�ϊ�� -]cQ֥��ԅT�&������5��3��R����o٢=�F�AZ�m�k]���1a�l���4����/T��z��"��Ө�H�]�R%=B�5���ן!�w;y^���e������|.n�����XE�Q�� dB["K Xd�o��XU�E�)#�P9�0���:?q�C�f6�F��T���ޡ��ed����g�9p+�)�'a���a����Xˆ�W 훘(]�������C��MC�Bf��k eeϛ�� 2mql�*��LN�`����}~�{�|��j�ҙ�I���l/p����1~��ڂ��A�L9&��ja��<��W��C������(+*�jCc���,p�W�\z�^6ݓ�/��V�+�YEW~�>J�o.V��s7�ߕ�\�� �.�Bͫc^���q��T�n��v����:��r�k�������Հ�br7�8p�mE�k��Fi���"{�8��[�q�#m⍉����W�7#��}y�O�`y����O1vs7!ڸ��?$j���pirN��r�E��J"�*b�C� �0��P<g��gD��Z���o�P� \fh�Gpԓ9�:ZcG��������L��\xR� G�1~Z�]93~�zqc��+��u:�/�9?Md��8��w��s���!�*h��ρ*�0L�8�:�Vb��E)�L��i���`{���ռph��ˉe�뙖�1d�|���ND�&]�)[����b���VJ��K��bA���#Q��G�ة�� �1}T4b�M�S}���g6��RY/+\�7m1�H����X��P������Xf>�r����Ь���v=&��zsS��Q=)�Qj���~��uG՛�e̖%����Q��2�БA�-����G����OvW�[�;��D����IXg*v#�o%�5�H�`�ףks���'�H7�3~}�J�B�"G�D5����Ԩ��;6d��2��X�U�ܞ��7kҲ)3�ܶU���u��D5�7��~-YI���8�l= ��re���Fe��i3�X�?kE���, ܺ��� ��2��]]��;X���4�ѹ�K�%��DpR�#G8�{��E�,B_Q"q`��ޤ�!����h�H<?[�9i���g��� �_��'(�Q��<��*Im�v��ΰ�\�uoϓ���s����)���Pu#��ft�x�3,�uiY�И�_u�"�8ȦE��Y�|h�-�S�o������%� �����k�2^��P:�=\/�XpJ���N�5l��h�= �9��'i�������'�C�R�������~Z\kϷ�ݡi��Ǥ���TW��<8A�g��a��Z6�F�#@���|��"L��FK)u��g6�y�����U���86���O-܂�J<�Y6�]O�Õ���'�w��� c3R�+_h�w�cMj)�q�y��ڼ'� �Um:~�{� ��5��Z�<�Wu�Ht�f.ep�M� �4�_XY��jj4������H5�6wmL���7�sZw�I�x!��c�[P����j%�3���Ra�"�]L��]Bg�R���"�SG=�aI;��R������hvF�Τ|pC$��~&��75�g����U�+�[�<Y�z���tg�ˆ��H�osu~4b�v�b��W��8z�f ��"�8t�w*�.�:�.�y��Zr�Þ�6�-�!�%Г�o��Pˠ#V �I7�wx�k���T��4MkR�$��j̣��Qi��S���$�������c�����6��]�<[m9�{d�2�2DYս4[�������y 38JL4���ڰ[嵾-$����0��d>_��z�>Y���腹��&���gCl p�W�#L�P�AT�V�v8��m���e_� 6��ڙe�?��Ҵk��m�ǖSB!���h<ޞ�fRµ�_`���O��n���|o,��}ˈ5�d���В��ȩ$��2E���>��� 4�&I;,2K#�*j"�f$��Y��Bn]aɗ�-��y?Ù�@��BʻG̥�6�T�+u]21�g:a���/R�������$��,FxF��b�R�Kv#��T�jX�����֘1���5v5� �(|b]9�lK��^o\E�+�b���)��.���kvlD��9��ێ��n�!��H%^��=j�FO�¤B[�:�5Щ�c�~�Ԑ���Z]�NdVnIx\���{�L>c%���ص������m����_�����pM�T�$�����#�Cӕ��]���B�Yw�t��u��iRg��S�+H�`�ש�M�Ʒ;a{e���(� �E��YE���R�x�u�����X�¥�ם� ���.=+�`�1�0M�-0�,kW���*x,G��_Ɔ���_M;�ǁ\~c�����x������o�M`��G?��_��c��k�����kjw�W��1��.j���eh^{|��:�eV��q�Xb`d��4��d��2.�6x�u��2����[ ����/�?��SO)exC�ey^�KS�y����f8~���b�%���T��3��ٯ�Oo15�좵UE��.�t$ެsX�Y�eʹ��'mG��WR����9�%,������9A���*���%�\~8͑Ü��;��r��Uzk �tԟ��Ο7f�X�q2����D�S�p��Hxd�i��r]nD^N�ƇϮ+kF�izA�s��<��=��d(���L���x����ԑ��F�X��E�S�iy���!xYp�$�*o��#�b\ͥ�*��@���?K��}o{I퀍}��!�H��X�ɎQً�}݁8�z5Iވ�-I�AŁ����~3\6�U\ցT����u�0��XdU���M%�QAi���Jy𰝴��mJ?z�i�l��y���U�������Òɉ��I��u^�BK��..�l���2߆���7������h�Q����l"����ƙ���u�k��mG ?i��dH⨉0�n��8j��Ifj���h��t��^�/rk��9 �Z��Fv=�� #ռd�\D*�ZMmph���l)9��QY�8oū�������� ̙O��ܣ��Z=��8��������?��i`�\�gvy!���Ȳ]:���Jf�ڣ�m6��,�T���B�AB��RI��Y
Static task
static1
Behavioral task
behavioral1
Sample
fda66b7affc0f60f635cb31b0b6b0f3eba1156e71f04bafeb0ea8c37dee0dd71.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
fda66b7affc0f60f635cb31b0b6b0f3eba1156e71f04bafeb0ea8c37dee0dd71.exe
Resource
win10v2004-20230703-en
General
-
Target
fda66b7affc0f60f635cb31b0b6b0f3eba1156e71f04bafeb0ea8c37dee0dd71
-
Size
9.9MB
-
MD5
d8343576f47f6f494c421a4bc3e6fa6b
-
SHA1
3b818049be26b85c4485f6f46c3988acf6caf4ae
-
SHA256
fda66b7affc0f60f635cb31b0b6b0f3eba1156e71f04bafeb0ea8c37dee0dd71
-
SHA512
e975517d7f5826ce0aa4d049400f89cf89eb2a882a8a306d4c4d4df4c52321fd68f7750c65aa30b9f999f79407f22101a2dceda4ffee4615c039ed408066bd7f
-
SSDEEP
196608:u07KbnK0hVZ1/Q8lcIMs8k8Dzk4t69zbVY6XrwVez4YA:9813/Q8lUk6gA69zipr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fda66b7affc0f60f635cb31b0b6b0f3eba1156e71f04bafeb0ea8c37dee0dd71
Files
-
fda66b7affc0f60f635cb31b0b6b0f3eba1156e71f04bafeb0ea8c37dee0dd71.exe windows x86
2d726f6d81224c23e5fc21a79a40d1a5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetPropW
CharUpperBuffW
gdi32
CreateDIBSection
advapi32
RegDeleteValueW
shell32
SHGetSpecialFolderPathW
ole32
CoInitializeEx
oleaut32
VariantTimeToSystemTime
comctl32
ImageList_AddMasked
psapi
GetProcessMemoryInfo
shlwapi
PathIsDirectoryW
ws2_32
WSACleanup
gdiplus
GdiplusShutdown
Exports
Exports
Sections
.text Size: - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.^ya Size: - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.1Ou Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mT| Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 365KB - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ