����lN&|�"�B���y����U�yA�<���m��b3`��*&�&T����X>�NĖ��䅵4�)XJ@"��^�zA~M�̍��i�p��ZN�i��V�9@�j�o���� Z�D���g\eh�=��b���bSɾ���'/_������+���� �30��|�����:�H��2�!MIC��}�h�����2=��~�v6 .&�]*�!�"����;K���{q�G�-��dX��/z���!�@ED��l�I�V��G���S�<��6p�_��C���ܾDc(��7Aʬ���mF��4fDP�$FP�`��'�5����L8���l�nCb�n*�: ��)^@�7#��sE��uiO�E7{rфm"�LM$֎Ζ�M췕^ۥ�ƪ��k��RU9}�2F��s�Li��|j(� ���!)}#g������F,����vه"�J���rTZU�+7�)�K�B= ����W\m�@39�vQ�g��nso���h9�@<`?G��=WP M�1��r%��͕ׯj�7\-Om c�sL4��~��������8���ã�q;9@�up;�b[���O��`CX�k��J�����i��p�'��H��h*�Tg;uԮ�����lu#�_3-���$� kL�9��G'�������ӵ�V���%��~_$踴�c�x�2�%�D� b,:-1��n��������BD�����a7f�Ol�ц�����' �,���r@7�hB�@A3���j��+�a�Q���Ʊ�����Z��g ��� J=���}ǖ���I��닐�������Bu�_��-n�Px���W� �����M��r�� �D��B�=�$���eU��a��r�>��%��i�Y``�b���SکU�u�����z�WM�&&��ſ$�p��V߮��$�I~^&��v_ͮ�V�QC ����b��~�����,��%��x�����r�ݏ���]���� �9���C1.=A���@��K��.�H����;���:���,誏��V{'��:�T��`� ]<d�7vJȪ�@-\�"�cf6��0�%#�1qAh�����T)4r\�x�.�W8�T��Y̋���M����p+�K���iqf�����}�Yd�8��v�����+@�o�@�����|�Mx=L��k���� <7k��� (���R'iroߓwX4y��)�H���#]�̽C R� G͐&p�$$t� {��"" �˕3�R��6\��wv&�o7+!�Ю��Z�'����p�.9+���� 0:F��|M=�V`�ң�V�?��4����a�X7���{�X�������k�z����9�@�w��$Xg!���A'ԋZ�'��l��w0�b�����~��*b�Rԫ��0|��p�O�ᇉ��[<F�m!mS���0?{~.� ����3T;j'�]GJE4�-n�M�l�r��KDa����ŒK��2����EFW���yC�!:C�F)3�+$��]�t<���)�g�"`;�=<��e�'�{LKǰ�H�>��j�}�o�0�d;qn�J �%>�Cug|�` Ҡ�w�W@?W>k1]��5�y�Ag���G�g���U^���C����l����+?��A��-�N ��C�-�����zt�2��B�4��F���ey���TI��.̗�<�=G������<{���{B��q��=H�[j���������ﻙ���z�#c#-�z`�y��c�6͖�y�-K���%d/O�f� 5�s��{��;E�-���x:�/�H&���T��Q�����C���2��y�i�|�7�p�d{��86��n�� �-��������hmŽ���]]�%s���%����ˏ���:�j�Ď,%��v��5����9�����R�$�S�^��~RȠs�<�_>tSF�N~��w�ی}\��g����߲5�f���\���- c�5�ޚEu��Y:�D�=wpu1 �d�J�mŻ����3��{͐�[�Z<���<�}Y��Q��dSʞgU-����U_��ؾT��*�Y`x3�z\&Pd�ɢ���(�� �n�hj���V��H��vW�����-)&��kHOK%q�U��_�Ot�Kz���w�a�"^*����LZx-��x5�D�g� ���H.�弖�<��wn_�9/Dz�`���L> .��o�Yd�X�������ɴ�`2rS�I �m��l8 ���l2�N��e�"�Xdw���2�3}^DDt@��P�����YO|��5��5r�ʴ`ob������!��U!oմ"P��'ӏA�Y��/uUfps���G%5�d,�B*{�̛R���֮�H���5��p�^~�E���ԝ��A�N2��i���˂|�Q#k]����N�o�C��3�x�'z��I%��39)���ֈ�w���䳒�BxOͷ��U�$�6��X���6��($7��#��\��� �D̡ ����0g<٬3W��[WN%�M�j^��J5V�4I���u�ҡ���Su�[D6:�v�yɥ��kj�_�.�r2�`U����%��=;Y�]��.�)m<�6V��a�aH[�EGMo.�2p I4����ۅ[��kߠ��{��)��1X���l��%���ݜH�J�sQ^.]�b7v�Hn�j�c��L��}ʅ/����<X�YR� �q�M zlyxP(�`�U=o "O��M�{�*@�F�\���_[�B��_[�o6���-�?��f!�侯��Ν��8�k�l=�5����.��D�+�\���y6'S�I�� D __���ڜ���me{�2���� ��������?ƫؓh����|<����0�M�R!� )U �.���b�z��_���rH"hų���q�q�� ���?<-M�)��1,��R�;��G��<�/y���� �T���nӛ��$>�?��d*j��q>��5m ,6����?��݈�9���o��z�S��q�R��ɣ����c`n;��,R�Z)X�����[�{�Y^f����P��o��E���xg�&�uk�~v�RF�:[�I*llO������3� X<d���6�1�~�N[:�$$�Cd2�Y�7�9}�YIty���
Static task
static1
Behavioral task
behavioral1
Sample
mask.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
mask.exe
Resource
win10v2004-20240910-en
General
-
Target
mask.exe
-
Size
9.0MB
-
MD5
830511d481d3b0d9e73f8475159ebee3
-
SHA1
b1e8c1ff729bee0b8b25030ad93c8076ae455912
-
SHA256
11ff80946d298ed531925658f63fd09dfb3a9d6c4a36cee57bbe569b9e378be4
-
SHA512
36286bebd361d66dc7213dad9d09b218a98a3cf756d22962c5992ed67b86099c9865a3f7c2b5b240ffee87ec9c273454314f08df51410f0f916c38209ab4d199
-
SSDEEP
196608:3m7O9QpzcfPkdpnW55tU54pPWxcSp202aoe3B:3CO26Ap74pPsckt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mask.exe
Files
-
mask.exe.exe windows:6 windows x64 arch:x64
0cd9bdd01f2c6db2c6a9c9ccc895e0d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FlashWindowEx
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExW
opengl32
glTexImage2D
winmm
joyGetPosEx
dwmapi
DwmExtendFrameIntoClientArea
wininet
InternetConnectA
urlmon
URLDownloadToCacheFileW
gdi32
SetPixelFormat
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.akr0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.akr1 Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ