oߚ��w����jN�iݣr����M�=O���q�a�a���9�M�[����kJ�]�ʹ��7��Y�Ig9����ᇭ�'�<d��҅�t�q����?J_Ռ<2#�r���.YPQ ̟qZ���c�����y; ��cU;��-ĥ/O��Vx�Q����\Yӕ�E�Ǹ:���й(��L���]�c\�� wf�U���ްU���{aӗ�F.�y>�N�a�0Y��c�/��8˸�a�p����E�'��Q}�9�hW�BFp֏�˩?4�0��w�iy/z��c�\��_��w�.g��8�g�U�7Vo��Y|�����M�-;=��-�ko{Z�{��K�mbpd@�<��f��i zO�愺A}�NRs:;��r������:6 T�ʭ����rU�X���9Od_��>4�g�ş���|�xuNm�"I�~�e��� �}w��� ��"4���;en��N��dVb�g�����ML����-[k�FM��������3�$�9�}.�����oT����.]i���a������ߠ?0�g[m������Zb&�J��g) �s \G�3��A˾2.>5����m_/�k��υ�}�d-R���P5�[��8�^T�%����Lس��k���dejL�֎@�8�`� V��R�m���HX�DA�*U�^���>v�5K�������c�!; i=�`����E��6ڥ�������E��`� �x�TJ�PBbb�*J֛C�@���!��n�j����Z���2(�+(-'{�Vn�5��6���=����I�ښ:\_�X�+��4*�,�f��?Y,�G`���3e��|���E����L��<���4�z� 5F��)һ��i���\@�g�̜�R���3����&UA=G�$z�T)��a`Ө�fPɞv��i�sμ����f��Ŵ�hCM*N�t���i�a-��qۑK�Z�X¦ġ�r��(������}� �4�.��v )� d�_��;�e���#c��^��(*R�d����������\�#���Ns�j���ܮ�3B��*�NL��~x�R�_��~��>�v��������f%�� ݙ;�x�=n++�����"��Zpc�LI�1� �D<����}r���8oS��w4J�R7� 집����&F4Eg��x0R��%��G"DW9�Aim������A��d��������[��O��^;���k��vGq=[��.{��E=�8�<Li����b,�!Ru�Fe�Rp���V������$�PB��&�����p�ݕPC������ F1��,ss�+��O����ň�j7�G�J�4c-b��X�{>���D�+l��J��?�]�� �����uQљ@m����u+�l����s�ɸk�ڪj���܆TW]`���?��m5�����%|m�>�^��U��[I���~�}�gr0��F~v��0�������O�S��;P�f%kS_�h��nB@ ���+i��/tQ�"?{x�؎.+��<�.��Ⱦq#�/{�b�R����YZY��{-˕K� �h�Sg�Y�2e���?�ئ6i� ���n�W�Uۈ��S�� ���1��hG�����n���o���7,>�'�u<GUj:�X4�|��!Jm߈_�I�k���jV�X�;���Y� $d��~��aUl)�V+�9��n���frK�6��S� ��r�Z���>�x��ߜ���7�@ɱ%�6$@��\����,v�nh-���(���!��)����a��P#/�a��ѳ��/��7F�֍�������T9�T��YK���1�j��_��gP�*JZ���m�>� Ë *����u@��J��|�����Q�\���N�q�̧9t�!�B<�fA� �2�7��N- ��H�n�a��UK5���(E�eg��d$��G7�s����|�$��iQ0�/j��*�H6�Yz�5��y���a�1����"iQb����9bsms����G�1�|�o)Úd �VA)C��Ưi�������u��P/RˇՆ���Q��Ș�Rp_���H~˒�F*���d�~]�ҷ��`�4��{�X�`d��(3Ūď��Jx�-aZ���������^w@�LE�O�>� ��&�Y�ܝ� Mƌqp+���Ig�⅓PI�a�;ѷ!�A5�Y$����8�u<�-O���K�$W���V@�q��Ϝmv�p+k����ٜ��y��R��S���:����|�U#�W��$r��_klh^��&���b��廛6��%��g)�sN��M�\��������ኋ�%�n�#�����g��H8�g�ɘ,R]��Z�d�`TnR��m�Y˭uSp�b�Zz��K����R������U��,Ä��� � ����f��/f1�M�`uVk�����Z^�����?�)���8檅�E�ޕ2>��v��r�&E{�g/��NWY b�@z��L�H�j��eUX�qTu�H�{���ۭ�F��<� H���1�dj�+ބ��o��A=2�}k���J�dhŷ.�Oz2���d뿑ۈ-�)�̟��SJ���=�J�F]���ߦ��&��D���eE��˚gRr�p]����#�$l��Gm9��튢* |�|�5+PV�3U�����Z$Ns5����n%��B�-�y��s���P�ze�cZ���O�t�����> �[�o˪Bo�����Y�)58�*9�횾�4f���G����SEyf8t�"w���ijOZ��uh��{�! �4!�R�!��8h"Ǚ��ĭB��!Nn�3��)ms��Әsm������Az���j�r�%�0%�܌d�R��T,^(E���^ɲ ���!�I�7�����{�r�Q����}���}W����'�N���t˂��[[U�Y���T�x�П���:�R%�͑�C�'��wP �HӔ���j6��9���>7S�]�52�^���>���b�%6U�o�6(|�;���{�-z�+�|���p˅j�2���-G �3�vG��M�h�aaa�K.��f�BW-��T⾷aH�����Hv�#C15�z�`_�NV�
Behavioral task
behavioral1
Sample
gNwUozvwFwDQ.exe
Resource
win10v2004-20240802-en
General
-
Target
gNwUozvwFwDQ.exe
-
Size
18.7MB
-
MD5
534fde121c133944da2818eb2611f6ff
-
SHA1
61730ac988cfbc8708a131cc0ca527f45b0acc9d
-
SHA256
0914a170413665df0266fb5802ff192bb0ee5bbd547f838e94c03eca1de57ba6
-
SHA512
d2399b686824a122a5318ac800be631e6293afabc6146d29ebd48cf497cc7a04d585f2bfbe9aa963bf617bdf54e857fc2e913a36203b6a53a6e8d1ff20685d20
-
SSDEEP
393216:mcE7f9dVl4WiE4ww5DjaUYndX8p19ADstFvKBuTd0:mci6249Bu839RA0h0
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gNwUozvwFwDQ.exe
Files
-
gNwUozvwFwDQ.exe.exe windows:6 windows x64 arch:x64
2278a975cb46dc4fce45a94431483414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
ws2_32
listen
wldap32
ord200
crypt32
CertOpenStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 18.7MB - Virtual size: 18.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ