����(y ��K��;N���XH�ǻ���3̏>�I�����<��|lɟ4QT�|֭��n���X��H�����gS�m�V`D�@ظ�c���b���������/[p���J*���Y,��&[��0o���ݻ���-;�N�9�J E�)B����d���zӶ4-z�[�7Y#�"1�mp��_�B�V+��l�yI������{ ݸW :6�:0�����!�L:#$��:� �UfpH�k��Z#:9c����y�4��z��͋R�^ju-|ag��H��T�î��4��h@w�CRI�b-�[5��>|��1N�n����?`^gd�(d��|&�Ke�\W�{�B'�;w�C>0��!6=ꌏg��\:v�Ɖ 9��n0���˷۫v����8��Yi)�D�i0�P�_�q��5�ѷS���ӉYQ�!_�� ��ɪ;.��r�}�W{r��Tk~Ӡ3?u�2rY*��7;|�#�iwR��n����aҜ���PM�:�̀�A����r�j�������ԧ_�苕o�����������ƙ�;���p�H�{�I}0'�*�}����Z���A(�� �`�O0Z�Wn4KxW�m�8�����J���}��_?�M�nqH�-V���9���P:�d���R��D�[f�f8�S���?�Փ��� |֜�b�면[�9��R�[�a��܀]Rq��R8&Ɓ���z�_U�6����s�(/���#�Sn��N6�1���L���5��y�pe�:27�;�JŠ��J�2_�� \Rܜ�ӳζ֕XJW��x�BbC�<Ѽh G><m��/~"���Q&�!T�J�b���r峖�걚 Wʡct�]VUDh�0�s���OP~C¹�A��Oh�x�0�� �^��C+rp����71���h���\8�3�������BLz*��5��{}A-H��-��p>��6�偻E�w���m6|�k/��s�_�5��>����B��~�6ë�YaV��� �(+�s�=��sߩo%�<�'��0��+�q6 .�G�1j��wI5�C��E���[3p���CEe�v��Ba�q�t����y�@�#>��`��T'��#�I3�����L[Q����{4P-�<y�BP�Ek�$YG�u����6ݭ�D��`G��,ǝO��$Ml*&���;��~J���o��n�M���WB��bV��}����(��?�륨X{�o��X����pt'ƩC�+P!�;��$��Buq�;o��_�W�D���@���u�+�G��\�O&�����'�Y�~_��v�ءn��=nkq<,�8E�ad �ɯ�Vr/��;��*�I*��u|nPfA���-Unu/�#�#����h�Bㅠ3��Sg��y��2�Ø��a)m�g�Zk��B��c��X��8��~���9��\�x���Z��N�Al���7� ��� 6IM�)ި)w����ٚ�Kx�����vC��ڤ:�����]0��A���߽�Cc`��]�q�Phj��:��{~�ʗ�=:]�+��Z1��-�ʍT%j-5[�t"JT�ʚ��d�xH�M��f�� ��ˎʘ���B>�xg�3Ct�����������`?�0�h�In�q#r�Vi|��F�����'����G0�R���v�x���%�W�J�V�����j���m�u�:K6�h����L���ֺ]'5�XyGn �����̹X�@��x�d����ɩ0��9[M��fr ��Խ��X�7V�F���P��l�;�����c,��<��h�N�vC���9J2zǴ�1w�QT�7{m�_�P^N�ƍ��y!9�p����*��i �>���+PL"��-��� W��[���)�0/*lq�_g�Oi��w7 r��G̚�_�<? ������3^]�X�������|������*ȗ#��`c�� �;8�V��F7#�B�w�Ad �ч0F���R�@�[�{0��mDi��^du���F-��~�@2x2����� �����R��OF��+�#R��VXD�N6=���KW��Đd��@�w��&߳�C�V7�G�ͤ�e� y�=�c/��h6k@�}T#�AU��E�B�t�P�<�Լ��=y�};a�"�~��ɆƂ�X-q9Cٵ͠��`J�5OU����q"�:$1$���᭣�}���������ǝ�O�t�x���9G��o�� ,��@�������� /�Y�%+�����OOX��Y�Vl�r&i��u'��_��X�3�F�9F�o����fޯ�s��sܟU���F�f�_8"�Ha�w],��(��L�nMR�K�3���F��"¶iA^{ʢhҝ���N��t�ڤ�⮃���Nj�ˌ8ës�&�?��e�߉ٷ�t�U�]�`؆�WB{���B��ف��rw���OmZ�l:�F�1�U�+RDP�u�8�Z�Ŀw9]~@dP7h�e�ݜ�ԺkT�KD�7�yƼ��G1r?��)x!C��m��{ w]>������w��3�:��"p�x$�8����s�d����(�p���Ky�I��T��e9�:P)�n%?vF�3C�|���5a2s� ���]���� Ӎb�O]�!����R���]�Tgh��#��Y8G�sC�e�q4�:}��ͱ�N���L e�����ʷw�|�S����v_�E���8���x��W��<�>�h�iev�+�1y(���O��:�%��r�I �<���nJq;������JO�ւzJ�;��|��R�0U�>�&�-���s��-�n�مu��T>�X~8��X�"��9�רҋ��=`���f�(^ƞF�v��P���6����Y�-]�u���'5��r8�y�c{"�gtyk�O�"�ɪP�O�T��+S�~~|'#�Kć�.�t���}��4�C.I����J$��4�$�����5B�qf�-�x�:G��_IJSH)��w9��꒳*�t�jP֬��B����`)F�TMHe{�O��˭S �l�IB��D�3eρ��o�ˑ�F���U�r�'ڲ�qy�y���L]Q���g�f�����ܟ
Static task
static1
Behavioral task
behavioral1
Sample
1c70bc8d173359b218c0ffc49eed718ce8cbc60bb9a5d3cb11491af537eca3e9.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1c70bc8d173359b218c0ffc49eed718ce8cbc60bb9a5d3cb11491af537eca3e9.exe
Resource
win10v2004-20230703-en
General
-
Target
1c70bc8d173359b218c0ffc49eed718ce8cbc60bb9a5d3cb11491af537eca3e9
-
Size
14.9MB
-
MD5
8758ea910d7094517fe88d4455b4a15d
-
SHA1
910c7ed1d94614f91196f759e3c8cd0918d48c65
-
SHA256
1c70bc8d173359b218c0ffc49eed718ce8cbc60bb9a5d3cb11491af537eca3e9
-
SHA512
cbe8646b7ab57d4ff908aa54671439fc7a064cc7aa8a7282ad688f1fcec9ef0e7fb44e9abae08e3df82060689d0ac1ef44a030db7738759652c3608dae628fd5
-
SSDEEP
393216:dm7Vh/Ay9iZysCwzrYCZk93CLBiEoCg5K04:yL/Ayn0PY02Svek0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c70bc8d173359b218c0ffc49eed718ce8cbc60bb9a5d3cb11491af537eca3e9
Files
-
1c70bc8d173359b218c0ffc49eed718ce8cbc60bb9a5d3cb11491af537eca3e9.exe windows x86
82b48a4b3e1a913c9ed7da01034e14c1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSubMenu
CharUpperBuffW
gdi32
LineTo
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetIcon
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 408KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Bn~ Size: - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.N8@ Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d@] Size: 14.9MB - Virtual size: 14.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ