�_O�I��s���зD�pZ���[��qįֻ)/SoܴB4Yf'��@���c.R�)7�m�[`�f��.��o�2w��=���7�.�4=q�|�6�N~@a>�$�Tø>)��'K�i����P;>����y3��H��`il��Z��/��$p4ł������,�G��E��=!2w�� c5�[g:�:H\{�Jۮ�*9�c& ��D���s��<گ�DP�r�-(�8�k���b(���m����i�F�H2�%H�;�Ҿ��Yg�g[:0f#=:���\�^)�� �����!�=c�TT{�>��B �sp\ge�g��c\�9o�/h!ל���#a7%��eY* ��{��|]n�l��;S-%�y�啠����is�%��g�4m4$��s��꒸C�R�e��g8�j;1E����%r���@�[�I� �Ef�ު~� !9W��"��3�FWh��#����dN<<�j)������厄-t��_nh#h$���:�\( V'��CS54�͎]�<%�7b}:�P�M��{��oȊ,��R=�"�BRq[�vD������qu=29zT����&�c5G�Ä��Fni�L�S]�-~�R��P�r�,�(�W�z>_KD;��U6���M�nL���<��/�$rv�P��'�����A����I2�=5y�I��m��p�� �B����`�k�wu�� �#��e��ɸ�<��E�Z�L�l�N����/�GQ��n ��5���ڹ I�DK �+���Īv3TipI_����MrQwh���Χ`��p���H�`ҫ�i�B�N��[:�1խg`��ʂ��^2U�J'f�������x�&���#"�< ����6��ðj�:�j�a3�:S� �X-��(���n(F�ߠ���"�a��hX-� ���q��\���f�&�o�}~����&�md���u�?�r�s^�6�ge�� ���AP{r7��}�:��=UZ&;#1�:QX�� "&Q+����-�(�3ؚ(��*g�!56P��}�����oY�t���((Ϫ��q\(?~ �KY���_��☃��.�3 +��#^xr~���7�[}1�ṭ��A�ZYiT����x4D��#��8�[q�]�t��,3'��Ü���w}�Ǥ7�T{,�1U���e����+��8D�����������t�Lς�l�oN��܀s��H_�WXR4��m;)��oŗؤ`�h��Q�� �Xl�kM��%��$B�9e+�,��O�(ERo�/��$��r�×�:�Nsc�Te��%��9y��X�#O�&(/;AP���i�iF�4xz�>_����,9�̩O�"��T������@���ڝN��j�B���|�[���Ua�X���nP���J3�ι:4Fʮ�8_fB+����g3Vs�U���a{����`�T����,,�����{`�.N��h3��G�ASv�#���p�3@���-�#Y��&�I��Џ^>(Y-�j������>B5��T��C�4ږ/;]A�9K���D�@'ǰ�ƽ&�L�hɯs-P0�X;8r��_�Td�3�o E�S]�c�E��H[��!��q���bkfJ���TҤ��/Z@�>�S�Y���i�\�1��lH\���X��t��]��u�� ��?/)���H���*����8Ê2�#V��>� �W��{I��xK#�E��_(�z��r��Ԑ�C�SF��M�� d��"�K�O�_�Y��������f�k@��� �`0�4��'@&K6�Z`�uü�#�V�XY�b�#u����@XW��y>~�2i���Os/��_س��L��3G���i���"�9�H��Hic��[ӌ�<�/�2��'�A��Q-*�0�yl����}�#��i�����<���倫8.��*Q#>86�e��OC��pP�=b��+i�C�%.)9'e���v�k����"�K��Y�\?�Y�T?�,p���d�e��셩<�5�; >g�'�A肇����f�e���[{L��Ha]&�/�>�8���-/"��q�Q�;�Wu7�ZE��X��Ķ-��ҊA�G�k�A+�'�"�HU)zw���1S��D�C}����?Y=��Q�r ����&������Y��ev��δ=��}s���i�wq|~����9�W����v��<��1O�w�B��9�\�wO�� ���������R�^դ>Y�kP9�� /�i�Q8���=�*[MC�R��:�v�� EBkh� >�9���q�bF��f<Z�0 � ��ö��K�T\�Ǭ��=�L�� ��nN�}r`�p`��@�$�p�SSa��\�ʜ�' ?h�;Kv�G��%%u���O�r��ƪ�[p� ��R����9�p@v�t��YD��X�(�P��֘I����Ё���u��+o���<;}I���:��"n�xp�X.\gS� (Օ-G*y���$������,�d�� �c�����$�z�ߋ�1���k-��;W�WH�d��B�<�`�(�E��zg�������j�/T�x��Mݟߔn�J��Xی�@�m����\��9NG��|b��fҭq���UZ�ǃo��vO&�ò-�� &�k�����d(��AA�\{��<�F���x!Z:P!�G�g�]������Oa�b������»vA:A����q���8;&���F���M�8:��M��h�}S�Lo|14c^$�v&�h��r$ hq1?�3 ���8ɡ{D��/�$\�qU'�����@���*��X����͙�R[o-����짧h�W\ϓB�k��TJi��oFZ4(ir��b.�ڬ| ��P��c?�#<�A/�K������ ��I0&���� n�{��2���s��� �����2�K����P����ܢ���_)�fW��6����3�����N_~ R��;�,}�Ͳ��8扢C�5$!�dm��c��*'H:�yώ�!�[�2�E�����.�}HA�|g��_��Yl�_5� ^b�y���2�����\}���)�O"�F��Q�Y���a�M�ld�`#Tz�E'�N�`Ѣt���Ҝ��@dM�
Static task
static1
General
-
Target
938d36a8-1206-4cc1-9eb7-80c11eb32b3b.com
-
Size
1.3MB
-
MD5
a5d4b0509a22ff773805da291b07c76e
-
SHA1
bf83288f7da8df4561d6d43abe459d45794dc51d
-
SHA256
7ccc7de4f21c869b5e96530833367ecedeb558ac532ac52da4d3c71a5071298a
-
SHA512
22013523b7ec66bde8442631e47585c499383870c0e6a0001a188b73097f3f651f7efa75cced095f18f5ff0fda9af2f7c88eb1405b6724dc0c7ec50388e6777e
-
SSDEEP
24576:aYGtOjUNzJTBhcHvYk6Iygp1L7TwPMyRWEBwh//dr5vP4CM2LgDOGMVu0S7:utOmNtKAmygPL7TzpV/B5vPk2LsOGMVM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 938d36a8-1206-4cc1-9eb7-80c11eb32b3b.com
Files
-
938d36a8-1206-4cc1-9eb7-80c11eb32b3b.com.exe windows x86
1a465f4012a3ef7a3a7efb6584c56c15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2621
msvcrt
exit
kernel32
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
gdi32
CreateSolidBrush
advapi32
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kl460 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 511B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kl461 Size: - Virtual size: 587KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kl462 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ