�q�HE|�Jb%�y��2�����R�����r�,{��<z8{Z4�>�zgn�8��*h�h����?��lc�|�U���J ��j�P���{>>�2ƕ��(�n�IZ�P �?!e��B�J`���l2et�_�A���S��?#��*R���{���XKP���<8H�-,�Ǜz�n������������>>ބ���ĩ�ڮ�V+K~�y��?cu^ҙ������E�p�"^����Ǐ.�fs�$��^ӥ���g� d���Q���A�ueʇ��5}.��g+H���{|b�]'�}��$�6���*ͻ_��Ӂ]�K]q�F�8��K�R���b�9"����s}�U��hP���gK?iQ+�8aB>��⠉�mM����:"� ߢ� Z ��Lx��{���i��g��Q�x�Y%�e����윎3-Fp�,���ֲ#z���#�^Ŵ�%s�+��,$�6��8���L,`�����1^ LkmTC�>���p�W��A|#y�� \��.K���@Zr�⯳l*��˨���п�ʼn���Kc_�軔��]�6�u|=�k���+���FC�x�ײ5��:����Y�,V�}a֮��Z]���ދ���r|{���u�{}�ݚ��?��#n�;VPD� ���b%S���C�{��:�I�#J��bɡ��������ۘ���t����ف�c(�M��0u��5�L܊d�YI�C�@�E X!�܃��sp������i�w�eK_6������`[#E��k�xΐ��V��;%�Hطq�*�8��}�G��-� ��VuK����'�Ҍ�}���(m��P���3�vyu�b���O#�V;�h���:#�Wmd=��.[��;z�v����6�a�r�Sz6�^ �M�Rj�ȭ����n�� ҇�#3��md$�jh�HH�s�������X?�H��&Q[__-JWח�<*����6���p&FnETU�I�ព��Ue�@,��R�n�;D��T�M'u���,��3yT#�X���V`���n��E\r-������Ù������H�����#���������\!z�4`}��/� �����֥��kK ��[���E��$�+)J\Gհx���?.����.���;(p��M[L��4�͓�?�y���.���"uBm�)cN�U+��xm���2�U7��ב$��I2��u`���jmH3�c�w��ޛg�,@e�qJ����6 �e��t��f�sF�ί�Ӹ4�/F;���&GD�:�+L.��|���)�SB.��*"�Nq� Y�wI����SJ���7��-+�@w �H�m)���aK�Uvy�/_:���NN�)4|���~�:%\<}|I�w�'� ���1��Ú����ko�� YZAHJg8�^n���}n�.�O@v�D�%� >�Z۞4|e��F�z�ʅ��Ea�ޒ�j2�����f/C(���d���7��EecZ�ũi �ts�V�/yL�)fI�Ym�vW���V���H5̋ �{=�MY����_�;y\!m��,�6�����@<}�� ��ȴ$�|�� bR_�un9t��B�;XU{�.+5���Mar���֑jN�i� ,�r�E�M����ǃo���:�qU=M�m�^�^c���H�4��r��?I^ǚ������"���6�Y��t�#�� c��Pg�ɧ������B;�*�A҅2 tqM��T���}��6Z����ϩ��-O(���<u���x����� �榥�t�"�6��ߞ.*l��S#f8����1���P蟠�7��h��(������a>\��\bi�|�_�ݯ� �K90P�/v���fF���ʁrqF303�Y/؇���Q��]N16i`����j�����&�eBw�N�Mͣ�z ��|�3� ����{�Yjj�w��Y���չ0t8b��ݺ?�X�])DG�4�L��f��,P$���HJ�+x� d�j�4HCx�X!2�o��^-Se&&�syi˲n���_dK�T�F)i�ȵ��4�Ǜ�O������V@��]��Lفm8˭��y���W�T�Slxk'���զ�&خ�MyjȪ)����+�@���tM��3�[]!�R�J�rI��Pl���|=�;R�tzs�ܞ�~v^af�2�ܐ���c�J�G��^�N������ʘ�l��kW�X��O���-< 6��@>u�P#�m�������=�o0�]��1�������e=\$�w�L�&�,�=�rM(`wv]IRa�d�2���?�07�m���yfΨƁrF�M��1x��ћ�-�3�^�XOó���3�Oj=O������2<E���p���]�~�\ߵ��tPU�x�³���D���N�?K��B���p���"�v+��Gw��r���G6N a�S��k�����vۤĆl6+���_�`V���8��)��;���E$�l���jxZ��] |k���!�ú�]8���i1В���a�����k� ��m�4���ш��}3�+*T��W�O�qz��;�.�n`Qh_0h0��w== .��̊�yE%��s����:K�M�&bf-��Q��j�oP�»�,�=��Ҹ�K��3��1^�4�h�J(F��P��/��d�cL�Ū�f�ɪ��ؙ+��^�xe�Z.�Ext^c��_}!��zH��p�(����I�.G�L��?�S��Ok���7���cJ��+L%�������g�,���ў�*�6�\�������\��p�b�yDbAr�n��{:xd�n QyPP:�)���J������H��D@K�%3��%P���UzL*�j<���g���P;Y�H%����[z}Ί��˜m-��z�u�b���s���� N|��^��t������㵙,��iʭ����j�-��[�t=<�Z���),"�vV�gYM#%F��� &<i�?�'�q����ቫ=�Xt�����Vb���G�_:һ��h��2&��ўj���|���A�g�<��έK�&Ǻpn$~��Dtq�Db��`FrC��U��8?ڢ�_}���!fV�+Z��Ԩ��!vZ�9�r���"b;1�x[� h]�8��
Static task
static1
Behavioral task
behavioral1
Sample
f1f2fb02d1de53abac1038d7d752e49d2e696533408a6bc19ac9bb6987fade98.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f1f2fb02d1de53abac1038d7d752e49d2e696533408a6bc19ac9bb6987fade98.exe
Resource
win10v2004-20230703-en
General
-
Target
f1f2fb02d1de53abac1038d7d752e49d2e696533408a6bc19ac9bb6987fade98
-
Size
9.7MB
-
MD5
b27faaa28e1c1dcfa8f5a2573fb10f3d
-
SHA1
675009fbac9d8abf5c7afb4cc98d7a274a0cf8c8
-
SHA256
f1f2fb02d1de53abac1038d7d752e49d2e696533408a6bc19ac9bb6987fade98
-
SHA512
a028382e4546f2758fe4bb025895c02e8acc13b449e4fbd79619749e847eba4bc68103d5d1cdccd8f16621171c363952183c74d1c542a4f5faa8a9f393445637
-
SSDEEP
196608:VN8vY1ynQpCkizonsn5DVb1AXwNaL5dw/1gXYiVabiawaw2TGK5:H8vY1y2Rsn5DB1AgwdOMpwW9joL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1f2fb02d1de53abac1038d7d752e49d2e696533408a6bc19ac9bb6987fade98
Files
-
f1f2fb02d1de53abac1038d7d752e49d2e696533408a6bc19ac9bb6987fade98.exe windows x64
ad5bb16372d493a63847d20377e56618
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
getservbyport
winmm
waveOutGetVolume
version
GetFileVersionInfoW
comctl32
ImageList_GetIconSize
psapi
GetModuleBaseNameW
wininet
InternetReadFile
kernel32
GetVersionExW
GetVersion
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowPos
CharUpperBuffW
gdi32
GdiFlush
comdlg32
CommDlgExtendedError
advapi32
GetUserNameW
shell32
DragQueryPoint
ole32
OleInitialize
oleaut32
OleLoadPicture
Exports
Exports
Sections
.text Size: - Virtual size: 943KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Cv_ Size: - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.``5 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.14o Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ