���9����[����lla� ��!�� �J���R��o�S��C�}S���I�3i�i��͗���8=�1if��� C���y7�T� ���kϿO(SN�;.ecB�fz�T/XY#�Y��F�f�j@������c��wI5 >��:� ��6��y���� ��Lj��V܄�&uWR�F5Ҏ�'�ۆ�V{�j��?�����������7�O��{d�[)�`�3�vB��Tޢ� ��,$O�:����H��Ս�1,���t�"�p۴�ڳ>�C�Y^]k�wO���.L��$7<��e[ݮݥ�����ϯ����w5��0���Fs�2U�������o�gǁx���=��x �oe���>�����T� ��h�=��.�7����a�q4[ѳ�-�x��$��xS��d��1H�J�����!��L(�$bc� �������I2�#M=�3��rG*���?6Kw�g��(�������[")�>�f�E�Y?�V��7�%0���^����HG���&�bD$�?GWF ��������Q������r�䶎V9,Ѭ&�p ͥ|�h(��` ��U"�9s�ag�%n��i>d�Z�%�dsjy�L��G?�u'���c.K���(���W<�.�����k���C�xO�O�X��bE�:HD�B_U��4OTX�1R?"�I��˃��z�� �����z$.����j��H�����+Ph��������*�dF��A*�Kj�D��vU�;F��roҚ�]�����Z��E~ꌵ��fvX_~d�|}Q�����JV��q%�N�x�:k2dӚO �2(nN�^���GϨ�G��%���cEkGI�>B}�o���oN��>J��Q9���P٨�^e����l��@�mVy���`V����w��8��ƫ��}ׇ��(�+�>`㇘�o�Օٿ{���v�}u+ڤ�ܔ�1�r뙼�;-N8��y�����U�n�������O��*�qf:z�o�m����n��S�Vp/�w�}v�ĄJ6����~��U�}��*��������y����a�D�A�5$�cH]�����C�G����ڔ�n�5�s���LJ��;�.�{2\u'��^�]'Z�p�^�����2v}G��:�����hF��]ݑ��V��'m����A-of��>���ˢL)��Vb��?�,d&���@ /,_ -쾖g�q�f��C䚜�(u�"�ɛP�/������;2��x���-�z��Ę�!L$==�i4��Z#�t��1D�Q]U��ӫ�r�οL�#���GV�������,^~�� ����Y����L'%�5����Z��^.u��L/�k��>�("��n�E�$���~��T�Cbf���{ly3�('��B�b�$��z�#R �+�!�����TQ�x�ʃ[�ù�V]k�L)�&���(Up�3%Ԧy8��'��[`I���̈����ǽid��7�٣����.A���U���֣'���Ƀ�#����X�m�Z���]0�u�����O��+�a'ɟTb�0@���W솗�>XE��}rrX�J8 �Iu��ڃ�H k,|�9sN��Ln1�z��������H[�c!�_{4Z�������4���<S*1�:�.��� �1����2Tꍖ�c�/V���=AV���GHa\�(m a����\��%������$���r���FL��Oͧ�P�,��.�lk��6�{-}DK_9}W�{w��46�r�`�m�/%�G��~�������t@���-(���)��h�D7�$=�=B़�#X�E`��� � 5ƃ (t�$8����%vu2�����<_��"l�6�n��fh��x�@��\}��u��W�p�O ��z�(d9����3E������ߔ(�װ��!���͙���f��W�݄EkZr1o�l��=g���4VC�9:E�AR�8dT~����K��{6Gз(*��f֫��~͜�N�N�U\���Rt�I<���IUp R���I~�Pj���egE��܂��X=��>�aEI`f��º�b�F�ޚ�͢��c�/�/1eO�w�`�R��8<�������{�3���L�.rv����`���Ohg�ͦ���C�L�@oK��~�;��o#>ߙ�6���4�#zm��lCȩ�ФK��zK��K, �s�L���`�h��LǩH��'�a�Z��06>�/ؿju��[Y�$5��(?˯�>�a�����Z���<�6n,��7���-p*��������l��ȕ���9*.g<�#ZSą�!���5��y����yvla�� �3���c��t��_c���ۨ�L��/Q�9���f��̯H����,�{����C�RN&\NJa�Y*oNV��`ɛTGgu:6��a� ����@�"���Q@�ԣf$d�5����]-y�'��m �ܔ9�g�=�h��Dq}�wDn�b�MX�M����z��[]8���F�XEGgP�me��M-(�����ġ�_��"#|Ss}T�;BI�&�N���_�^�|���xPGڗ��@�V��g�a��}v(����^6R� � *�����Fl�A�"�$O^��G�e��lW�m���I=�#}��ǐ����ܒ�{V}K9� yقZ %b��9X���;2���|�e|�N9��j��T����D�#&�1�y��^�<���V��[��^\���A~|�˜�R�g�Yf>��4�W�0�^y���)<�\)�mv+�G���U����u/�ْ�'���s���\�����v�KH>oa��G��o�;OZ�y�Ţ��(�D|1m��� ��>��դ�m�T��?L#{��'�� �GAB��(��2o���'�:�ЁYꛈ��`�Bo�$X�f����j���!b^F17/M./�8䭭>/7hW��c)� �����O���l8=AE�A�Ugj�f�~+��^��~,��O��Y*�#�i�Z���-�S�<Þ*6�S����D����m�d?�v?"�_0���R+sd��/_.tm�$�,$�od6P�3���f�juz���g�v��!����`?�q����Ւ$�r%Xl��
Static task
static1
Behavioral task
behavioral1
Sample
b9e74824d67573b75322da6b3da4fa38daf71da972a9750a2cbff93c9021588c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b9e74824d67573b75322da6b3da4fa38daf71da972a9750a2cbff93c9021588c.exe
Resource
win10v2004-20230703-en
General
-
Target
b9e74824d67573b75322da6b3da4fa38daf71da972a9750a2cbff93c9021588c
-
Size
7.7MB
-
MD5
f742c8d225f942179aafb09ae94d8d52
-
SHA1
a6a32db413e319a865a136a7e54e475f65214eea
-
SHA256
b9e74824d67573b75322da6b3da4fa38daf71da972a9750a2cbff93c9021588c
-
SHA512
b833d92702b6b959844d9890a99ff94898c42972af5a5ce0b4882fe452ff08dc65c678a12bdefbcacb3454601e7d49ae96aedacd8c984880707093da0ac3957b
-
SSDEEP
196608:818bNsUCnfhqEwwI0pX0FDQhSTFeYCh27NT5c+YO0V:818bN6JpHpXkUUFeYChc9rTw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9e74824d67573b75322da6b3da4fa38daf71da972a9750a2cbff93c9021588c
Files
-
b9e74824d67573b75322da6b3da4fa38daf71da972a9750a2cbff93c9021588c.exe windows x86
672be891bceafe0695eed14c64702d88
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetAncestor
SetWindowLongA
CharUpperBuffW
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
SelectObject
GetTextExtentPoint32A
gdiplus
GdipCreateBitmapFromScan0
ole32
CLSIDFromProgID
imm32
ImmGetCompositionStringW
shell32
SHAppBarMessage
ShellExecuteA
shlwapi
PathFileExistsA
winmm
PlaySoundA
midiStreamRestart
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
ws2_32
recvfrom
winspool.drv
ClosePrinter
comdlg32
GetOpenFileNameA
advapi32
RegCreateKeyExA
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetImageCount
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 777KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
._tJ Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.P4L Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cbZ Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ