��������{'��[T �/����XFD%���k0�9I��f�����F��$<��k!��Q,��UC%W{_�A�!f���nmݳ0"��·��#Ղ����DA�z�Υr$]ҿ�+\Lh�h��u�|����ډ���z�H�ҵ`��H;���G�i���mT���RG�84;�}X�'E����6+�X˹Y0z�-0t�E��x6u���N�u��������66'����bT�QWFNnnu�=D;iXŜ�oB]������i[D3y�YF��� �e"t����Qc$p½oK��}��.^ @i��r�dי�# �2�S�z6=��{�����v�v���o��8, =wo�r�ʭ3��Uʪ#�)�I�P���!�)�Y���it���`���-�M�~"���T���� �ʆ/�e��K���;U�0�m��ˣ��{��<"b���G=��^8�A�E�C�.%���s���q��$�;֫��el���ܖ1���ci"�\l�'��w�hw��TI*s �������D�B�0��.\)?���=!�@���D1)�{�|Q��$�.�o����M���&S!��hi��_�r��!�mnc�x���yU����Rfs��Eq��M>�w� us�u�Rh�y_k�܈��Yf�akM0�gi���쿍]�Z- �?h��3�,�7,)2 o/��Z�� M��ٓ$�����G���о�q ���B$ߞ���hn���n��ع<>j� �������<�:�h8Yx<QbK���m9m�N�����������<c�g(����Y�A9Q��2je���] �(�ލ�����_�Ϥ�o�+������ 7�%�^t��d��(�[� ����nm��ԉn'~����wJ��8v�4f��;�5!��wrL��U�k�%�@�$u����G*M���Ո��<���W���Wa{�^}*G�/Z�44k�ޖ�ڲ�~���/��A�A�o)�2��mޚ�5��v}�-�����OwA�e���J�|����@;���3��}�dol�se��x�4������s��s}X�Պ��KIc�zg?����ܲ�-D�4�"L�0��R٘q�{ ꔕ��nan�N}(�f(�)��p`�Ug?�:�����!�(S�G����Ι��7!�4��%I�<b��@�I}~Y� jc�����YPD�F�����cv_�-�ޓI���ܴ�`��>� �nAK�yi�Z�zŪ�=�}�O��M6����Bn�C-,Ӣ�s���M�;�:ڔ����Yf��)z Y�Q`�h�L�js�K�a���tiKt��5<�}�X����>fyԨ��c6�$�䭈Ku�g:��0}lu�x�Ȥ:5M=��v��iX )���O���u�Gf���J�$>�J�'�4���D�zw�� I/�VT�����t��9���I�H�����EMInp�:��#[R�}�-��)���$LU���Q����?�o��W-� Q��F\9U��mCNeVFM��S7$�|lv�>�tD��YDax�y��Xo�&}W�����n�}�TU�?����]�@q� ��-{O�|�f*�Ed5NS���.�@ъ��F�B����.EZ���X��vl���%W�~dj��B��2�_lsJ�]�A^�W9Y]�5R�/U�Fh�@�DJU�(Z�x��&�"U���z C}�Y}1�)c� �c�2�R�~)�g�+Uۈ�8����r,�F?�*>����4%�v�Ph�� �0��J��>���Н�����A�Î����<�VEɬ����&3�;L�O+��)&�JyBڕ��(%��*�CA�#m�<�*;��P5þ{�b�u�����8�R%C8ɋQ�#���F�@jC؎PP������@\�\'�4��j^|��U.b*��M�Yq�Ƚ4�jA�����P�o% &��������c�-��Q�#�삮a��N�����u�L�*#�SuW������Oe"���"�!<�O�7�F��ϸ���T�B|��� �y�%6Ƨ��jWT�$���� ��ܣz/���>�#,s�4��Q|7�cu���f��c���"�T��Ѱ?{������#�Qwn�mWpPd"j��C��6��5)o����q+c�!ofp ��zo!�;f��b]����9��;�Ɏ���9��1IU�(����}����3V.��n�K�j���������-�d� ��z�#O�H���0f ��0��M:O���K�l��t&zV��Tf�zL��.P}�D�f\�B6Ogw���q��f�H/{Ys˳���슼�N�'������A�|�S-G|0��x�mK~"�p͇���IpmM1V,�����G�C��W_q�9r����](�����]�oƀD�M�J�`W�������Hy�=L߫�|�^��I��^��w��w)އ�H������`�m�VAKoD�Bî5R���j{��Y�vh��^u�r�.މ��d88��8���{`ܚ[����c��+�|��������g��"R�`,I֍c�-jB�p�D�V�zQ���-�`����ڪI���'�ݸ{��+XM���~(Q�O�W���0�f�3�Ơ!�==�C����O>����m�����hQ��<��ߟ37���%��Pjn��`����X�����ff����H˷�{x���#�0|��>%I9d z�U�96��?�����GՖ't^pP����`p'�"�F���BGMO���9Z�~<��uͰ>?VH�g�T4�-~+&ɞ�7X^��t�.Z�T��Ƞ��4�|}Q%�8���OB�x~I�zk|�5�S�X�K�|6@_g�0�3 X幱b�ސ��-���fgp҉�sgm�JgH���|�<giLԣԤ�_�>�������p����2�:H�K!G��ifo�d� ����U�v�ys���ha�b���ൢ^�\*i�`�~�����"��yP�"ِF5���'z�ua� >|�p�rl,o/�������Sw>�t���>*��պ�9����2��m��_��.� ����n>��Ʒ���\eC?M�����q��x1��`�M�a ;e/���
Static task
static1
Behavioral task
behavioral1
Sample
OW2-External.exe
Resource
win10v2004-20240802-en
General
-
Target
OW2-External.exe
-
Size
8.7MB
-
MD5
774cea623ef2a847cc667f1a87eee33c
-
SHA1
2ed3170d00ed2edaefe485f61f91dd2350569ce5
-
SHA256
fb5d524d148bd41322a846d517479045998c3fb7d9b74f58bd0ba5e59d4ffffa
-
SHA512
4b769dc913b930459a366a83f5d9d6678b05058154ad522ae3273ad20625642d21a0f360cc7e9e0457b41355e2f9c73a337c3d044eb336ff21f5a1ce79bb54e0
-
SSDEEP
196608:QROth48INKNuak6Wurxytp21GRq6Rn3QktmCD:QRkINK3k6W0221GRq6RgMD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OW2-External.exe
Files
-
OW2-External.exe.exe windows:6 windows x64 arch:x64
Password: 12345
4c6944bebd738ebf665fe95fb369948f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetSystemTimeAsFileTime
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
shell32
ShellExecuteA
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
winmm
timeBeginPeriod
d3d11
D3D11CreateDeviceAndSwapChain
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertFreeCertificateChain
ws2_32
closesocket
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
ldexp
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
advapi32
GetLengthSid
Exports
Exports
Sections
.text Size: - Virtual size: 829KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Bvr Size: - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
..=P Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mDC Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ