�d���bKtr!`�=��;i!E]��D��Y)1��[R����jz߱�H�0���`�$fx�v���nH�Ֆ���B�q�`e��uF�;��2u��+ �Va����� ��Z�j�n��&��5 ���$g���?��$� n|�+�Sփt�.�kxnDgS�$��l���+q]��O�� pl��%YQ����z�Iݓ57:F�I�<�L51J"ߛ������({.r�W���1J�)�\��EJ���+�Z@�m�X��:��"�-��m.郔qʆ�*Y�� j�Dx<�KjW�~GYN�y/���I��G���UR����t���WG�����Ҍ-��O��ډ7BfZā�l���]~�k��sS:��7ިA"���R���a)gm]#�)��9�E��/O�����E���:Q������<��B�e5�6������E ����'X� �2�Nϙz���̽r�^��3��؏2�U�������r��-����+�f�DbY��"q�B� &��&r�YŪ4a�d�I���@b����H����n��l��k��f+����lh�L=U?!��!�k��I�8NԮ��\�&�:�p�z��H~�A^�����s�O)��:�����rwR�9��p��=À-\Xh|h��̍��Z5����kd�/� �F\2Y���es��Y5Ơd���x�����<�Jb6�^���'^O ��uo������A�� ���H6��58=(�Fr)��X al���gm��U%V����q�a�Cxu�N0%�� �ه5f_�-�i}*��Cj����4�;�����Sl;�K�k�8�]3�ef5^�E�6�}O��g`昒�aJŜ�ǡ�QN�!!KZ��P0W��A��A�畔ۺ�ӫmkM�"L7��E;�(JčHfx���{�������Wm�6͜`rB�-�6��N�<��BG�]_�B��T�,DF;���SE4�>b^b{L;��=X� 3:���Q�PшE-�_�Gڝ��T�S74�/S����kޙ� �.jA����d]ϻ�b玃y���L{�N�0�!.ϫ���� ���N���͔��E�6x��4?�#���&@�Vn��y�|�H� �x�M�d�c҂���%}���J�?a럀ئ���+�ے��_Y�'�#���ɏ'o�أl�������s7R��ݱ�J�9�J%D5�Q%Jr��L2a5p�Ǖ>���p4�������{��6���JV�=Ż��6C!C[���BJM�c[��CP����]?}~�Ihj�% �qy�&R���iY�a��ivT{�*>�6�nD�r]diK�O�k�*� ����O���up���)qJt �͂�p���чE6`�2�{W�G��7�18Cdz�]���ߝz 9{�Vl=�'(�I�f0Äq'�UVC9�t�\�Ҳ� �� ۫Y W�a6�����y��a��$�v}J��� �B�]��bk h�鴷%>6=r�1�W���&ۡ��&d߀j�����+Sl���η��J��J�֢{�r� �����A�; ��I�U���E�6�[�h�gs0~�_O�Q�4��q[�������(m����?p�3L|�C�e{��.�]I�K�E���](��<�����t��]���*\:ֿ`A[�5}���l'^�t�FI& u���NM�A����K)16zJ/8k�.�Ռ�<1�>��o����a�b�"���t�'�����x�i����} |��6��之���G�[����S�]�Q����P��\t���"��0>���'�Ix��O���8�s�K�t1���G���N�+'�)H�ߛ���1r�s9�ό��0!N�z�z�^'����@[�yf$I�QWG�[,���1ihe;Q-M�WJrGA�3���;Cd+(X}��|�J�ݱ��n���~%���ԍ)��m禍��RB:$�#f�-�t�u���#������"�dO����۟�ل�^��B,�.�פ���Z�&B��e �鴏A�\��ِƢ�|��uO>�>�ftRUgW����C� >�3n�=� B��&֤݃3����{�G6������(�_�x����B#�q�Ђ\�'[v���E�uD�b��xc�G�����4�%�dºz�p�dX�9��뭸�qNd��R�e�&���sh5Hr-sx�a'�g9��[ #0� ��W�_bF���Qj��_�!�kmQ�za�8x��@�p<�.h�mS�(Cfo*�t��&����g/-��w����<�B��nя`�H���C�fZ6�|p����C��v��n.+���Ȁ�X��7����%v�U[<��JB���X'$���',�-�+V���P���D�K�XO��d��ĵ���sf���a��f,����� sn��;���$rճ��XP$�/���qx�&J��xNtP��+��1�p�S�Gxg� ��f�L�s���,<��O�\�."]�/��)N���ox JI�h2��Ţ�iڹ�{4�[ʪ����a��r?͛+mO9��*w+���j>U�7�1 �<�VH�\?d�Kf�u���b�k�A+��^�g~kB �)�a1nn�yI�Nk���L*,R|�XeB}94֘W6_�چ�� }����A&��¦u Nj�^�����Yߥ�F%N܈�����M�I�:|C1/y�]}[�B7��t�%"�Ҿ�}tO�Rҕ�f���K2C���\a0U�;�B� ^(�DL*� =��.��}3����A�&������M5/�� ��^�_�e1a@�ߒ v�Z�2��qܮɶ1��}��S�\�@]�����q��D^;+�Ww)��!MiO^�"V��ʝ�[y6jE� �@�@ҋ����$k�n5X\�!g9��[��yͽC�Y�:8�����X�4$1���cw�W7%� 4u $�*���b폁h ��$��1���7[�M����F�i=�]����{�0���Y.aTdq<���������4En[��\"v)����b��u�������Dǿ$���NI��T8\4v�#"Wj����6>�h�c ���n{��ZP������={T
Static task
static1
Behavioral task
behavioral1
Sample
b562b6c0f4bd709e15ce67c9e5c52041e4cf6a3d1322ddaa453ef45e280127ec.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b562b6c0f4bd709e15ce67c9e5c52041e4cf6a3d1322ddaa453ef45e280127ec.exe
Resource
win10v2004-20230220-en
General
-
Target
b562b6c0f4bd709e15ce67c9e5c52041e4cf6a3d1322ddaa453ef45e280127ec
-
Size
3.5MB
-
MD5
9178458bff99db3af2b64129c30c6ccf
-
SHA1
947dc7ac08a20027098b7516650f63dc25f5c987
-
SHA256
b562b6c0f4bd709e15ce67c9e5c52041e4cf6a3d1322ddaa453ef45e280127ec
-
SHA512
319f521daa66010f0d46eedddb8c8c78e9dd69d693a4a35d18fa2e1b95eaeed3e1864db18163c8f6e48a9111ade97cd4535cb867f1b61ceeb9bbae8c35ab4d76
-
SSDEEP
49152:UQvz4m2LR4L+gGrJsrI/BtF8zi/OQqf8LNN0z0aa8PSTeJRJ9tgnOf7Ll:Z4ZdO+gzkptF8zYqfIN0vZPreO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b562b6c0f4bd709e15ce67c9e5c52041e4cf6a3d1322ddaa453ef45e280127ec
Files
-
b562b6c0f4bd709e15ce67c9e5c52041e4cf6a3d1322ddaa453ef45e280127ec.exe windows x86
4a7db3593edf723110069b9c6f45c94c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumResourceLanguagesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindowVisible
gdi32
FrameRgn
advapi32
CryptReleaseContext
comctl32
ImageList_Destroy
ws2_32
socket
shlwapi
StrPBrkA
Exports
Exports
Sections
.text Size: - Virtual size: 525KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1010KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ