�kF$� b��E�.ԅo����p�&��3E� =��$�OQ�����}D��a�����:v��N���^��RA^�����*,c-����{!w�zQ������zg�R��s�@y'��rĨ|�\1Ə��4�܈��/ճ[���<쪸J`�bL���VU������>���9.7lv�r }oU�02��ؓ�({���pD���Ļ�� �����H6��h�&�]��������R]V� �X�5i�:+LJ�t� ��BB�� "�g4��������}Po���Vd��L��ό�Ih*����mx���4^9>Nz���υT6A�p���1�ϺQP��.�}F��B��bßa����D813���pO�;+�Z���K����(D�@J�����_@�x"���J<-mm ��7�8�-��ӄ�%��.��1!���w<� 8���eT:��E�7/-���ÍC�����rN��J�Nܵ�6,���݂XH"e���<���;�ѿ��ߙ�V��0�;���~��|��t�Cc.I�+�]�L� ����K��ɿb"t\�$�lP4����r_d�L>�� 6v��Y�$����*������b���Q�꘡l:�&x���TA�\ Y.���i��o^��A9ȸ�H:�8����w'��i�l�%���Y2������驇��9@��ƭJ�p����$Lɍ_��mZ�KWJ_?�:�R9�[��d&>�i�s.]����ˇ�K�%��LHu.���]c`G�OA��n��VX鶪ڋGB�W(^�>~j�@����@���l+�OF��+-��"Q��@�r�f =��"��R��� ����J*�W�ӆ���m�x-cҤ�N�O��ʅ�?�BT_�l[�w`uW��2U���d�/���Tx����bA���8}&{�'<��3:%%g�P��Z���W@x��ujB!)�9S;���&� ��6V�����9�>��}!��<D�r�K@�XO@�;��os�]�7��+�H�LSmU��G�o���E�dт�RS���2����VH����?��aaL�����W;\YU�����p�%��Nv�����V�������vB��F�Y=�̢9��-Ժ>mp2Ku;c\J�n� �A��s\b���k��(��d�x�TEa]^�R�S��I���pi��)`.h�)�T��CFy@E� ����\�D��ن���f�D��u�G���ߖe����~Ah)���nŨ�Բj}J�?/��j�6H�*�s����!�jhK��T&��k]��bB0��X僘���&݈�����܉_�#$�7.C(�{�K�M$��)uJ�)*n`N !�|�ËP <Y�7"���d���j��� }M���z�� L!y���\��]�z��oo8�?��#]FC��D�L���τ���Cʚ������s�V�\��d&9�6��F5��q+ $c�/q�B^��N�����vhCrj��BX'�S'��_�ND$�커����&,.2x��*}�D�&(��ǏK�����{ d��`� �raz�!�� �g�0��O]�����t;�<�z*�� �R���'�vG����W��] @%g[i�<�� ��I���b��[z,ߊ\���D>��Tp5$ٶ�c{�hG$a�H�u��0��.��U�9�!(�iIKCv �+�@�=����qW8P�m�"��Po�O�!!�lְ�R��$�ޫ�CQ�"�7�!���vO�L��H����~O�s��p� f�9��ਆ�P�_)��SR͌$v�KRث/��$��P����P�9k�p�1�p��֪XDoV����v���F��de�"�3S��䂊��`s�5h,Y���5�;��49<��h�#�A�g^p��b�N�CP=�ќ#OE�{�z'�0�h�b+�[e�KH�����x�W��>�m�3����.��3�%)�(���������]p�+e�O������˓3��9�~!��k��P4�eBq��礃�f�����ǫ���r��9]WiI�y]�`>>X�b��?Oі$��BV3����S��ܴ��r%��y]-�#L�4��7D�,Ⱥ驵H�@ -���u���9�G����>�T$H�[\��d�i�+����ko��L9������{!�/�`^Y�\�Y�c�^3��9cz3�}C<������Y("��JsVt_ζ>���6h�f��ryP69��ͫ�aC{"��5��ik#���I�[V�������T�<z7�7`'��������F�|_c�3Q!��F�9��s��wGr������"�S(�_:�YB�¤��%/@a��0�Y�M|�ł�K*g3�m��ݨFɣ�D��+D�T���u�KrZ���3�3��� :S>��\�kp��؟��Ju 3v+Wp�C��|��g�2d�ׯ�ϒl��G�L��C�h��:����`"Ĭ#�#"<&�?_�(�}����v\!5�߮1�g[:�+�ѻ-M:ș���=�]zS���V{����D��^�Eo�5�J����$��R�H��7T�33r<&��:��}z B� Uc �y�%��v�I��'�uڴ���Mt�ͯ��J�J�8�^}�������]�.@�߀J�R�e��zOK`��N�H��1��q�G�xt"��fP��.V�!���U�r��ww��+�k;�ɒ;h�S��|& �C�Qo���f�� UM��5�NZ}�Ϝ��BP���5�P3���i�"���tߠ�v�/�a��?5-X���<����^�ڹ�����!�˒fx�n�� ��B��v�8?�5K���چ�h]�]>���#����~V���"���G�n�f�� ӝ�v��ʫ�-90 ]�_d���%s�$l��--u��^e{{�TB���;��ʟ���J���"m�k�@�ӹ͊Ӈ���wQb��l)��=�2&�${�"��Q����/�%�̋�ݒ��}P���70����7�/���Hg��L0�\�J}��m�E2_�Ƽ�L�6Bv!���|X���37�U�*9�K��v�܈q��1.V��8�x�fĤ�F�� VP|�1n���
Static task
static1
Behavioral task
behavioral1
Sample
90163d86c3dfda40e4579252ddaab9f0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
90163d86c3dfda40e4579252ddaab9f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
90163d86c3dfda40e4579252ddaab9f0N
-
Size
6.8MB
-
MD5
90163d86c3dfda40e4579252ddaab9f0
-
SHA1
00ea30919c1e1529581cf66d7cb9308e2ea8d070
-
SHA256
e0c49b377007837741950e36909ef14c955725126e337f23bef349118ed0e1fd
-
SHA512
36b2265229e009c885b5a7ddd541bccb6615f3fddc44c9150c903e243ff847202dfa3fe329d510676977b46d231e76a1f1277a89b53397b518c0fd22211ef609
-
SSDEEP
196608:AjhYLYvPTyevG7qYjCnshgZhhsGVgX9i2YxbyfYcM8:ANYLYv712mnsmZ/49i2YxbyfYcM8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 90163d86c3dfda40e4579252ddaab9f0N
Files
-
90163d86c3dfda40e4579252ddaab9f0N.exe windows:6 windows x64 arch:x64
a4c628690aab0bd206da38fdb7ab6ff0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptDestroyHash
ole32
CoUninitialize
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
d3d11
D3D11CreateDevice
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertEnumCertificatesInStore
ws2_32
accept
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-locale-l1-1-0
localeconv
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 475KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pgorezq Size: - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pgorezq Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ