؏��r�4���?����D�(�H��$�7JB]w]���qN)�C�?�Jm����/��|{�y�/}�uC�}b<�������>0*� tDx-1_,�b�����@Ç�����5� �������-A^|��Ѭ��p�m��٩ue������/i/�e�F5� K���� �dP���P{���iI�b���n�dh�PԘ�K���ꃈc6;�kS:Xa��k��ZL��.�����Z��c�z�q�+`��{ ��ȵS����b�����*9����&0cNF����ʌe���Xi��f�g�!��(C:��I��N,oO~����aRl�ޕ'�C�5G�+t�u�3j� �R��{jY��|�2���A��@h�j������{AJi]x��Z�%��t�D)20�.�=س�-W�!�rWy��q�������X��HS;��N�qH���Uo������"َ����%0�)i����wU��!Ja��'�T<�����K�l�-�Ws���o|��#������!�`�-YYi/4˰���鏚|+X��J'�������o$��H'�[���z�^8sLP2G�߷:�8h�NR���%ƃ�)0��̻�s�_$�ݲ#��Sg�bM��jkA63t8�Jz|�,|V�Sl�hU�7�G#+ ��� ^=�&+��&��NƦuI��[��>����(F����{��ς>�E�a=��n��"{ x,�U,.*��T�w�B�,���.Y�2��0�l��<�탂�R>� ���*�@�>�F��C�YHw?RI��w@ ���X��L�G���o���Y٥v��$�W���k$�?�/I�-�恟�H�)�M0�R�������V�{pi^��������D�cK��+�(3�d5�9�g5�e��?�E�܄FmĨ� �3�I�9m���Q�C~B_l�o���_��8Us@���Xv�z�����]�3���� {tk�L�CǾj(�n����c'�֕ �)M��**Yz�i�A,�q� ���OD�Z>���S+��m��lx>N�Jj�K������rɊs��;�( �H��C����):C���ż���B�a肻)w�]�Y��h���ε��ˬr�����َ$�b�=ۢ����I +�&�#��$��{[/I��J�սv�F�[�Y�ɝ�+^�N�ϙ �{*�|���Gt��C.v^x���!Ł�xq���/�y����N}���J���;:�E�yB���� 6f�>�Ltf��!ö~�f�&�vZ_G���~�T��2W�ݚy:�����.ƫoE�k�,o�������.��-a�4U��>Bt�uo�:n�ګI�S�̗���m�=��� ������ �o8��K|Na�bc��� ���,����1��#������&����]�Yg:���}(�8�{�}h�f���2�Q�$ٿy���Uᳱ���Ю��U��j����������K]�>6�pV]���`��N#�Հm�ƙG���=��l�E`/��ޒ�J�/ l��>1�T?$������t/��� �� S)�ƀ���,�I��-�B�96-��U�զ+f�g1��hoƴD[�o���xY���r>��� �˸�Lr�B�j�P����c0��� $���fc�I�Bg�*Ԑ�)�d���"2�3{}�������ۻ�ro!j�r`ip�)��j�;��MP*a� RD��PU���c$ks+���tw��i+�"^��0��4�X�-�$����;���y�ˑ�Ewע&��ɱ�TG�a��d����2����8�/W��H����1��Mk}����LF+ ��{���� J��8��P$=h�xڗa3�����F�/0���.ʋ���L����٥����&�Z�$-�=�49�ln��A�t^D�(����j��є�nD�5�4���l@b.�c��0�$�U�}�S������ɴ�{Y��=��0U���~�P����,�x���^��Zck�q~&)�X��X�Ϫ�K���y���7���?nT���Č�8�����l���_Y�1+���X��.�G�!����w&�TT'�E�j�M #��8j�i(�B��d3ŏ�������dⓊ��IT��l��\�IWx�P����^�Mr/�⅝$4��b13��K��<��e��,�}���R��Z8p}ŋ�|�� ���[A��{�/VuJ��_�N�w�}��VPi�c�����J�t ��$�N�'9��{> n��}���OY�6C��rɥ}y������@���y*�Q� /Ѣ�5��y����%Y��_�ݦ�WQ ���ҵ�����zi1�g �3������:{PO�<��-%������C�ǟq��Hj�@ܡ�E�Jʢ0 M��S�$�@g����f�6�#���nA��xU�}��e���R�i����!�~���3k����ӳ��-8� E�h.H�+����4��r�Ic�����+�� s,�ܟb��H�.8x���!r;����5|�f�+Mm���Ǖ�z���=|�M���,�^� �EF ��6�|�چKY�v���:@����i�W:u����:���r���_8��Ȱ �.@M6%�b�PWy�:�� 3-�Nߣ�֏�ˈ���t���YnŊ�;$�7k`�, ��0�49-q��,�������I�R<ϫ�.��?���!5@ߋ����p�d;M|��5��؎�G��s2?�o"�g��eM�6s����P&"vU�f�� �Yt[m�j�~/��})bhe0�#�"| -G��� �Ƌ��M<5̬�;" �2D� c��1���W�J��8:' � ���p���%�����3�3h�H������g����Z��%�7ښ6�Rw�"��_g��T��/��n����p�:�;��T�]���~Z�����+���� �G\����(��Ks��_z�[�'\����J���!�x����@�8�pG;�?�� ���:����D�C� ��u��5�g �C�iS�ݟ<;�Y����WW��}.@X{oFR|��/�w!vQM@>�Uk���x�~���K���y���~��w��FefB���I��j��&����"p�s
Static task
static1
Behavioral task
behavioral1
Sample
03e2ee5073e4310f39a50d229a41449c0a489de33fe76a70bff82cdfe2eeeafc.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
03e2ee5073e4310f39a50d229a41449c0a489de33fe76a70bff82cdfe2eeeafc.exe
Resource
win10v2004-20230703-en
General
-
Target
03e2ee5073e4310f39a50d229a41449c0a489de33fe76a70bff82cdfe2eeeafc
-
Size
2.2MB
-
MD5
009c5f26c8f412de47dc2aba49d16220
-
SHA1
be102d7d6ba5aa5297a6031f4904ff7fc5f0df74
-
SHA256
03e2ee5073e4310f39a50d229a41449c0a489de33fe76a70bff82cdfe2eeeafc
-
SHA512
8c47f6e7c707527672eb353117cbe84c69709a90e32f5ff16cb19a45727ad6c5836cda839afeb8f2d8a56d4a116109626c28f3ce37b8d71809bad8deb46bef87
-
SSDEEP
49152:HIMDa1f5SnQ10htf/tkBJ5kggyeEKJPeFDaFMRgTbNKDUnHIT9er2MT:zDaxd1stkexIjwbs8HIT8P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03e2ee5073e4310f39a50d229a41449c0a489de33fe76a70bff82cdfe2eeeafc
Files
-
03e2ee5073e4310f39a50d229a41449c0a489de33fe76a70bff82cdfe2eeeafc.exe windows x86
526cedb2c394217c09343d23ae770743
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
EnumResourceNamesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterClassA
gdi32
CreatePalette
winmm
midiStreamClose
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
VariantCopy
comctl32
ord17
ws2_32
getpeername
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 689KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rs0 Size: - Virtual size: 883KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rs1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ