�i�4��%D����鋪+�Q*�:�T�Ŏ�&��k`"��M_�P�b�w�ND�]L���,�,��A����K<>Zϻe�Ѳn�t�&��kd��L0�I��Y\���iV1xж�����Vʼf�[\�$"��L��$�{i�ĈgK�q���i6��#���͊��*-ܯ�v�}�N>;b^���37�LYnH7n��$���� ����A���A�?D%�Pq��N�Y�㢁�\W��������i큂(�fP��T/5����cQ�A�&<�s5���Y�] �+��Lɺ��Zd+!W�&h���P&�jl0���f8�U_T�D��֥,����*�@����JL��qT\(4ܠjeC��p��9��L2���^�^�S�U6-5�.���N��|{d^ z�����BA� .����E+���F(%̧�JX����������;+g��.מ����:����������I� ��z�O&�:�I����������6>�dc@9��Ng��]^��wl���H��՞b:�NS���e��J{�2}�h��2`���h'['��_��ܤ6�%Hf�X���5�M�jLC�������T}J�97 Q�\*�$�eZӪX)�bJ��5�Xf�~b ��z�vi�~� DiI.@B�H�(>]g�w�B����j���h,G�������K��;я�Zo�㒑��IL���0 (���JG!���Q=����M���ĉr����O�������1:q26,$�ra�;?_�E�3�i�*B���H�m5~m�l��x��M[ ����W����P�a�B?Qܷ���@]���|n;!���R�2�6~�X����k���"y� ))2;��蹎6&cr1�a�C������)F�R>�m�h������$zY�ЩV���D֊��EO��ki�NѤqz <�DG@�"�'�k���R�����`�]Y�P5�r*��e��D��mc0�5h� f��$�N>U,�Yv`A4��у�ա�*�������>i?P9)�$������$�.���b�k1w�eC�>3G7ZJxF�4o���;?9��z�,��83#vT��F�cr�.��7�r��d��X ��٭K?���@��: ���� fI���x=��B\�`���^�c��Y�'��ŬEc��]��%�'�"����l���jQxGVW�$i���)B���[t"nI��2��8��|;kv·M� ����n*+��'���Y������0���>��r���AS��+w9�qM´>���p/c��*�ڸ�-,rȱ:a���ъ���@1�͙�I]��:�;�_'���թ��0U��nȩ�]����ݐE3�W���<�{��f�xI~>5��&���\�q�jO��Y(F"w�y�(u���m����Ս!{���������Q�*O�'�mā}=z���kq&����ܘ��e�ē�s,1O�B�w�c��5�t�Zݒ�>�3j���ï�m�:2����B�]I��)IT{�; ��Y�躏��"5ðn`D��#,�>(A����w>�:��~��M���M�5 �8$�6ϳ[{- �Y듭���ZK�t;����gD� ���&�' =-��Y4�5wȂD(����.w�d,���ga�E�;�'��y�aWʌ\sٜLJ³���G����U�V9�b�Kd�Ɋ�yoc��v/� ����2��a!��C�gp��`������:3k� ����a�R���.�7I������P�@������6�o��ɯ�S�c�Q_���݃�c�<Az�>��o�&) #��I�K�j�[F��1�b�#� ��uӗ�V������{q��\��#�*�������S��q��O ����u��0�p�G�^���z�����-K�+ȅ4�$�9d�ɜ'��8M �,,aJ�o����Sْ W��]@���9�w��I7��N�1��!pq��iߕD��{Z���)�o�_}B�������l�&�' HK�EЦ�SM�c&_����f��+xMv����+�q8����q\�?����F]���j"����Tz�vՑ��ig�0D�ͻ�t���V6��JU��h�B���|�k��U�{� ���>�� ��6�� ���&ɵ�"d"y%�GU��R��D!���?�z�J����!w���Y�����G�K�l���i���_����n/{ͺ�|!����~�>Z����0�ə�rHz�eDO��%�玩���zc<?�aثJV���T©�$I�8rK���<��m���25��=���Ku#I>�r�M���J|cbt!�N�C�+͔;62A?θAK^�?p��G_��-�`BAF����[xӯ���n��ۇ�16�S5��W%���|�M?��~�8��O�2Cc*�r�yΆ<�yM�7H���n��%�`'F0�x�*�i6��~h;̶ 4��A*����3ܴ�����N���,+�t�����0߬W��p$�����6�R(�o�2Ǫv�wA�-�N��_�&y0��"�II65+�o/��}�Au�5 8�yL����m/B�����\} �XCHm(_����n�0.h�p-���y�V�,��=8G[w@@\2�Fs��D��j�Q���Dg�]�ү,#HH�� ƀ�n�����5�a��?���1�����鍶�۩�q���_3jh�>)�|&�����2d�ٴ����k��P+��;_rQ���>8�=�<Vkg�C"PdDW�����x�2 D� ��>����h�o����5Ř��9�'%����/�f����Ȋ�ب�]��~�G~�C �@���a$�&��^���A��J�s�D���궛�@G�`��C|�e�=�&flU7�a�E~Q����mg��MBu31~��p4�|v�쇺���Y��6e��X�[3kT��:� ,m84�*��Dh]IOy�E�Xc!��S��h�2��3�P���ƌN0נ��2�� e�%MuYA�R6�=����m��3)O^���"�����(r�w5_�SF >m81��)�L����cr̤fDt�(�x��Ж�%������ ��bGS!!
Static task
static1
Behavioral task
behavioral1
Sample
b76a8acbd5a3389cc65eb82a0488be0819ede2f3695798a7b6cce72e4f9cca7a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b76a8acbd5a3389cc65eb82a0488be0819ede2f3695798a7b6cce72e4f9cca7a.exe
Resource
win10v2004-20230703-en
General
-
Target
b76a8acbd5a3389cc65eb82a0488be0819ede2f3695798a7b6cce72e4f9cca7a
-
Size
648KB
-
MD5
f1f10f4b9b5083dca19de1174dd034b8
-
SHA1
f01f1b0b39458514cab846186dd627881f811593
-
SHA256
b76a8acbd5a3389cc65eb82a0488be0819ede2f3695798a7b6cce72e4f9cca7a
-
SHA512
e6fa13beaf973e4d500cc2edf2aedd651333f50ecb1e1299181a7edba23d7c388479e2c5ac8d9d4333711b01dd1e0d732699ff83a28b9a5c50a08a03eb4c88c4
-
SSDEEP
12288:MEeLAr8HZxRHysarBFMUPwKesJ9FismIs7GgxUn3+qbqt+:5z8HZxRHysozMWBesFhmIsS4U3+Ii
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b76a8acbd5a3389cc65eb82a0488be0819ede2f3695798a7b6cce72e4f9cca7a
Files
-
b76a8acbd5a3389cc65eb82a0488be0819ede2f3695798a7b6cce72e4f9cca7a.exe windows x86
e673cef06fa64591153e87485fe3629c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord626
kernel32
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
Exports
Exports
Sections
.text Size: - Virtual size: 323KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.date0 Size: - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.date1 Size: 636KB - Virtual size: 635KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ