灤�1?�7���E��l��R���� Sʳ�M"��b�`���.�R)�!g��'�)�?c��ƚ������)f��_���Ȉ�6��зT�ޟ�&th� ��FI�Y�Q�L�X��=�������Ò�C[�p��Y�Q��E}}��N�cp�k'��d5�K�7�����q���{d�B�/�ٷ�P�R��,�C�4]Z�a��!��2��R0Φ�h�41w��ö��Qf��v�9����֫l�kH�@�f� so���蛕�H+�{��CE��I��H��^�t� 7��k�f,W0�4��_I�|�͑���YQ�m��"���3�L������P]��i���Ӵ�{!I����Pr����\��2/�7@�/B�h2.�U�2$^�KdGQ�wS�"EͶV�z�?�~HL����ų�`�#����df�z�yFq���X�Y�)�g6(��P��<Z�4VyL��u�ٙ�=I���k���Y9��k��� H���3i=����p�#!�Ra;��d.����ߝE�Y]w]�Q�+�� �aX4f�)N�A��%�?��tv�*�°}�C�g��Ñ�Zk�p�g �`[�I�ҳN��W���;\�H�mdʎ{��3+L����/;4^l?��u��Or$/C��zаz�(;�y��m>�kw��S��A)�<�5C�IZ�50Q���(Q���6�;�ֳͪ���N�ab�-?��J4�Taw�{/{>jv�c1iwo�Gm�L�<�D�^���.�Y�)C�v����Dk��R���q�;�>��ba�nXWu)���=�ɀ6�Z���\�����?��P�Pӈ��M����-U�9�f����*��'�#� �g�\6��͵��o���;'����:=��O��u'�^ވ��rT�s�.� 5��ɼL�$���,:lj� �/va��k�&�T���PS������O��Q!��(Z�3���d]O���;Vp��j������f�L�aIَ(fEg��qLiz?��X�D1&�Ī?��R�y"��pFܩ (ۃ�i�aNHe�~\\�r��&Z�F��a�#���\'��8N������>�&b����O`I�������ؾ��(��38�|_�Z���x��W�9b�R��������lx�+H��0F~w��Ι�����d�kRv�1+s�V�.�-�ے���$D��&���-!-d���� �l.��m�|ω��]�b���Q��ÿa9x0��c��'Ĕ�\���n&Q���|��D�������噊Í�'��Q��#��=�#V0�V��A�r�h`xľ�\ B� �;��`���Ǫ�Z��\-R�]q�/-Y����v����.�����|%� 큵 �g��� ~:� �&H;�� 'B��(���գ���V���+�Yj9q��+7"���6�gNq����^P�v�G1�*�ݶ��\��j'�K�6܆�[ғ�A�����Yi�0�*����/��סN~��T���T��f���v#��t�?���ӝ�0�S�-F�il�h�[���;�5�˄���Z|n�է���窞�̄6����Ѝ+��K�%�������Δ��N���o{W(lf��2��\S �2�Ǯr�<ࣷ|��$�b#`z��ʽG��DjM..QFo��8֤�����M1X��p�ݫGP�f <+GO۹)z�v��ȯ~���)�}#�s_X��R![m͟��Įr�`�bu��" v��!��`N��u ��dɍ�� �&z��_ �3,��:T6�"�.����<0N=�W�����������:j���y]�W�1��uT�J���|� ��.T1��):�֔K����W��P� jF���Ф#)��&�+�� -���wg#�n����C;|��[����H�(!p�����"�K����*0��}��! ?JH A�Y����aF�3(.��!Ǫ�k��U�)ׇ����c1��74vl���[�#U�S��t��_�T��5a> AE�!��0���n�H &���\�|[�"a�Ӥ�Tc���E� #C� �IӋ����`ZEG"%�6d������ 9m�|2$�a��d���>�Q9 ���`2���)�V���;�.�E��R$��,e���x��z�����nv�N�#�����z�ԥ�w.�f�����vDF,9)�Ҫk�7a?�!�E�Q�5�/t���l�r�]:-����ĦO��n^quS�F���"a�G����V���4FB��:��&W�A �},��c�bk�ac�~ؿ�3��<;Y3�V���rƙ�2����j�y�Mv&q���Ҥ�xCvN��R{�C}��/'���Uj9��0��I{y���Nd�6�Ӛ���D���M:<�;�����,�1����|n�e��f+��D|a�P����(s<�� �L����x)����{�,-P�,�����|*�Ca�#W�c`���^����S��b���+�r��x&*�.�e��{�+�����~lz����(ƪH6t�6s���� �W�w3�"�#d����]��݀��hsڮc�[u=�T �ź[� 5u����l�9�i��Q/*n��F���&QB�."�?(pןb4gU����a���������=y^� օI_�C�x�g��j�||� ��o���}�B�m�f�(��jۭ�$ᗕM`N~R�(k�EA�*���-tʯ�{z�����nQHH�A�h��^� iyr��{>��N�NAĮ=,�V�UFX0&� $e���:�E����Ð��L jݎ���*ϐ�vοJ5,��Q:$�;�<���<��~A�1ԍ4����4��$'7x��W_i�vN���j��v�_�`]�g�wr�/����ԬIb�r�9#+'��?�{^������Y�jF0�w�Y��fE�5���� �t�Ƞ���ʊ����l�!�y؛ ���X���|]f��p;�L��{r�&e�pV BMw=[r>,�,?�j鋁��R��iu+b���VZ��-W�ԧ��J�rT�f�?�lO��2; ��A�W�} Vm�=�1I��8]�������gǮS�/�zC����^mQ10+��P�ϵ�e
Static task
static1
Behavioral task
behavioral1
Sample
ca4a65deacf971b6c2dca2cbeab7effb7562d4e06302ba534af8e7773ac9976c.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
ca4a65deacf971b6c2dca2cbeab7effb7562d4e06302ba534af8e7773ac9976c.exe
Resource
win10v2004-20230703-en
General
-
Target
ca4a65deacf971b6c2dca2cbeab7effb7562d4e06302ba534af8e7773ac9976c
-
Size
5.9MB
-
MD5
fe3c884a54768d848345b29c11795f0c
-
SHA1
fa7d9c269ba7c34dbacfec3685c7a9ad747ea396
-
SHA256
ca4a65deacf971b6c2dca2cbeab7effb7562d4e06302ba534af8e7773ac9976c
-
SHA512
90aa58922a41ece16448159f20236e5b9b780e9bbe50e5edfccdb578ee3b453194dfdad2e2addfde59d50e667012961f06dc405e07fd6730b37c737faf25d84f
-
SSDEEP
98304:WO/7EtjkwuBBpbV23mXMMocR3Q1waCNwGy/0NzbXTBtiHvJlBxCtByjR8:WOz6uBrVMmXxoc9Q1CN7XRfKPJT3jG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ca4a65deacf971b6c2dca2cbeab7effb7562d4e06302ba534af8e7773ac9976c
Files
-
ca4a65deacf971b6c2dca2cbeab7effb7562d4e06302ba534af8e7773ac9976c.exe windows x86
ff6c3caf21cbb2d3f52b1d9b7f70f857
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegOpenKeyExA
user32
CreateMenu
kernel32
HeapSize
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetDCOrgEx
version
GetFileVersionInfoA
mpr
WNetGetConnectionA
ole32
IsEqualGUID
comctl32
ImageList_DragEnter
urlmon
URLDownloadToFileA
shell32
SHBrowseForFolderA
comdlg32
GetOpenFileNameA
wsock32
inet_addr
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ