;�9����%��F��o0D�����AΡ�6���g14'>�`v� K�Mf{t��5b/a�vߵDJC�:�����رϐ|�Nؙu�=$�(`��2����f5瀲4�%��� S��$��!�iL}�i��!�h�����\3���!<T���&��5d�2�����ϋkQ�ːh�����Ž?�x=�l�L���!��������<4Ng�����-�ӷhb���g�`�K �/L)|���0�.��)��N.�_z)b�_�:�W{��\h>�����<�M�����^0���uf4�ղ%!ǚ��\��>R$=���Y�DDA��O�Q�a�N��9�et��Uz% :bw�0=��o��jO}6}�/���@@pQ��ܨ�3��5�S�&��#��[y�<�:I���={�C�r�sd�A�:M6�9͕X�8)ɓf�$�[������:��I���S�s+8��I�vY��g����4.N�b���c�J�篾I�V�(7Z�W,�v&'�Al�\�:'�SCq�f�)pFp��U��QEnR����AQ�4Yt�.�H$�e]y rBy5hh���\�T.�_�N����k��f�)�+�5�((T�DE�v���ӭ�I�ꩧ���xAzweo����7:}y�p<!bBj=)���J+4t^%���{��~�p9a, R�� x���.�I���)�t�0���6�B�:l�h&�AT���f{T2�-����A�⩱\�8[5��᱒U�/��K���c�ϒ+����\gL�k���� _�?�_ �\��ç����VǼj7���P`�;�{P�����@��j�����}��$�h"���"��Щz��.XH�N��CD����d^-��<������|G��4�z���N��t�F�T6��fƃ%!����w���$y�>3�h��h#,$��q� M`���T~9����B� (�����o<�F|?ǃ�)8x�$�-T/#'w4����!01����|B� �r��`g�^Y3�0��c�����I�+K�3e����lr"�iPq����Й��T�y�_��슯�02C�� �c�D�j[(�.�ݍ��w]tkQ���q�I��`9�Ny�~��-��>f���yM���&�L�J�Ot�00�]p-Klj%[��d�����H���5k�o���,)fX�hO�h����OD�4�j���b}�>CjwΦ� k�qzkL�M����q�稲�>\�����e��(�hH��l�"�w�M셳mD�4KV�]��� ;�����S4��kXS��6��DfH�gb���<Yu�B�kzY��i���t�I�48V��"�bI-�� �N��#eOT��ڏ6pli����ZTQ3���)�ӌ����+�� EN�p ʿ�ͪ��L}(~�zJ�,*3�ŭa�r�B✟6��l�J��ZOp��^ �J/q�����i�QLC�9}�N�e�p��Q���N��u�����Fᷝ�܌q�_���8�k�@�7q�ڊ���[�/�[��A�:{��iЀ���jE�`C��X�{x���q��a�I矰� �p/h7��1�>&��|IR�E?Uo�.���j>�VE}Sr/�����D�)��U�ܢ�: �������գ����1��b����\����(\|-K�3�6�0��y67��p�eu�5���U���)��D�[8��%��;"����Բ�t�gX{0t&G~�p���JG�����PS����d��L����������[�>*W������-��s8�G���gF�q����x`qz��ofi�:��r�� ���#�L0�Yxj�G�y����ǁ���A6�6'g�SS+a~?p�Ma����2I��:�z���(\Py��O�Z8�(Ķ�L��&���:�e�����������+�~w�x�K��v0��1x��a��4�"~n4b\��^'_��W4b����خ��F0'����U���ѡ4r��ES}��9�xҴ=d�E�I5JW�⍢c+f�i�9�KcH�My�$M�}���}��a˝8d�'�h�k}G6�s�_ӕY�_�8D1�]Y�R���m�]��/��:����STӌa+��m@/�$��>�u$rX\�LN�di���n�tgՀD�7��?���.Y�Ra��^�����nqS.$���h�(�9�EW�R+�dM��0x��T���b�������wÇƣDW�1�<��VeH���r?g�p����A�A�]OC( l2��*'ɘ���Co0����H"�TQ��������Z��K� �$Uc?�9�6�-]8��B*-����i���Z�D�RC�t}���OW����6تN�����:˘3w@Wb��bÉ����+�Y�&�ÆP��ܴ!MAQ�����lD˞h�W� hQר̂��b.�������-7<X32���g��Ozz8A6����^�-q��̱�����`P �CBO�Z7p��ݨ5�X���P�����T\�TqyV�>����$Ҍ���l(��;L�]��b��?eǂ�i U�O�=J�g���tg%B洿��*ذC"X;�2�B�+ﱲ�d7���J8!�سL�{Whf�<�'�K�S�V�3����q����5�i� ڝ ���?7���F�����"1 ���7{�|Bp��R��S��i�4U��L���bx����h27D%)7����鸤������n���!�����=I+\A���3�jMB�+�u��i��r�������ϡ�dN��xXg����8��7%�3s�B�U����)���&p�/Y�M$�K�X&�DZ�g��R!�WJ�t5�hT��Os�=�p�1�6 ��uia�� ���B��68F7����^�<����z�:���:J�Xks4��5���u�q0�W���wBx8~l8JL��5*��hl�N���1^t�n��:^þX�fs�y~eӺd��Y.=ׄǨB̻�%�3=:��Y��T��q6y;M_,�?����g��E �j ����)��sUY���0���@jgx�2�3����gw�_s���bo��J��D�ZY�X�ߖ�����,��|f���@��9K٨
Static task
static1
Behavioral task
behavioral1
Sample
efd1d58d3d6994e5c1b908368d6780b7afab279bbfc71222ff4008236dd2a6d7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
efd1d58d3d6994e5c1b908368d6780b7afab279bbfc71222ff4008236dd2a6d7.exe
Resource
win10v2004-20240802-en
General
-
Target
efd1d58d3d6994e5c1b908368d6780b7afab279bbfc71222ff4008236dd2a6d7.exe
-
Size
18.9MB
-
MD5
3674835c0c82ee1f923b55574318e79d
-
SHA1
12a29e3f9c2660f579d8cba90fdbccb88c8caab5
-
SHA256
efd1d58d3d6994e5c1b908368d6780b7afab279bbfc71222ff4008236dd2a6d7
-
SHA512
e8e7b3a5527845f1bf7b6ce559bb5f987e92a39113f2182222328f30c5105e5609555587ea7c3f5d99782ed70e9e00a18bf1450993c3aee956b331674857eca9
-
SSDEEP
393216:H2MfCa7dO2+/CZoopZxW8GKmTVfpDr41PoFl0Vjn26Ee+52:WM/W/C6opL+TPr46FCVT26E3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efd1d58d3d6994e5c1b908368d6780b7afab279bbfc71222ff4008236dd2a6d7.exe
Files
-
efd1d58d3d6994e5c1b908368d6780b7afab279bbfc71222ff4008236dd2a6d7.exe.exe windows:6 windows x64 arch:x64
a83d0a6f9dd076c6e78f7bbab3a96933
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
WriteConsoleW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.@?F Size: - Virtual size: 16.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.^@{ Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kJU Size: 18.9MB - Virtual size: 18.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ