���ƙ(d��,�m~K��JP�^ Hq����$��Y�CEF3�v�p�s���|&�~��}"��T���&v6���n;��7t�(�G��po�`�gN)��t�����m�� �Q�vA��e%8����T}2`K(m^�����,�/0�N���*����>��sQ !�~��� ��߸}����jQ�TcY�4_�n�1��p��X��g!��.���z-)�K`���iF?����� �b�ݣc%�����u��R�� �$i簺���&�n�rN�XZ��8�1�����O<��{��ў!7�ׅ�M9�;k�݉�5���?P��i�� v�Y�L�-�BiZ�����2�W�P@��Ũ|�t��� q��xeN�#�Z��>�7�fC�6��3��S��ݞьv�[�{�X(DJ�� Kx��K_�T��8@Z�pD7�58 �8�����f�+�~Y'^��_��vmJ�3%�<�˻Z��h��/�x��]=�#4�������8�3q~F ny��ГѸ�Us����Z��m���mST۫�姃��{���[���| �:Y��5�_Q�o�#�/�qŸ��B��:*�_k.���[�ǚ������q����g5�/�/J�J��F������ƔtΈ~Ja_3�<l��G8,w�$��7�Uԕ�%> 6?M�I�"������h���.���b���(7�w-?i�҄����8��QKS΅�����X=�4`�Uܣ��H^6'�K�n�y-�:�z��2l�X�*�B|i,7�t��y���}Z|ҩ?�� 7mElQ d�%/�B_ ;�A�����:�4a����gF]#,�^�!�C����N�`iP�\�YO�!I�=S��+lp<gt+%����,��Q�K!����M\F�a�*���.Ux�<�\���H�ŗ7�ߛiF����RH_E+�BX�E;�m��9�m8Ou�n7-�B��� %�;��>=%����{��zOֹJ!��g!u��M�9�Tn��v?��I�A�����5_T̝`��u)����+>�[�� �0��9�"x��aE����>�;/�v$�3��m�5��5���FQs�|�p �v�*#��`ۧIhZk��t��>aJ�-������{�^c��B�Q�����=��^F ���Y�_��\@��Q����6s��Qo>rp�:D� R�-I|(lP@Q�����������G�����/�(1G��>����`�w"eke-�hňm��~�'`�{���X*~���z�gf4�� d���)�u�Tn�"Rr3/ޖC�?��-fV@{j���Nє8��pƼ�dsè�H"`�f�G�A4�Vg�{��u�7� AN?����&�Á}͜� �\�]L�D,�) �(��V���m�X�5QSf��Ա���eV����ᾮ���j��qm۞1����� F2����"�/B���ʪ".�Y�q�dLF���y�0C+��f^�����8�0�$V��� �ڹ�l�85�:s�s+{5{9�=@}^�SmcwN�� \�b�i��DE�H��D��EC'��zs��n�1��1���~=��u��.�"���'u���D��+m.�t�}�qV�.����A?��u�n� F��:SI�� �]�qUp�����d��nH���]4����"jG�3��hs�Z���&����I�EP�л���i0�P�U`/C�Kz�H�տ�H.k��PM_�! �6P����Z�=���bb�(h��l��ܙ��sYv�]-��q3���A�� -�����iʳ9��&|��� � P/&0��n�D�M����|��Lb��A4Az���OWJ"�Ǽ��I,����f4�6��.��TK���t{�3 �\�zU�=#Z����}"F�\���a��o���C��nW�V��H>�ʼn >v�za�+|!��,��*����ȶq��/i���_�n`�?͓�'�\3N)9rܠJ.i-Jn��D}l���(�s�����W�O�v�i��̹z��#�Ԩ�k�n;�����#��O� �%*�ꕏ%R�B���IY�������kF��bD�A����5^�hh%�#7�Pe���e���R��$����|���?56!��Q*gZ>r%�Z2��R�y�kz�#KL�?��-��,m�Q&�3�w�%ѡ�����9@�� :b�+iW����Av�-N"ҍGE^TM�;l�n�؈�KWvJ^�9gn殕��".����pY�v�{@@@��4?A aӳ.�xq�oY��Md�2�4+�j��C}��ʔ���v���(I���=�8J�p��*���hS��t)��S�|�Lm 4��������ʊ� ����W�u�|�0gŜ�W�3W)D���!��v���`n��~�By��%����ɶH3K�AQb9 �C;':PmKLĕ���>��J���ZMRO�������Ұ��~S���r �Zy�w�@�rZ|�:�S?T#+4�Ѿ0^���f��©̬tK��;��f���R����=�_G٤�TYS�}@�:�q���6"�� ��x5z�2C�z貿$8�/� �N��G�^�̜[�MK�l����]F����]s{���D�S���xD��N������rTYP�x��"��#j����8�K��~�g����� � %�vm��Ԇ#o�}�rq9 ��ޕc���m�x1�6�˿ݓ�C��%'mryk�s8.~���W��D�k{����e��5^} ����j3�E/��u�ьz��۱���0�������3��U���o$} 糆]c��͟{h���9!�2���XE�\�����j�S@ ��e�z��>��A�#ыlŦ��<����&m2�DA8(�$h��,s^P���D��K��g.(�w��7 Z����k暳�6>��� Q��=&J�/-�G�:�0�Xg���t �.�C�P����r(-�23�{w���i�Ӟ��;�CO��jB��Fx|�z�+Uz��[麪e5!�n�9M��Lw?>���j�;�|w��@���b����ޚF+�.Ǿ� e�� Uk�ў���O6>;��W�0�
Static task
static1
Behavioral task
behavioral1
Sample
e073baa3ab869c9fc03b91e9b627a05e411e2f27387e8e2f4567b8cb7ecba499.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e073baa3ab869c9fc03b91e9b627a05e411e2f27387e8e2f4567b8cb7ecba499.exe
Resource
win10v2004-20230703-en
General
-
Target
e073baa3ab869c9fc03b91e9b627a05e411e2f27387e8e2f4567b8cb7ecba499
-
Size
15.3MB
-
MD5
039e2b8bb0ebfb4774c759e0c2556175
-
SHA1
45aa3a5de938712ce87a07751b5013ac86f629da
-
SHA256
e073baa3ab869c9fc03b91e9b627a05e411e2f27387e8e2f4567b8cb7ecba499
-
SHA512
2ec84dfc8f4197002fd0b13440a8396e93cede225502889531a659fe059765287518373d586b4b90d4079dfc16f5bd6defc0b1c8a4a4e25cf213790f3c5cdde4
-
SSDEEP
393216:hJ4/H7SnMvEhmlWtNEoWiywaw6HkkTkUrwf9bOe1:U/H7SHmlga2vykU4/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e073baa3ab869c9fc03b91e9b627a05e411e2f27387e8e2f4567b8cb7ecba499
Files
-
e073baa3ab869c9fc03b91e9b627a05e411e2f27387e8e2f4567b8cb7ecba499.exe windows x86
c51b308cc6587b44c4b8c8af6b266c69
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetClipRgn
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
ioctlsocket
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jkls0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jkls1 Size: 15.3MB - Virtual size: 15.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ