D5�o֖"��(lj�����?�~��r��4����d��H����TY�����g]u]��5:������j[ ��Nr��L��6�a�(�k(���Vs3/Q,e"�R �gc�xG�$hi#��KG����� EQ%��V�*��e(�dcI���+���Բ��3~"���\Ň����~�7� v�嬔<����֊�W�gWux� )q�(p�~^r�<�P�a��?M��wi{�7�l}U�������R�}�{ŭ�h*�u>r}��J����b^�Ic����ݳM��<ape�~0Ce{�h^f�!��p Pj��v_3����s�RT�G�/����D���Uk�ޝ:�i}� � )�����$�~Vt�^`_݄�!������"�s!����{���.T�U�Ώf��e6H����POQ�c�F>ӊ|0Fګ��GJ�z�v�}:�w�6��H�L�����8��s��f_X���x��%w�ˌa�=��o(�59ǘ~���$������/깃 �ۀ�ʛ�;��ȳM�������.hU��t�:���ؐO%`X�b�%��H��0�,ײ�`-r��������fχ|��?�숋�Ѕ�����7�:$�;0��ݶr�e��;>X1��g�#���Ko�\t�jr�Q/��CQ�/�G��:}nՊ�4A/���v�H�N�@TP�]�K�_���q��<�zS�Ai0k��g�Dt���X�� �7�F$�����1nFL�Gv��r�j�s���sy���8Dj�q�4�c,x��[�Q��z�$��4�ǍH0�J��O$P�v�ۉ���j���c����L #c�6��=q��:pè���>�G6��ˡg>��&�j-R��yY4��q�+P�a��j�b5���}��3����ÌJ�5=����v�����q�f��|�����[ �3���G���(7���c� WN9��N�G��_F���,���~#��+m�#� P���CM#�[z��R���r��z�'�a�!2SKnOiA����H#(}V���-V�ǹ��F��"�=�ܣ�%B�'�������}|���/Y�Bh̓��gF����sO�p�M������ϯ5��h�����ogܛ� kgsAޙ���-J��I�&�q|^�@�{bޘH+��ͮ�["+������~��F��:�M��]���X5��V�-��[��VƦ��PZ!�1T�<�4q��c����0L����sA���� ��ߎ ��֭7����1��|)xAk��gy0PD���������9)X�n��0��������6�B�UQ@<4�A,Qn�k�����y]�D�eoM�/�bY�X�@���Ж��K\W���Q�� U����N�|©�m��@���#���_���"������iku�sL0��*j% ����<_ �����z����U���q|X�h@_q����Y�@�Cv���ȫ<��me��AiR�@Y����Ri'LO ��y��K��BY).����w\_���t�&4���G���W6�O�������;�{�������c�хB/�ϳ����T�V�N��.c; "P�桧� Yn��B�G���ޯ�\/g@% 2�.�:����|uT��0�Ð�C:}zכm%IG�f�3ګ���Ѝ�yd����{M(���m&uP������-)��v��Ʀk�ɰ��k���g�k�t�>߫ L7e��Կ���W2?�T�.�/w� נ�Τt��( �EQX��;:�N}k�!�!�t�e�F ���z��p��>I���R'Z������C�����0"P. ��c�])b�O��`�ۗz�e����r�����2���b����G6YQ�eJ�':䷂��&,z�1K�`�WY�?�%$.يm��b�vB��̃� ��ѷC���3.Z���� i�V�lL+���R1�v����V�Dn�JE�ˀ�)��`�d��]�\̺9��r���b1�SV��߀�`]�����U�U$���$f1�PX�·�7�wt�����2���%�?d�C�;�g2�\���w? �9�.<?,ʆ}��i{�r�~�8�����,}�`�s!�����<�� ��&��U��| �������J��j��b�*�fT��{X�1���I��.� F�����W�E��@=�W�6��^���Y� ���e%U���pX������v���z������=�|��r��]�n=��NH��M����` �+�B5#z�L��c���=ײ��h�@�k6,������2IXf&�A�#X�����"�� ��:�:��e��"��I�~K-���'e�K(�o�@ȩN!��?A t^����r��Q���^��T��1�;�At�Ж���kՑ��"�Z�t@'Z�G﹠0�������;D��k��� �Gb6�]�`3��p�>�+D�5��˻B�א�!BEQۦVf@,�����(Õ����tE�#�m/� ���������sDU�s�.�6�#"�������@��ji��t�o���`�=�9�-�xt�������d`!���R&P=���A%����J=9+�V!�'�����2�A�A�� �^��'�"f�Zc�Ù�Q�����ItßqŮ�KXT������S�j�������YxX(�J0��T��F~$���œ`��z-K��IB�k�|uɜ�Z4����˞[�$d-���)�[Y� �0������b�����i(��:�QC-�;�eL�`�`�F`{r����}N�m �\�b�9uu:7U�&Q ��X+ۤ����V������]�Inw��������Œs����q��eflpĊ �88��[GPHfb�q>�7�������1M�:�Ӣ�j��TaG�J�\�_1�}��xg������5��� g*��k���BY��� #3+-Lj?�S���7�\���Bg��x�8h;�(�Z�_�����q�;�JW!҄C�J���6HN�����9��9r؈�0��6Jx�[�8|�/�2���!��in�&���� �M7���|���l�ڀ�QQ<2z=H4{/5S�I7
Static task
static1
Behavioral task
behavioral1
Sample
49870a9a095a00bda9c216b8b6583c087fcfa3abb8c29e4ed82af3070fa94ae8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
49870a9a095a00bda9c216b8b6583c087fcfa3abb8c29e4ed82af3070fa94ae8.exe
Resource
win10v2004-20230703-en
General
-
Target
49870a9a095a00bda9c216b8b6583c087fcfa3abb8c29e4ed82af3070fa94ae8
-
Size
12.5MB
-
MD5
737026c2e3083208c3013bb9f938c2d5
-
SHA1
208dc36aa490fa019cb980d616043cf77ad0e63c
-
SHA256
49870a9a095a00bda9c216b8b6583c087fcfa3abb8c29e4ed82af3070fa94ae8
-
SHA512
0ce7b82ce2fd4cd89b61a2d59cc0e82fe0f46dfebbbc66a3b9d1afa1f6292b2e69e124c3542c455a2d83a6b958fbb9721bba20b87d77e72e572f2450fa441759
-
SSDEEP
393216:TSihinP0xrVjWZyR8itPEodgTt7nZWrRGbHr6ZDsD:tuP0xoditcodgBbMyHr6ZDsD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49870a9a095a00bda9c216b8b6583c087fcfa3abb8c29e4ed82af3070fa94ae8
Files
-
49870a9a095a00bda9c216b8b6583c087fcfa3abb8c29e4ed82af3070fa94ae8.exe windows x86
87935fa4ee1dbb627de13cdfc77df117
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeResource
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowTextW
CharUpperBuffW
gdi32
DeleteObject
advapi32
RegCloseKey
shell32
ShellExecuteW
ole32
CoInitializeEx
oleaut32
SystemTimeToVariantTime
comctl32
ImageList_Create
shlwapi
PathIsDirectoryW
ws2_32
WSACleanup
gdiplus
GdipGetImagePaletteSize
Exports
Exports
Sections
.text Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.[t< Size: - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.\pg Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BYp Size: 12.3MB - Virtual size: 12.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ