3Y�[if�Np����������C�wo���s���S8��B6(��fH�_�e���j���� ���o�)�,Rރ!0��շ"\��ߧDч��nd�YUk\Q7 ���'(1�R+�k#(?��u��&Qx`�m!:�.3�w;e�Q�|��0�6{%%3�=�dj����^��k;U�&XA!��}�t\�R�@�+q��\���Ӂ�^���*�))��?� �~���$��/��+yu�K&%5�O�f���~��s�����X>�)����e��L>�.���&�+��cU������-U�}��=,��q���1$qUI�h��Ⱥۭ �Ą8�%&TJ���clCf\�)�����ԝ��o����d�MH��Z$�Z�o!z��I� ��h[�U)V��M�]�,7�f�i�W����/З�Po �ֺ�YC/��M��zy�m.�^>�eGr�A�}~��֢�3�Adt���v� ���;]HTJ^�t��(� �7";��"xJ��s<�}�%8|�`��@�ʺb{V�O����$��d�7n���X�**ɶ��������e��]u-�9϶*�&���Mg��#��,!?t�B�V�%ӕzRd *W��܀�$������{[�*e5��ٖd4����%)�Qg���e��J]�nb��Md>��o{��WӦ�7��8���4�rHn2:��]plR�6d���:Ϲ��x��6��1�R-=���d�%�_�����nQ���A��g����=�=���j�h�6W�����n������n��#���ɢ.i�H�&HcH��0�g���W�i�M ���>(���}�E��DA:i���k$>������g���q� fH"����+P�z��}~���ˤ��e6�1ܰP������P��<Vo��Fd5�P@#�g�#���ED|;�'Vyu@$|ka�`�mQ��hG��^��JgͶs��LY������Z[�#=Ꮨ����O^8�l,ا���C�T���<�⣋��`������ dt�wN��!��rʾ�5�gF��Ky����E��-=GQj(�Z2���@6R�6���-1�zG�aJ ��� tJk����"�߷��#��w�O�'��'#�>���]��Bjcu�`�W\p!u�A�o��b~�"z��4Lr?3"� ��,l����{���M��.B~t�gB+>�8��_:�Z�^7��y�e �~ih.�h������W\�s7�?��ƫ?��e���o�/8��@JGh]��szB�ř�쒵:����L�[�N�t@�n�ϒ������HUyOe����b�Ҭc�>����9�S=��b�����:1�#85sN�j����_:E��4s��]�K�����Nv!�X�`NPJzm&���Ո~�� ���)�Z%���4_ή��f�Ď�t�@s������;��|n�-i��Bn��\�w������eB�W@��/N�+G�8�_?�Ah>(�kW@Bx��&1-��i05@���y�Vw=0[��Ykt�?�D���� '\��%��2?m�X����w�5�t�(��Z�Sq�h1Ԛ�ͭ�"/�����;�۴na��8�t���������B�֕ѪU_Sz�ݬ��Tuy��I.4��-�N(�{<v����=!��:m�nyD�Fr�Ԯ��Q���2'R��r����O��$jQ�<���D�]C8��'8�aĉ�B}$���0���M��1)OD�>�I��~$�[��)j�m��My�ą�Ӏb�8�r�@�S�=�s�b��V��s���q����T}�>-. ����5NW��$��]e��~�*�>������ �%H�A�^s�`�^!�� ��pzqO d$�0a�M�[|IQ(�M�r�{���>��������������DNر�Z��.B������<��C���#��c����u7�ZQ��>?��)!���k��)��k��=�+�Ш�5�=s�D�}%t2Ą!*�)�-��i05a��6���o��>��k�L���im���' %`*,���vev�W��J#�*`�|�ĬO�f��k~i�d�,]W�(��>#�`F�}���H�����D\�E6���ž���hfZ����P�%��lɅ�� f\�T*�bo�����|Kl����~̠�����BFQ����C �Ȳ�\T�v"�C]��F5)��ÍL 6@��v��@�R��l ����#�҂�����r:��}��� ��A��r�~]���\�1���d�[5��h�Ѕ&w��܇J�z�-K&�( (���6|�v�xpY����s�*j��V�@qD�=�[� &� 4��X�zU��Z�y���U�a�xh����������,0�3Gz�b:��"8��O�G|)i#k�8�H˫�ji � �r���}�̃}"��VO����:��/�6^K�E��ĥ�9q���-���P���� m�iWJ�o9���8�Z��"f��&^��#����t�6��Ka���3ޢ����q��7Y/WφwGF9u. ��������&"eB��s����\��S����ټ��V�ZP�P^$��L�*=皠�]��fW�����2��8��i�r�_w���-���f�V,mP�)R3�����^n������-$��̪3�nj�魧��n���<���+<9���ps��~g/[�����a���M4��M�k�� ƀ��ҕ��P?����A O��"Ǧ�D �����A���r�m�7� p�'O�Z��0R����K=�n[(n֡N�>Q�}2g�RS��01��;>F{��,&�:|���Kod;�x���R!#��uؑ��(:mN�(��*l1& �m'��xJH�x� �'#���Yе�a�����vg���g͒E��<�D� .�Jq�i�N��V.`�nP����koK�B��&����ؘiO�����k�o�)��i`Hr���CV!����c�����ؙ۟e������xYx-�z_b։�Z#�rzy����"'{��B����F�$��2�P_Z1T�g�ԝ��Fd^2v'�"R�R������m} ��hG�@�L������N�Y�6����%EVD
Static task
static1
Behavioral task
behavioral1
Sample
933de3f2f04076ad837bbf213f4b91cb149f35c944f4d571670aedfa50eb2bd5.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
933de3f2f04076ad837bbf213f4b91cb149f35c944f4d571670aedfa50eb2bd5.exe
Resource
win10v2004-20230703-en
General
-
Target
933de3f2f04076ad837bbf213f4b91cb149f35c944f4d571670aedfa50eb2bd5
-
Size
9.3MB
-
MD5
22787da71e3d1cc8049c3812aa5d8e52
-
SHA1
32535792b14071d3f0adea42d0718bb6323a3a33
-
SHA256
933de3f2f04076ad837bbf213f4b91cb149f35c944f4d571670aedfa50eb2bd5
-
SHA512
bf1fef9de90c06d29320325d1ec6795eedb8fefa37c0d614c4c3559e7396434afc1e5f0ed1fec7172948c35bf1665f29468d97e94c73bc4e117fe50299219551
-
SSDEEP
196608:WdjEzXpyEnXyn+mLztUnmzoYnuNIdDrjzePc:EjEzXrQZcOVTeP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 933de3f2f04076ad837bbf213f4b91cb149f35c944f4d571670aedfa50eb2bd5
Files
-
933de3f2f04076ad837bbf213f4b91cb149f35c944f4d571670aedfa50eb2bd5.exe windows x64
3e66e3d188b181863b8bde25cb0be1b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
comctl32
InitCommonControls
kernel32
DeleteCriticalSection
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
shell32
CommandLineToArgvW
user32
MessageBoxW
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 416B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.89640 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.89641 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.89642 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE