̯��B�\ ���}�:ab���Lv�����E�[�~��r�=+��G9�1+���d�Q����YН���0Aߦ������ğ�R ���`E�D�u[���n�����9*���*��;H�*�~���/k7��u�E���dG����X �4���|wνN%��N�v��4��O�N�gߡ�QYڔŚ)�X�p[DbG�=�x�=��:���Ƒ|h����� gp��+�ÏY�;��~��M��I�56�i�5��+�_� ȕ�;qFUb��'Zg?"�s��w��y��������䜷����d��a`��oV�`�A��,�.��֊�@tF�|�R=��0"l1��A×pq{s�}���.�����A�:7Ž��:��#c����m�P��Tu�/BŁO�����jGӧN��Sج���ԧ�/�V�^gO�g�e����I����4���?�����9R��_3���x�r �ޱ]+P�}m�)�/�Z�3AR#��p��ʁ ;��]'%�t���=�V�����~���ƚأ�P��z6�����E�mU����d�{6����� �p���VV��Q~�e��P�;�� xo4�$#�Sx 4֑l�p$!'�j�z���룸������k�X%d�^�f��q�S�|����sӕ7"�y��X���)�TL�?�o����e�ٜ�����Hը)�#:�`yU� �{��e�{#NO�bb�%;�I���Ǎŋ�.�7��7G�� ��2J$�|�l�&DV��uI��)�������$�=��� ����p��]� ���ͪ��oH?���I�nS����t��e�;�=LN�=[-�b��t îہWQϠM����ܻ{ئ�Z�[�$�$(C���_�rB��/M�ٽ����2��=e7��dJ�-���%ܸ�t.�2}�c,$����O�`���������{P�0���,Vy�II+�1Z�7��;���c�D�-���F�=/`�� ���h�gL�饧IQ�KX�v��nU�XK;�a\�,���Ί_@����9y�a%� ������G�'(�>q��Bʚc�(���V��y�����Zb�����V���s������ �����l뒸Nj���N�a�^���L���~a0��5s�l^�\>����h ���RWZO��U��O@x��O����{YB���{z��t��-��پRyd�c�Ox��%,g�g�D��sc�j���v�FS������ 5A��\:�:����D|>Em�`�?�% �G���V�:t0�}� ��d�H �ج��[�W��Ix�z����_���V���'f�y���U.��I�P��؊�w�`h_�!����@�`���'�H���9��j��*�n��^gU-��<��˅n�'a�4.����+u�I�����0M<2��@�m��ѣ�#��Lx'%��oP�_�O��F�.oc$�R���ۃӏ�0��H_|�u�ϵ���9�om��X�s���9 ���H�.Q�y��kwIw �#įh�fF��#���D�H�.6"|bM���8&��<H� ��}0����>QΡ3͈������J[̦fo&F���-,8"���k���3gđ;�I�}18�k{y�����;���&�Ă��9�����z�_`��\O�0�� +F��N�´������p��^���t��+��$|2��x3���(�$X;����c��2%0�s��J.gu�7|��*"s�_-M����Y����̣zp�x����Q<��!�hbjp3� ��|��{j�6�9�@�1~#y�7bKc���k�1���M/�(<�*� SX�E���9Ƨ����bs��F��k�����FҖ�PEYحi+�eS,((���Gͭ��e�c���=�ڤ7W� �c��ٵ C��%1���o�����n1@ �X���R_d~��3��2�?Ä�c� �ж\{~b�)C�ťD}g�Pۙ�,��(Y70 ���ǂD�'�N�2��ƽB�ƪiX C/^��R�L�oh�m�������Ǎۆ��o*]�`y���z�>�Q�;��ss&�b�\���XG���7�)'�`$m͠�����GGD��k�.���8��?Rr��M��}�MW�W�6�K��*����ԋ��;^��lK2�jl��ZV���}ux�:aYI���|LX��������ҍ|������{ �Ұ^ �dⲿ������_#_^ \6�`�3C�ޞ�~D�)O�Wp'��T��D�nia���©��h�u�<V*�w��p�d��eW�zK�?8�l+f��C�P�����RB7�U�����D(��B@�I��y�.:�6JʋM[�?N���Ϋ�-"�Z���ݎ�Ƅ��+с�k�s��iD�Sk63������@��!doz ��A�r�d�'����\��t����G�=�6� t&M~���q�GLC����)6g�DL�"7��H#\�r8�&ܠ��5wX3��^�˼���©���#Z��-���VDϫ�b���a=���Z�\����mH �4YDpb������el @�P(J������@,���/��ZO��_J�>%�O��C��k�gfb�IG�e�L H]:�vj@��.!4�W�|)|���PԹ�K�z(��GM��]�s�I������V�cK��JۆB�9y�a6��q�E�#_����:0 }L��L��,�E��:~MW*�0'�Q�5�)�?���)����&p%���Nm��Aj4]F��7�Z��c/�g(*S���OOG8�Nb��角ބ5@��.<���Y^pq?�x�M����<��lM�پ�ҩB����*����wǂMBX �8OC��m��8���'��_�8�:�o������������Za�1�*���d�w�~�f�;�ӭ�C|9GT��\��<f�G�ڜ���WKo�h�f*���}�!��s��G�u�h!���Z�[~�՝�4��B�̞�kt����jJ�\b��崥D�������r�M/s���+' �U���D������fi��k�aL*�k[��J�"Ō�38ip��������R2�^��w�bMߌ������.����T{
Static task
static1
Behavioral task
behavioral1
Sample
120988497924677fdb6eeffae87663925c85b0b9d6a0fe7e2fbae1752a5e35d8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
120988497924677fdb6eeffae87663925c85b0b9d6a0fe7e2fbae1752a5e35d8.exe
Resource
win10v2004-20230703-en
General
-
Target
120988497924677fdb6eeffae87663925c85b0b9d6a0fe7e2fbae1752a5e35d8
-
Size
5.2MB
-
MD5
6560377dad0b1e3a2e8f44bc82f91f4a
-
SHA1
138d309453ce47a711432f8ff0c6e32e978ff97a
-
SHA256
120988497924677fdb6eeffae87663925c85b0b9d6a0fe7e2fbae1752a5e35d8
-
SHA512
3b17a9f65ed9717781692f1d0eec349ffbd03e8b7543d8bc3d28ec4d02885a32fafb8c979ac53e31ee244495fbfc63b8c8f448e5c88f3371c751640b1aea5f62
-
SSDEEP
98304:saBp+pzh1J+E+2e4l+Zon9cZgOefakl78nUT9Fo+Aw12Ltf2y+Q25xPm0+R:ss+pzh14Y5l+Z0Yg73GavLAv56h5xPmX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 120988497924677fdb6eeffae87663925c85b0b9d6a0fe7e2fbae1752a5e35d8
Files
-
120988497924677fdb6eeffae87663925c85b0b9d6a0fe7e2fbae1752a5e35d8.exe windows x86
c33627d2046ed7f4e94cd56ef353f76d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
WriteFile
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 551KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 707KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 786B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
.data0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ