�t ���M]α�AK��b�_lTA��u�36�����w���Q����� �D�_��?(�}Q}�l��c��lJ"�n�d�-_g� ���֗��_�� #��c�_��&����U�R����b�]���*�g�GwE������I�F�֔3�.�ߚ���k�ثQ�-:&~�0���]�K���ɵ��@(��T�at�.\�l3�����fE�|rw|Am9MB��(J�K�< �A.\�ZL��j�c~۟Y��E��̣�:���@g��@ނK��#���v���5�#%2܈���ʽ3=pޜ��J&p�m�k�ۘ;��L4�� f���G(�?f��4��E� ,��� ��q�ff����E2DE�߬z@��SnN�.]�#��u��21 �,hFȑ�Y�;8̓�o��)�b��*l�1�΅�s �-��V��G��f�Ȱ� �џ�_-���yJ��tN�!������rr!|d�&��s����.7Sk�Rh���s�`A8��eC�}�۽3�׳ S���_ �#�#������N�w�Xn�K�����K�@Zh�J�������x��d�3��1nL�ͷ�+�z�fcT�*��E��i�)C�f&o5�9Us��~��c1� �K���kT-�W2�%��C4���?qo�o�Q�]=ۆ�`cYF����M��C=����@�Z� )�8b�����g*���>�j�q/���IRX+;Tn��m�Z!"��jr��u��P^�����>�F��E��7h3+j�s�"U����j&�#�0gц. �i��O1��!0&�����c_A|�И}�[:������$]7cKIs���l��kF����F�>� ъ(fG0�fA�� %���q�x��m4@���v)!T�i��ꍪ����W�����������Q>Xm�N{��Xj��k�Jm�<<C� �A�}�AG�L,V��km:�/��3������]�P���`A������L����Y�0ٔ5�RT��&�N��ќ�����u3���E�T91������i�t��~�����E����ʉs��>����9ӣ���S�P�V"f< P�����W :-P忲��䠻 ���`�e�Hx�?��w�9܆�+2�>d��n3e�������������o�%�z�gCI���(��.�����Y�9�6&��I&t�סT��Y?��xjl���ؔ�S�㰭SK�gB5t����3Q���#�{:IM��{V���K��g�������y�jӓ~�I.U94d@�L�}���D�e�k\$4��,h�B2ZLl�W�����15w�[���l��!M���,�������*YL�~���������d�B#�G��&�~�nK�ϔ��VR"OV���0�W�����s'�ԭ�2�}��l^��o�v �H��4{��T)��ԟ(�������j3�k�/����Qu{��h.AS ��x�j�{�����$Lil(��0�&�-���@%(h\�ptP�`i��b^�K��sf�{�f:Ti®�(���hs����"#b�tA�����[N�Q"�&���橝w��mt R�Z^�m�w��:�V���&�������ϫvՀ�XiU� 9� |�e����G����Swқ�meH� ����ן �?��9���w8dB�1�u����n��ڌ;��A�ݢ3|� y�L�m�,�<�]�;�������� ��[oHv��~��;*�+��p㞅'Yn2��ۨI�7\�����F��Ͷ�p-�d��M8[b�Y���E�v9EP�G�c����,S�֧�yϯ�T�,��R�➌k����ΦgvS� ]�����u�"R�+<�����tP���.h��T�9�_`�Yi�4���������_x1)�zj�D�i��E�g�g�L�����#[�\ �j�A�L;��σx���Q)zv��z����,����.Q-�WO����?�a���|�!�q��=K�tJ����DG��n�W��ּ�j�M�����i,?7M^U���r��|���� ����]���f����#d<����ѳ�.u��ҲF��+ob��SX���+��-��{��1����>Mp�=�>y]��#Ig=�,��2�\1rKፆ���BP���]H�w^~=P}��5��)�>`lŷ�&k}_�V]�b8��眔!��#�I��Ay?���B��jE�Y_��c:�����v^5EG0j�����+�v/T�J%�33T-�^ѧ�� Z<[���s�U)�=��J3%��aH7�<"6K��Ow��Y�S�[�p��>g�p��ȿ'g��I���î�on�S��6���s� sXf���!���*\���_�T��`�;��&-���}��Rݾ#��*�w�Q�l�NE% If�ҷ�A��VWx���^��]<�y����1x��۳rM����v�kߔ.=� ӣ�S,����8B]En{���"D�y��k��P�L��Dٵ\&z�����u>���`�y{|�Զ�fA�5���/z]�$�m6c���O�)U�So��0L"T��E<$"��<J�9�ή�|k�l�mT�o�yi�{+���)s�p(|6/���~�5���0z=�\���$���<{s�Ӻ?*��|��?�-��aB*Oj���]�(a�(6!���Ay��v8d���~�7ϕ]L�ҧ�n�� �(����ǂ9?�tdp��A�X"҈i��J��?��e�����a�����:`?J���Ι�%�J`:��N��%LRU���&2��<)����y|��$F�ܴ�6�(q0Q 8�-ĉ �uI���D�$ 2��uT�N3�]��j,H�@_���eW"�\(m�_�z"~�v"b �T���b� ����r��To������n�b �*ۑ�s���_�Z�� �Vv�\6?X` !b��И}��q��-DK���S�>X����7�w.���"@���[b%�u~�N��k ]ٟ�%'m��j��+��Gd�LХ�b��*.#zc��d����mn�8�p_��rf�E7�UTV<+�jp�C��{X����f��#�h�\��w��5���ƺ��1���6�?������f��U^�rj
Static task
static1
Behavioral task
behavioral1
Sample
82f84e52e6060acd9e146c1f222449989457a2eced50a52a6c602ae830d69809.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
82f84e52e6060acd9e146c1f222449989457a2eced50a52a6c602ae830d69809.exe
Resource
win10v2004-20230221-en
General
-
Target
c8c4b40901052dd411865ba2d3fa98b1.bin
-
Size
1.5MB
-
MD5
7454776b53a12b6dd2957b22da033dc7
-
SHA1
bf529556ba58fa8a16b9506b005bb4a5846a8e6d
-
SHA256
fe311a8874df5a18fa3989b53ed02738ea5421cab0f318746c002a820a6c2cc8
-
SHA512
e69ec9dd41fd27a6c5682d3f620f29a0c6009214000cbd9de6ee7d9d4037ab93be6e5e2dbfcf89329bd01ae3ca0f80fc336d2c5bb4f159a9e751bb91041f0104
-
SSDEEP
24576:IdXj0vlotWCmsCCjof3Vu04k+eeL8Zw8XyUpK1M26pwnQ9gSauHT8gtsUSgANCzi:IdXslotNPCCsfVizRWpwngtWgAUxqFN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/82f84e52e6060acd9e146c1f222449989457a2eced50a52a6c602ae830d69809.exe
Files
-
c8c4b40901052dd411865ba2d3fa98b1.bin.zip
Password: infected
-
82f84e52e6060acd9e146c1f222449989457a2eced50a52a6c602ae830d69809.exe.exe windows x86
Password: infected
368e3e49caa60c6ee064142ef7f4f5b0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
EnumCalendarInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageW
advapi32
RegCloseKey
oleaut32
SafeArrayCreate
version
GetFileVersionInfoA
gdi32
Polygon
ole32
CoUninitialize
comctl32
ImageList_Replace
winspool.drv
ClosePrinter
shell32
ShellExecuteW
ntdll
RtlUnicodeStringToAnsiString
winmm
timeGetTime
Exports
Exports
Sections
CODE Size: - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 506KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.myAC0 Size: - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 31KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.myAC1 Size: - Virtual size: 726KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.myAC2 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE