�e�w��)>�� �����IBYo*.�N�z@�����ۊ�e.L��q�)��=a��8uc�5���{��b����@�H���Ul�/�ެ���|zM�"�c� ��� �j��\o N��R��z#��/��yhrn� �����@�ύq2#��ǣE�����%�L�P��4Q߅X��[\\My�����uoJS�����)�>��TWvQ��`t1ڕ�v�K��T��[s�ƭі��2U��=`���z��O(��s�y���L�����%zŮˏ�*W�cCݱ��$�p�ᱯ,��@q��!��Z��xdV9��C�o$��\���??���P?��I5�G�^t��bz�½�J��&��������V������H�<� 6�R[��J(�"/�b߰���Ų��� "i�T0b�����-5&���1z���̾�Rg�UkA�������l��no���nN�s���j�r`�1����o��8�&URz���v�����F�O)I9p���3C�Q~���jw=.�G��_k�����<`}��s�b*!}�~߬O��F��Q8T���e��\KŖ�b���;=��_�6 ?7OU�^�� ���y,��@�!��>Iz��wmE��k�U��!zѶ?Z��f!���3Իu�z���`�D��"{s� hh�Z���c�y�1it�B⃩�s�-T�ɖL��֦8�=G�b��OV��0Ece�\����!L����DZ�{����Gz����+�v����`/_ �"�vC��KP��.ǣ�A~�F$��-���N���[ _,[ן���+E"���7rCji�;�`���T%4��s�>+�$�Hp��-.�m�xF��K�����[��=G�ϖ��p��Ո�K��9�Ŝ���jŋ����]�g7�)�ԊȦVqQO1�����/��H3P?q6 1-|��%���(��r?�7R�o:�o*�� ��q ����=����Ё��>Z�[8:� ���o� �`Ƚ|+��P�C� a��w�lXj�"UcD���q�%��'��+Z0�َ�����~|�xi"aPv3hd��Pd"�������$�:`r5���2PH�A��b�͍�� �_��xU�Ao6�������NE��71��Bޯ�M�t��ro���Y�8��MA��2�2���7پ:����哝���� ���3 Ky��Σc��OeR����K��1ݝ[o��h9�1���$E@3o�~w[��y�sy�3����c�;ё{ՊR��lؙ���J�aE�p�����e���6iQD�W���3�_H����5��9��IX�I��nKh��XmSZ��g͔3h$���o����p�v�K�����&�� K�d���n�/������T�7��{-T���؛��P��}���Y=�IB�� �<��xM�@��J;p��J�t������I��_��-N#v�z�h�@16�Y^��GV5rk�<Q_�>�8��ܧ��)܂fT�c�-�Ҿ�w�� 7@�(��b[@��53��}ɋ�N&��(����!�����fL��#R�Tf�r'��^�I�n���Q%�k7r/�8�,�p�U�'$V��u �Y�yso:�{/IwR����,�Amj�-@��(��:K�Na0��ƪ�F��Q����RG�^��!-&�} �4�E�Q�I���Lީ���H�_@V[b[�%R�[�5c��{�ʭ�Rً��ߡ�KtY9�0�+�[)��)�o5�W�!KD���(�w�_�f5v���O� `���pl�{��3��\����!�M�RM3�!�!2�6�J֝J-��3~�v�.Rh�=ac�8.�X���ď �c+�-�Hݏ�R�S�s]z;l�薾�w��S_��"eMr�Ph�ҩ����0r��� iI�IX��@qm<����t���ڿe+�MM��L�k�o]XV��~y�{���Y������ԽC0R��5K���{��$$��)>��x)(!��ڬ �! �`@\�)��"y���-9G�o��(�o�7Ň��h��]�Sz�>V�e��x��7��bQ�Ԯ��e��gSΒ H�Xu5�[z�ߩ�~\՜%Þ{��*�6�Cb���6�i�K�zO����@na!��2P����I�}y�+�p���oX�6(Ԣ�=_����me�����1�!�5E����{�7qni��������̩��dOu� ���\M�٠4?��������6���9�#$��?ƿ����۫+#�)߈y�әΜ0�،��xX<�9p�?iZ2"�4𱲥i���9��jd�"k#c�o�'r;� �0����F/ oO�kj���L� y�-�O�c%���&��[�D���e�n�=Q�y�lz�#Ԉ�=ؒ����e$w���X'���œ���c�틝�mЙUZ�љ�s�R���5)s�q�j����o��p�N���z�e���72d�8)�z<�����ɊT��Y��9K��R���[��zh7�D������$@����U��(aF�_i %c"$����찈�P|��⸂V��Zvp�̫W/�P���;|�E�m�� Qz���<K9ry���D��{��y}��F����� ���_�uHE 5Y��3v/ۙ�8h����.��y����!�2���|�]����7f�Sr�{�܉��>:a������ɛ4��n�%,q����~TѩO-av �`�6秨�����q����V�Xݥ�l����-��O �S���A�v�e�mA2�1ă/:Q��۳�s�䕜6D��IQ(���H���G��El�<K�Ѿ0J��g���}4�m<"�p?���Eq���Go�� �����c D���Ӊ3�;1����g,�q��%D��vdddAPΰ'���������zX�+fʅl7;��P��҈ڤ��Y�zp���MJ݇�c;7�H^���� ��v�G�S���)�����{r��lltɵó��,�3+�>���%�a�o�N�W,x��XY �r�P�н��k�&< cÁ���2�>Er\�y6t��A+��~3�KF(����?�ujƝ= K�z�[�b�9;D�
Static task
static1
Behavioral task
behavioral1
Sample
bc1d376cfa2b32b3768ffc69174c79ffde43e24899efaa841ac2863b999a9b07.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bc1d376cfa2b32b3768ffc69174c79ffde43e24899efaa841ac2863b999a9b07.exe
Resource
win10v2004-20230220-en
General
-
Target
bc1d376cfa2b32b3768ffc69174c79ffde43e24899efaa841ac2863b999a9b07
-
Size
5.2MB
-
MD5
aa29c93f7958696f22178e02b11f3858
-
SHA1
e616c1e204a9e6deffd2cc2bdd4b8b281ebe3ea4
-
SHA256
bc1d376cfa2b32b3768ffc69174c79ffde43e24899efaa841ac2863b999a9b07
-
SHA512
c391a4e126206055b3b09ac7587bf54ce9908e7392c4b6673bb4247022159bf9a35da3940a3ba42feda3e010643dc9bbe7ca4c44c8ee42fbdd0f628f81f80aed
-
SSDEEP
98304:WBcXCg2m0l6TQ0CM6Zd5vD4RBbFSrecktEyBKQYJqX1T3Nc5xeVG:W+Sgv0l6M0AZd5rImC/qxQ6eV3Nc5YG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc1d376cfa2b32b3768ffc69174c79ffde43e24899efaa841ac2863b999a9b07
Files
-
bc1d376cfa2b32b3768ffc69174c79ffde43e24899efaa841ac2863b999a9b07.exe windows x86
e18eb965fae991c218165a75e241482c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyAcceleratorTable
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 678KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CsoKz0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CsoKz1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ