cxqV:���,�5I��8H�!����H�GX�NټR�L���Pmw�'Ce�@�����S�)'r'�>�U���|%�šCE�����nnV�0w������@�ZC_�-B��0��]SD�PH��7�@{$]��hf�K�ڣ�p�\a�����-��Q��{��:���`�����=���P29!�daÈ [~l��5�IS�͐���?�!�1K"�yyD����r������� 0��V�� �p��ξM;,Q6����M�/��V�HFp�� �q���h�ÉD�KX�� ��Y3]q�y��<Yd��aB�S���*�ޔ�pj+n�0&n� =��ȏ����gt:��2ˬz�����r�)?�]tԀjl��%;�"�7��ba!~�o- r�v!T�q��xc:z䚝��xO "�������(^���ﳫL��i�qUߡNܴ��T9��+V2<��+u���M�gR�����0� ��;M0�EaZ$����"ヹQf�sHa�T )���KZh]���O{�^��`@ex�~o?e;C�5V�[6%:�F�&�_:�����ڬWﯘ(�P��2����NM��[Z�]������B��j��K��~k+�T��Ӫ� )��#у��k`wna'�sǤ���Ijo�DH�cɥ�g��<} ��bz�+lm/��1Oc�� eXO�k�=��,�t� p�f���9��֓�ހh�G����lϪ�b��i���V�@�-��{��L��>��$�%@�F�*�����Y�)G+͗N[,s;|*�f1���+��ҤjHHd�;đ��ž�r����!���y��f�������.O�U�t�VptIUT\��?�=婞s�I�U��#���S,��$U*C� c�9�|�Z�h^� ��`iLQ���&zInN˺��|# x��*U� ����(�[\��!&F:����>�u�/�mC��G�v��;���ZmCuy��ʉj�EP"���c)�����V�h$l���joy�9��l����!�rA�G%x,QvGJf��o�����̊+�F����9t���L�= �0����L�����A ̳7�`?-GK~U�����ENzf q��ғ.�+P�8��/]�Ŕ�̰�~�w��>�~ŊQg���'�rJ��ap�������jm}p�-��i�e���'znY�z|[��B��A}Kcح��W �>�0P�(�d��R߰�1�#�p�hh$#��R[�-�]�3"_]bDD�e�$����C��[�9���I�D������R�(Fs�����t�N��lB2О��1����M�Y�L����&[U�l���������o{���V��])����}Ɠ�&�%o|���=#?M�B�*ʼ�41���M���D/�n���'�p����]`d��z�{l���b�!���Vcv� �Z�(���y���v"sa $EqX/�V��{+��=}�_�:ܗ���䛃�c�G�[�kd�?��6��-h�Uo0���˯٬�K��Z"`��B�,4��P`�1�'X}{S%o�R�O�]�?XJ'+���2�XS�ߌR\�Nj�9-�/�z�$A�����XNq�>���7Z4FeBIe�[JQ�4��ff�8�n(��2ͦ�C�CƉe$�:��; ���$��@Awb�a��r�.�^�z�q���O�������/�g�3��� _O�xn��T#��p|�ԔI��/�+��� Q�[?�=$^K�Z�n�w�6vS�}�I|���%J6�o3�s^�7�"��r���ŷN�K��K�)|!ݱFI��h2=cd�d��h���X�.�H��y��%_�77*��;_s��埭��k",��1���KwƵt����p���Zt{ �c�">a�e��3�h�:f�Zȡ?���Z��~�����w�;I˙�d?�P��m`���&����h��>��2��ٸ����c |���ļ<���u�b����D?r����Gvg�Y�'�0>G1!5�q���3pjȲ�P�} �'S�o\�긔%��Dxj�5>����G���Z����3n�w���_0�:�7�Ȕ��uc��B ;�U�0`�0[�3"��Y;a~�������Fd�v��\���Y.N�[d3r��0�@,�㖜�n7I�ط�Y�;c这S�X�����۶if���i��@Ӂ�+��!����\������[(���߬Ep\8r�s{8��������GF���9S�|����)�(`C���>O��5�����LsvU��2�%���>��d���?��bbe#[��a�IY��PF���z�$Y7�(z�2�m� ���Z�.��}���r��p��,r�њ$� ˤ daQ@H`�Kd؝�]�R��������3�R�f߫��Gc���ɇ��tX���MA�ҕ�zΏNZֻ�]k?��Z�u�����q9����V5W3��8����ԶpL��.����^��љr$2�o���y�t�����y�-�@�a���qĴ�g�寧Aql�h��i��)��c�yj�r?���*�W�-��%�X���f��{;�n%��0b�F* �r���{c� j�V{����T�YD��F<n�����J�'SI!�I��x6��*��[��P������xМ/�G�3�mO�4j�Z* �\�^\�%�������w�[nN�_�0#7���g̜JL �TK��'���O���a0k�8,�F��NN���O�E�ud�3� �|ߗԥ���Yl,��=CT�؉4����ƒ�>���<r����"�*B41�dK�%��l�@^ ���D^b�|هI_�M}O�]�I�d�a�?���6�-�tL�FI�I�%,�=�0��"߲8����d}�;5-2�bJ쳮H�f!ҕ�l��Y�5�u�A �#�t��i�u��Ԧ8bx�}+��ly�飌J�5}�W�H��5}H[>ϥ��`ŭP[�dNK��q����sk`NiQ���̈́}��-�4�<)��.��ri_�*dNMb�*������������SjY)ǒ1����Ә�'���I���%��"(e���S��[��χ���uݗ+r����u��v�%c+f�}L�LVE�Kb�v
Static task
static1
Behavioral task
behavioral1
Sample
7092b33e1c8a10d49ca1bdd37813934c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7092b33e1c8a10d49ca1bdd37813934c.exe
Resource
win10v2004-20230703-en
General
-
Target
419efb03d980241ea9ec90811015345dafd6f4ec0ae624af617ecb3e15d51eb5
-
Size
631KB
-
MD5
ba87e298a6d9523b146012bfa10b57ec
-
SHA1
7957e0b219d458a1c56b424836d2e6380032d305
-
SHA256
419efb03d980241ea9ec90811015345dafd6f4ec0ae624af617ecb3e15d51eb5
-
SHA512
c27b092adbd6d424e4e4f329fba3d7cecf162c4e9dba5a632310b6df08800efddbb5d3ec93b5c3ea667121a1e63f70bdcb7dd6b748d58d492ee7269a5336e1ea
-
SSDEEP
12288:gzmqDtdSYieqQPpHxsz3j7VrER+vsporV/ZBEyXqI9RIhxql/EBhGQ+P:mmOdh/FPpRAlApoRZqyXqQqcS1g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/7092b33e1c8a10d49ca1bdd37813934c
Files
-
419efb03d980241ea9ec90811015345dafd6f4ec0ae624af617ecb3e15d51eb5.zip
-
7092b33e1c8a10d49ca1bdd37813934c.exe windows x86
dffa9bf665d58e297d2506fdecff2ab0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord561
kernel32
FindResourceExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 323KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.date0 Size: - Virtual size: 582KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.date1 Size: 636KB - Virtual size: 635KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ