gR�}5��Z)hXv:Ă����(�������`|;������:8�G����)ƪ4�T���q�(U��p%^��u��rX�&�^ ��}�^�Ճ��OH�"b���3�q��t�3�,�����Ux'��\8�����S�X�w����Ns�{R�4�T�`=g��LΚ��kS�UAXs}ӯ$m�Ny�����!���V9:c���*���b=0� هD��ѓi�R~�j��������h�\��[�����RB'����ۓ��rH#�j��2{�{�Y�dw2W<�dtt�7��i@��ʽT�`y��/. Ri��������-T!|����=*�a��ܡ�%ɽ�4ef�kN�V3�V��x�-�� ��<�J�E�c��p������6��dP� "�G���EA��Z�QJ?���q�ա.���Oa����ړ!�֨M^ B�_�u��� ��#u�����J����H�㦰�^l4��E�H?V�3�*lN�2��%3�/�l~�)D�b��K���{�8n|��s_��A���jk��S�T�O9�$t&Yr�[�b���t�F,�n┹�kœ��0B@7��#zx����6����;n�Fc9Xݐ+�%C�e�Wl�*������m��Qk�ا����ʡy��ӜY���ݙ�Zo���_�k����|�T����L�ZcL ��`K�N�;�isv��X�r;3^�ذ�i/�<*�'� �2l��J|��)�%�ДL�y�djC����9\���� �{c���%��8�f�9�ٙ���V�:{�����UM� �{~w���4�/!k=���(������ᄯ�(gϓ����URtH�x �&�v�0�y����Aq�yP�+���r��i�C@������!d�:e��.�у2�cL(�Ú\�� �Sp�7�ё5����s�`E����S̓��8�r�G� ����t������l蹠�Q���X&����;�)+���q�+�+��jZ[UX~���\�������[��je��w��PP��R\���"�H�����Y*ZV�)%αyn� S� �����m�)�sx�H�{{\H�vY8������\�T۠1"����{���DP�}�,�^ɋ$Bz�Dh6��������1�o�P|��F��O�x<�gf���c�7J��YL-�� �P���y����|���"�w���%�����`� �3(� (� ��9 �=�ƝG⦿�q0�j�U=�גGyi�/ˤ�?�#͐|�ҫ�dŞx>�0������L �`}�Q:O��X��5>�+8|��oH����]������M�BĊ�}2���o2��}YI\e|}Μ�U��9�/�f�RT��Zc���}�5}U��R��7Py"L~�7_��U��6L��[�[���Oc�����������`y���_�Y6���1m�L1�%\_93j`=gyhl飮B ��E 1��q������f��,��ͤ4YH,����d�$�r�8<�FӇ�� ���+�b�r 6k+�-��A,D'�K����ϻ��������C�� ��^��yvC/ˎ���y�ƍ� d %VZ�2�A4G};�R<��o����5��O�g��{4��^�E.�"��x�U����G߰4#����S|��B���u�-Ύ�����*����vp����H�k�0��l����G+�e�@EA̜Q���K�?���T#�'���m؏�^�+yE��@,ɟ��xKu��,)7dp� �ߔٗA��j��@N $�dVX{��= �ZR�s�OɈW�_��%c�/ҿ�Ј��a��-��j���D+�9�d�*��?�U�zE�2M���GѦ��1l��I�{��&n�z�J��0��6�(�ո֚�V��j��Ȍ���H�xy��b��e �Q�^�����yR�iL�{��������1����d��f3�İF��Z&F-�EE��۶�_�J2)1���dDroU�e${g ���1�$���A�����@�����o�+���)�g~<�Y��⨈7�{_���D!`�:��;���BO&��8��]�v�ot@�����q^gh��Ų���o2��8(BA���Ŋ[��Q��ڕ�7a%$����������T��>�$?����tg����o����Sg�Qؔ���- ��4 ��W`,�,�^��H�dz�x��V�F����J���7�� ��HAyv!Yr��li��s�5/����;ahC_�.hfDgb��@�;Q�� J�4;�h$|�"t��@��^Ѣ|ew���ym�����*H���#��lƮ2��wR� ck$�u�-�""�ζ����t�Z����3#<#+D1'�)�����Rf����$!���z�m�B�=W9��%�q�Ӑ��~j���m�.�hU��ǹࢽ���0�y�&�B��T&A�wf|���|}Ϝ��9_�B� ?����E���0K��� �1_b[�hq���u�`���W鄴�wnf�Tk5`���K�L@��J �ܱ�xY��ݫ<%=��w*oj����%��tmkq���2o Leu���Hf�W5��u�n��*��n�ߺ�Y����A���:�N0me��w>�`��0T��4���ʉ�L���+�k~9�iPd\荏�b{��奮nI(�*l*;��ă��B���P��ɟ�9���\ˍBr�${ʐI�Q��xn��:~՛u�s2����G��fr�zh||�du-{@o�A��W���Iv_i}xɖ��U~��iF��,q����J[<�Ǘ��՞q��yG��#B_�C���a�!��g�e/ '�牰S������9-*��$0dL)�d.�y$��G����ߋ��'�< �� ��"0�9�8i ���v��s&��H��x��y˒ l�r?*�ʱ��T` ��#����JQT�9�^P)��-�����u��(��)I����d���0���?+��a+���oC��9rR,�cv<j5�Vu���L2\��KE[��DŽ�������Ǹ0�״��bF�cp*._X��q2�;�Ot�S���n�kK���,mU��D�B��f�j,)#��3����6� ��lfo�W�[N�O�
Static task
static1
Behavioral task
behavioral1
Sample
xx.exe
Resource
win10v2004-20241007-en
General
-
Target
xx.exe
-
Size
9.7MB
-
MD5
3f291ae3f9aa4d3552d99bf383236dd4
-
SHA1
0ad5e2083bc6f9ddd2ccdc03aba9a19c15db645f
-
SHA256
a468cda48ead5ef87a37413f8b02b9e395955302392b808b57d34bdd3f436112
-
SHA512
1228e3eb0ab8674dccdbd044127b5877f13edb6229ef1d191a5e7f4ec37f4e245f9458b756883be34ee0fe048750226636c9b743d00366f62a21ace9e3de1658
-
SSDEEP
196608:gynV+x+Hwcay7pTUxn5VrWfHckmFfA0MMr0fq/PkbGor+/7c0a9u1NIK:5oQHwcayJUx5EfckmlAsr0fFr+HvqK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xx.exe
Files
-
xx.exe.exe windows:6 windows x64 arch:x64
9d6346b54d63fd33fc885adab75aa30a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
_Query_perf_frequency
dwmapi
DwmSetWindowAttribute
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cat0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cat1 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ