L�I�S�к}"_�J{�t���jgmX��R��f^QO>NO�n2;�Xn #j%�'�Umf]&���MgL�_�k��1:O��wj���e��S� :��H� 7[VA�_�5�_v�钿\�}")w��P:��������T)�^x����d�GM�F:J����02S����[��}����y���:hpcV����Ǣ�hG[B��3�4�'\*��_ct���d�K�AnZ���|DvcM������t��0d���E� �|1Š�=��V o��"���'�i 8TIa��w��]=|LoWQ H{bXALGol�0Z�b�3��8���\����A���3��!o]f�^-QZ0D*�=шˊ˄MԜ������-�<��8>ɴN3��+�E���a��ͅeY��?�yM�ԇ��Ul�ԕA� �ZKM�M�S��WKji�)3�u< �� G@�6�r[���a����Ɨ�Ƙ�y;g9��}�r ��V��t��X�����RČl��xcBR�7��֥m��#dBnАn�p��v b�t�����\�'���wp�]|5��d[}m�X�a�Kuju���Y�ex�&�C�mިp�\f�A|�%v��$��o�x�aIۃo�_"F�M:k��HDa�ʑ#ݭ��/2=H�]!/���dpy���n�S� t\�����G�f����J�����Nݶ�.�̄x����ʮ\���ko[���X����ݗ��7h^�m����m�ZA��2l���j(�]��Ƿ�t�x3y n�TF�h8 AbFXO����o���l�$m4ڀ�Bܮ�.�d>�coX�I�����r��ڠys��"92d�:���XSLs���'J�r]�+�;<P�2�^-�2fS�vJߒ�OT��A�����9�������E�<��}��,<�^���p�ZK��T�&��?�����/h?�M�������n�$`ؤ#>�s�6��f�����@B��'gԀ�ΰ�86Q� ʵ�T���;���'\���~A��ݟ;�Í\l�D7+w����ޔ�r�g�cf���{ ������c��&�,�3�KDB�r�a���7��ژ'��N�{e���PÏ'x�0��� 35~��c�Ҍs�l$��I�����U�E�T�����jТaaP��Z�}_<5ơ~���ȣ۟~�.LtԻ�v��t��_�;P�_�Ͷ���t\G��e� (��)j��Ŷ/E��mp����&���<1@����)wY�plgc�n��7�8ȗ�k��$6���N��a���aڕ� oXJ�V�ev���\�G�\�<��Q�A��t�5�EOV��H����;����y��U�TM�-���nÀ,�����& ��䙦����f5���^�ӑDf���?x!��gD�G��.�:�>��A��������h��M �D��oE�N�:H2��2S��d'�,��nK5��ۑ������|����~�d�sk��&�s ��$�E�L22ԛ3|�ήF��t6��_��~����"�_������y6�y��nC���'�O.Л�53(w�7��&������A��Rjt� �� ���ߺd[z4$Q�����]�u�v�ѫD��y��[�3�ma�L���pK� C��A�(Ɏ9�jq;�Ћq��YH.���g���ɡ�}�s?w���ث9�Rn�`���S1K"�Q8��%c>s0;t�Ru^s���Jm�s^8ވ��R���A��0Gs�d���ڶ��L(�Pƌ�a������1|5���[�c-��b2\������j��n<�9 [��<��=_E��2�.5�u��������F�K�5��H�h��P٤���ͦ���٫ޓ�:)�> t�nvP�|-�1�|�\B@�E5�9�5��ClM�#O_�WZ�۱�{���_�Τ͋6��9e�! :��x���N�>Ԇ �Q\��0��ҋ�����u�Rh��ԡ��'j\�D��g��Q3n�;\�Y�_�v�h���V,���ټ��nI$���$1�MQy&����,<���E� ?�K˽[ ���̤��{73pXzI+-Ꮧ���[�4�WW{v!����(и^����En�J���ܤw�����R�(�=C{� ����S�| ���zb˺�҈���2�#��{1>ۈ?�������� ��=�<�#;µ����;S�����A=F�@����c����q9����E�V����'(/�G�J�]�%�D�����n8��P��5L�H4�}lV̾ܠR�a�Z�Ҧʠ���������@��:=�:�����V��db��Ùڀ�V������Z7�`�w����|}�r{�z�q����x���M�MP�Ԛ����#k�i2r;�VUD}�glI�eC���n�&��e�z��.�����(��v����t]�an����'���ȁ��t]��&H��> ��n�&D/.yY���M��˶e{�Ab+�?��t�eV)��A.Jo��?N'2�#��Бҫ������-�t���~\ɕ,�e3rUL�q�����>��O9��rGCd�¢9�� �MG����gj�D�@E��?���b��;xh4�Reö�������Z)�\$�rɵ����̐�K� H*�A?��r�:1�P��eLO~�8�����O�W ��G~ �w�{��{�]b9�r2�!��H>�h��M��<��!�99�ʆY>���TZԙ��?O,aP�p��I3 iE�>�4V����|��Ӧ���M���Z�c�v�}Z,BQ��Vf�2�4M�����\:H�s��U�_�Y���nJ�^���im\7�]q4u6�����G�8��G`n����=u29V��(AGkf�s���c��>r`� ��م[��]�T��|��z���m����p��W�u/�����'����F��������0.���,e��4 3��G�._ R,$a� � �+��.9xf���9��h�z��M�3�L��($�:���^R����~u�U�0j�k�D�P���?ed�������֏\�=�\݆l�<F� z�ģ<�����v�|Qp��
Static task
static1
Behavioral task
behavioral1
Sample
04e16c855515880799c8.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
04e16c855515880799c8.exe
Resource
win11-20241007-en
General
-
Target
04e16c855515880799c8.exe
-
Size
8.2MB
-
MD5
36b488690c9707ce7535f89ecbf494ce
-
SHA1
eb4ba5cad20093988d2fa1380b157402e4f97717
-
SHA256
b10c01a7256143b3abb1d6fe2115ecd651fe639bccadaf3dd88d1d68e1bf50c4
-
SHA512
26c95b5a5a5313575a1237bc66fc2dcb1560f216d54bade0985bcc8ee8df3f80457f3a979d0d1349fc2e14a5e7352c2a1e55f69a1acb5e7fa16da77497c2255d
-
SSDEEP
196608:hT0JUsBIIbr03TNMM06YxuHCFhIL1yLmj+Bfu0Qgfe/q+MMF1o:x0JU85kD6MFniFs1/jGNKZMMF1o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 04e16c855515880799c8.exe
Files
-
04e16c855515880799c8.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.R<e Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.|a= Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.&,p Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ