|�����+�3�䱃��+"���%���E�Gr�`�Y�����ܔ%q���|Mڍ�$�^!\��8P؏��廅.���-h���Ket@*>#}��(�fv��a�T<d.��(,#h�����i�)��* ���8p' "��hq�C����y���):�PM�>А*U!b�+� ��.#��GC���}�Uɥd��~�D���O`��uk��$��yav��b7tq�KkU�Tz�}v��?'t�,�%��>f �$+�;����۔}�R��P����U�I��E]N�.�\�6`U<zM�Ӟ�y��S�Ka���?��@ ��'4�<7aD�·#%�[ŤƖ���j��8��a�9m �{˟�l�^�7X��_u�ؖ��� ����a�h��t�$W=��:.�dvV������eF�.PE7�|a��Ґ���P���t��������Qsީ\�dNf���0�n<� !v��1q]��n���(,6�Z�-��yB�jg����]�U��_�u{�N����Y���"�&�"%K��~O�������g8�44da�`?ߊ*ړb&�^J�b���x��[����h��@��c��]s��$鰓yA֍��6��f(�n�\��þ��$���@�c[�j]EYB�Di����I<a�m�V�1�O����:�Ui1�[�(� S.��+�g6p��usc2�9U�5P���K%p]d��I&)���(�h7��Mc�H�@|�5b %������� ���il�{���{���B���)�<�0qCtۓJ������U�9��!��y� ������B��I��v\�tV���?$!SKZ#���Z��J>��c�RN�i�F��\��h���Χ�9��R�*On8J��_|s�D��%�OSd������H��#���qb�Ju���H}�n�~�����7�N���[�O���na�/��,].�|��l-Q"7� �7���^�P��"҃k�7´�M���V>�4��_����=��HY)�Z3�KW��n�������D�5O�
Static task
static1
Behavioral task
behavioral1
Sample
EntropyV3.exe
Resource
win11-20240802-en
General
-
Target
EntropyV3.exe
-
Size
11.5MB
-
MD5
b0dc9a1cefbc083bac5a54a02429692d
-
SHA1
33dc91058557075ef6dc5248b0e88d37f14c0cb5
-
SHA256
b76402869c68a900178d62543b2f0451ff5f3106ca8df4512d9db27105dbad1d
-
SHA512
1d479199ba1265fe88fc20073b566879fbaf929580ed6b39c408267b210097b78a6d16c384238b14ed3337a4bfd9b1ca24cc3f795e1ddabe89f947b7a09d205a
-
SSDEEP
196608:gYh/zAnzRZoGevy+aplnySGw7u2PzJrP1frbjFpgViIW4dnOcZ:t8f3ev9CnSgDFR7zjIPoW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EntropyV3.exe
Files
-
EntropyV3.exe.exe windows:6 windows x64 arch:x64
fd6430271f2f16986c253db21eeced18
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winmm
PlaySoundA
crypt32
CertOpenStore
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
ntdll
NtRaiseHardError
normaliz
IdnToAscii
wldap32
ord217
ws2_32
bind
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 797KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.seg0 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.seg1 Size: 8.0MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 737B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ