j�⽎��c�ޠH�W�@�cz6)�{QF\~^�0� 6�LE༐B5�y���#J��d�X�?����:Dh��+�� g�����`�N7�P�g�G��K��D )��/��O�Ѷ��#V���и�����k�r�l$� k����|q��"N�K|]4v�W@�`���~ɉּ���7����V��5%a! ����+W��x�ѣ��S��j� ��C��\��\�Z+�vo��my��A�]��'���0��b,����6�v�������!$�r:#�N��`�q~x�No�p� P�D9��u_���%A����eo�%�O@����b5Z�� �ΟĭɠQ/M���iM�y�<i^��-gЯU!·�� Y�������W� ��Շu�U_�J����ܽ��3�C��su=O�>JWF�4bedW���Z&SB��V��3�S�S �d������*��E�����7 ����_��cg�C� ��\�Dt���ʸ�͓��zL�P<H����<j���?��EGȞ�� R#|5�J������s� �wj�zv`�CJ�o u-L+i=g;��V��25� ��ET�B2W ���y���G8�Q$�*�'��"� ����J���%ߗ��(�f� ���Ha)w��V�mR�>M\�zE���o�)�m�����я'��]m?��*��[1�����M }����� db�`�2 ^U���z���T����!N�I����,�Ч�F�n~�n�/fS�y��*�;�eF-X }�T�rf��ow&�*bi?Hu�WC�~��"p��g�d�+PV�����0�Д�a��N���� ��q�}��%Я�c�R,rW�֠�y�����%�l�1V��¢ʸ���9) ��������}�W�p�dk���yV!��A��N8b�w�B]�U$�>��������.DTTV�Z!�^|3����3��P��yT�租T��F7��"�zC��8��:^�sܨ$�ѠK�+��v�6��iƐ��(Uz��ieΙ�=|M��'�;��}����J���������y�AܗM��[�x&9��e��vP�lTԅ��˧h�Kn�Ar���\P]�n|x~�+U����$������KM��J�bs>�g��HS�L��zB�cQ�<f[�V#� ��ʣz�Ȃ{���%]��3��hK�功ȃ!NY�4���!��]��Ӗ1�����)\?�� �i�������������&v�6,����2�����_�A�5��hïfah��NÛ�sl(�BN�8_()��(tZ�O3�b=�{`I4i �����ш����ڬ��^)f5T��Xz3]��+z���ٗ- ��� n���Lδ�5I�E�2Bz���n�}��x�R��Tb������E�RWG��V�_�[=���H۬[fQ�Q���0�OZ�$�a�ui�"6>a���ٖv�^��k�);]��nD^"-��#(=��K`>8�<:4*%�ߧ3^���H":â�����c@+D]:hi�%2�GE�!��!�����&��u6����aq�z" Vm`�?"^�|ߒ��I�Og��݇^oZ��t��5܋6[�E�<�Qʂ���c�z7��`$��ڠ����X�V�uI�{X�ʃ.�Oٻ�-Pn���ݩ��bг�����Tc�=�BM���~ڝ�(�@Z�� Z�q�ay�E8{��ƿ��igU��+|�T��;��3����Xɔ�ĽR��0���@��ˌ�r4n�{��絸�"����;�B�c������PV@VZyht�� � V4��z�g۹^w��;qi�=l�0���� �$��6H�U{k����Ordm���錄L�̉j���)��5'`�%�t%\��X�V��f�{,����F_ ������Y�����Ƃ!���I\pM�g'�)���1�a�ǥO12��+���� 6�i��96����"�_������{��\iU��%f4����k����� ��iޠ�˓�v6��}� �G���\K���m�-���٪7`���I����j��Y�QL0߶�!hj��������~���7�v����g���<�a"&������o\�"�D�H��2i���1Bj �����qG?E��Ȧ�H�����w'�7UД@D%x�o�)Cr|������������kv�l�X���5i�<��<��.��������!�,��J5����3�8���!�襶�;����kג���r��,X�,����3�J:� >��&��*i/����:b���2>eb"v5hY�RI7��qַ���d���Vk��S{����^��<=�Ωݼ���Ѡ�|� �\}���=����/=��(�i}�e�v<0�$�@"7��Ϙ-���p��Q2]�ޚ�U�YL�k��Z�%�ue�Lڍh�Q�|T�T;$R�$+h@��[ܤ".���k4}=��>ؠ��� [��+�,�C�$�+$�H2l��ۇ�b�-]�������"՛ot�ĉ�������A���,����C'[F�>��B��T.K) ���S_>�g�OR��{�a����,>_:�鿀Or��r���צ[�Cȝ����xlk����3�Z>V���]Hl����Z�������l�F��>J�k��,������9x���4�~��.�S��ևC ��*����W2D�J��r9xpW�B����/�����?��A3b�+�6b�\����"9�Rps�K�q�1�`n��CX�B���8>��Ƶ_�*{Z�9����9��H��jc^�뒁"u$~��/n��@!"6��o�e��o`��ZC����Ȉ<��=y$�g3�r[B�VZ[驊���n��rI��}ͪ�1Yws�������v/�A��v+��M*O֞�C>g� o�zx)Gv4��u���$>��* 3̯I��̓i-�%�̂�S����5��ö���vȧ����d�� uk�\[���M yv�> G�w��+P%�ϵf���1��4��8J8>���XƘ&64V��:Ҧ�?�^Yl����%�$����ͬ���p�lD���g
Static task
static1
Behavioral task
behavioral1
Sample
Data.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Data.exe
Resource
win10v2004-20241007-en
General
-
Target
Data.exe
-
Size
10.3MB
-
MD5
431d93760ee9dbbc27506884af0dc572
-
SHA1
426d9d1ee1f251e1f983239dfac9c46cd44e0e92
-
SHA256
b11df30d5a184297ea48bd4b92f67ed8ff31155cec3d3476fa95e33a2ad84652
-
SHA512
5d40493ead52fed453eb18dd015f71217022b32ff55ceecc9031d6b5854ae09273e82150feda0a68fc337681456c7b739717206a3d8dddc6b94b8ced17b915c9
-
SSDEEP
196608:abYoXBV5GH2/y5/zHHuS4d05z7Ubi1R4Zq/eAft1UW+4wkF0TRw4:abFBVq2MHuSEQZz1/N5zQq4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Data.exe
Files
-
Data.exe.exe windows:6 windows x64 arch:x64
81f42f847e10ff9167d2c430fcba0965
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteConsoleW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetForegroundWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
DeleteService
ws2_32
WSACreateEvent
crypt32
CertOpenStore
ole32
CoCreateInstance
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
bcrypt
BCryptGenRandom
ntdll
NtQuerySystemInformation
shell32
SHFileOperationA
oleaut32
SysFreeString
shlwapi
SHDeleteKeyA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 650KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 10.3MB - Virtual size: 10.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ