f�0@�{�c��/t {L�v�ڜh������ f����k N���7���cr��>���/� l���Bͪ�Yr����!֙�7�j�4k��������/�Z��Gj+�P%�В��es���/���0�K8��_"���k����ܱ�nAk�d�7/v�)tzRˇ��pDP�O�7k��.�r�1�DX�&�q l�n3��n�f�edߜJ�3)�f���yi5�^]i��I����B1x� ͻ}|���}���~�'�fΆ���NϥzW���8Y�3c'������ �Q)�z�숛�����+���D5�\����Ь�m%�����E�����������0�RI�4x�I��k�N�i����v�-����c)(3h<���n�Bgw�F��/6G�k����5}�\��m�[�YR�_����gU��.v�h��A%@�*Z��*�3���G?LU�8&��-�L;��H����'�蟨}9+;��k��|��!�,f�d����\se��w��I�u2kH��$s�Qv��m܍��4c�gF����)A������c>�r5�~��1����u���u�<���D�B�q~/G-�ʷ]m���F���)U���רR�e)�j��[9�v�K��bA��D$Mga�e��d��2�Z����`Å+��J�i~���� T���xw�� ��������l�.�ں���x}"L�X0�D_x��b��?͂p�~��=Vx�V�-����O���J�f�3l�`�9�\��V�jOٵ�Z��j��sQ�>v�K?��j���/��� ���"]��L6��y��6m\���eF~�+���Iѧ�JA%�t9)������~�d�s΅��z��s��U-����ꤋDl������AX�f#.��0�}k��'�O9RC�-��pa.� Z��.C\��ibK5��.��\i��H6��t���`�����7K�լh�AM�d�F���g����O�n|a�[�.d��y����V���������:m �ȳ Z�&����aǐEd����3�D2L f�5��{~T/�e�r'�t����S���TY�P���7�l�y}iY~H�RƼ��� g��*\��A�> @�l0G b�@����*s�D��]W�ɴ������$���ХFJq�������1%1�^�n8����S�- ���2ۚ��R�+�`��J�v� w۫��q����U;�`�[:oq�~M�^m$"�� N�(�Y�s�.$yؑ$�DJ���[�·��Tzܧ;�%j�e���O����m|�Ƀ`Mp?r���t�n�4$�L++���q-vG5�ת��i��4 �=�Y�N�M~#��!�`JM7��Fs� �]��R7�<;�h���8����aQ��>w(|��T��Ķ�.���Y�R@�,�SWz�J/��Q��w~ }7s�0&�3� ��������6�`�L�a�rYl�$��ш�Jk5|���'?|�z �sԄ+�Vx�ޔZ�b1y J�����g!L�ٜn>F��L ��m�W��L��3��X6l~0����p���gޣ�gB���q��"K���ʃ�0��j\Q���OP�R� l��h�e�t����-�zȑ��4���*l�h��fC��I�(l#�1,*�hY�U���X�#T)���`q����٤\�t����&�3E��6�~fU�!V���.5��0�x�kl����zLͰ,����=����w�И�t����;�����^i .hԻL �G9q%�:q���خ-�L��WKfx7/X�1 �1����7��<ƄAp�ӥM���HD^�$��5�9[q���f�W攙>��� =��kyh�0���? ��9�$�((T���#�ذ4�_�{�0&�3�-8^���-ɋ����kh�ɼ���}��Jۼ���k{.�n���6[�������T�� �5��7�G@,���� ��,r��*��?�|������r�|�E��@�U�֜����~*b�KP�6�:R���\��F&���y��F,8�D8��S����UER�� ��W<� �I� I�T��3d���C6/ֱ�����#MD������!KFoʹ���$$Q��‵rH����:>c0#��� ��\X�]N��@V�� ��)�A��X(�m��kN�7R<�����9&p�K� ���c ����juCU:�� $+d+=�O�&Œ�!|�ϵ�[�g{Ƹ����t�rYJj]���O �XE�9*�~%�N��0��g�F<�ʹӒ��{$Ε���K���"���H^J� �qXԏ�e��:�7��px���s`pu��J�[/>˓{�Y�p+��^��;X�vY���f����x���F����u���U�%��,��{4\�:�4��MF�Aw��C�#�4�Pc�|�s^yL����3;0�'��G��V�X�b�T6���ώ� ��!�r"�K U����3��"0o�% 0���ؒL�4"{��]-u*!��)NX��.�ƞ�C�4��TJ����,��sֺS;�R���.0Z�L�s�ٞY�d��9-�Z"b�"���c64��fP���@�=��R|@�-�v{"^ޕTH��퀕X�Ժ��k~+�Jfe��ѭ۷8��0�.G8G)̂$���ܱW���j��涹AP�|H���AAȳ���4d���mG�H�_�E�9��+u]�C�e�4Ӷk�����S�g�-�a!4E�m���`G�X�,��lr�A�B�E�h��C���1�>�]�N���k�gL�2����vL�Ծ�6y���lP�D�=}� ���'J�����\t S����$�������36���,�:�!b����U6:� ��f�^]�CYT���R�n�!'���� ȑ�TЬ��q�N�R�6aN´@�D�',�sN+����D��4�N`�2r��7�O)��}Y\$�m����r���)4,w��g07���c��wv"Ϟ[)X�_v�� 1D�/S\I��{��r�rc�����U����`�xhP�S�� Yv���2�F��� AA�/l�V�@ܴi�,�
Static task
static1
Behavioral task
behavioral1
Sample
edda3ce11177d2e8628b0626c07968bb97fe12111acffce83549ed90b50a0990.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
edda3ce11177d2e8628b0626c07968bb97fe12111acffce83549ed90b50a0990.exe
Resource
win10v2004-20230703-en
General
-
Target
edda3ce11177d2e8628b0626c07968bb97fe12111acffce83549ed90b50a0990
-
Size
1.7MB
-
MD5
8a7eee2fb6639640bea443bf0d9058fd
-
SHA1
298327d2c75c6c5dc592ae776f5d62a5693a8875
-
SHA256
edda3ce11177d2e8628b0626c07968bb97fe12111acffce83549ed90b50a0990
-
SHA512
0d3a2bf92a6a78b3dd628069c32b408de0ef743b47ef39b1625f74d84cbe379e98959e6c4627c6b0663ceb9edd40e0f5141fc496246c18c0f1130818aed8f3d0
-
SSDEEP
49152:z+TN/aCoRQD2iM0Wep/LvEQOlBRVvESNtGlA3A8Ko:zk/+ldepLzMBRdncJ8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource edda3ce11177d2e8628b0626c07968bb97fe12111acffce83549ed90b50a0990
Files
-
edda3ce11177d2e8628b0626c07968bb97fe12111acffce83549ed90b50a0990.exe windows x86
fda328a27d1acdcd4b2a872ac49f7df5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckMenuItem
advapi32
RegOpenKeyExA
oleaut32
SafeArrayGetLBound
version
GetFileVersionInfoSizeA
gdi32
GetDCOrgEx
comctl32
ImageList_DrawEx
mwic_32
srd_24c16
Exports
Exports
Sections
CODE Size: - Virtual size: 558KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ