��d��sMf���L�^'���{�������ϱ}aͭ/c�U?D'>7O���͕�&���t�W�l/Q�SF9K�"bK�t�Fr�%[ݡ�Ծ�.���/��� h������Wg81t�aF�X��,��I媙 112il�x��|�o�!0����\����׆��8��q�+���\t�nb;*n�cI������`���>G���������x��(.����JD����r�o�@�}Ջ�$G+:*b�[�&&���au�W,����#x{o=��`#���Z��@^2[P�ڪ�r�I�$j�����6o���4�H����o��,:"͕=�h LƋ���ܩ��k�1��G�R�<��k�x�N�J��,_ �����l���KQ���+�\�\�|��wIө� UW4���ňj���}ƿ���"�7*(���RN�xn�6��O�3�<OІ�=�u���@W�O�QY�+n4�$�֚v�I�ۍ��.��ѠZH:ҏ�2VS��3����V���h�%,Vdrȗ�:����λ�*����t�ܺ�bO�u���;%���/ท�A6�̯w/}�a��]tl���x��j[��,[ń[�%�J��/�\d>4����m�H�x����������_׀�F���8�ol��c�0'�9L�~ooK�@>88Y��R$�\M�)U�&_�x��)2:��0d9S��6F��✴I&R��0�g����_׃��P� �� �N�Y���y�u58ަi7�l-�hf�� �I��;�&1Ȅ��D�VG+hȼ�3S�@d� ]���Jځ�4���3F5��xA�to^� ��%��#ֻW�$�mb�����a}�NUdJ��c9Ϭ�ٝ� �=AEzw���j��[���.]p��qr�|�4�X��T.�Tu��s�uT\�!�:��o]���|g��%h�L����.#|��juu���1�%Ap���#���ZR����ܹ��`��O��6c�f�b�^I�G^xL��D vX`��檬���{��n���cm��[��}O3�����f܂�7���v ���7*Y�����JE�����&Ӛ��vs) �Q� &���d�Z����k������Su,�^H��[7H�J�=��x�`2���,5��(~�3�� ���Z1�gΡ��u5�k+*� �~�o�ؿA,��� 9��m0��S�#�`������L��o`�(�/�ma����K�7��@�ƹ���!�Б��dM�(��{���J�~ `f������x��X�� �0$� �xQ��R<|�p���*���� ��F��i���"�Cθ%(���نN�ڹW�c���JG�pna0ߕ��x3�riN)^�n1^��7���ŹȰ�~�x��]��ycSOKR/��P��/������9��[$t.��N�H�,�,�҆q�ۚ�AtQ�|��D�*���\�@����8���6�����y������H�UY�����%e��I_@{���K"��O87J�J�VAN|L<,��7�h|ύ�ޓ�0�~R�%o�_"�����&��ҙo�NF������wb�P���}�[F�A��iT�*}C1xAE.�8��a^ki-�HTH���i̓��$���.�2=%�m}�m3�_��a��&�����$��L cOUoD�2V2��|���.��I�Ϩ �e�t��yD���-��l����c��ǁ�������T� �]�x����)�V�>��|���aQw?'!<�_�uJ� +�ggF��? ���80 �\��.,s��H��~�I����!��a� j �K��;��&,x���j"fi���v��Tbk���L����4����l2�Q�~��S��v$_��w���K�� �ÖH������H-r�)��EQk]�-2P`�m��`c���?������&<1�������c�5�~_��-�5OW�O&A� �Q 6��N%������b㔕 !Sd��{���uA�;@zs���`x�G; �Ť%����6��|���zlʄK��;�)v)��S�(ᥢ=3�"������'b������f8�t5�T��1��f�Ka7z�E{�|�>U�cv�=�ɐ�� �l�WݨT��;6���U��HtK���u�u� �7j��{O��ad����'QD�!��B�ܟ=5���NY-�#6m �P�չ�{*@ 9��"����`�gUx�q�Qӿ�����aw)�-K�e�k�� ��`o��|�*߮��0C���b��;��������Zk�������� ��� "ft��M�y7�����ߤX��\ƿ�~��nm��U�� �˕�/?�b�E¦�����u�Q$Z�\t�FFc��� .��:�8n��#x�N�5�%p�\xUCt�z�9�����KiT�:���q�u^���:|P�!�bl����۱Wn�h&X&ҍ��nR��d^��NI�g}B�x.����K\�$ A>��qJ�cVb���3V��>n卷�.���Y����OƸ����8�{�G��7�P����+�7�QZ�@�v�v`���!=P�;�����P�>x���8<��sn��� �u������9��:��!��Ti���҉�;�ͬ+�~���S��aMN�q�ui��e�G��w[_�^� ��&&,�sTȴ�,d��y0| նO9�db&�����C��)��oz��q 7 ����$~��L�N��������=I�yuNٿ����i<�m�1ؒ���pr/gw���+��D�%�G+#���6�4�Ɯ]���~N����i�����/��=�In�~�/�W��5"_�m�Ri�=�#�h�W�z�IX�<xa�r�5�:�'6�]�P���ׅ����Q��d�������uAxI����g�O(��S�Y���9~ب����s)���X��"� ���s�?7ɮC-�%>m.�f�s���,=�+v�#�h�����`�i^�6�3Vt�>�n�~�,ȯ?��UlN�g�EV�e̾�ک�XSݲ�}��gX�\�Ҫ�w=O8�Fxge=���5�\���,ch���2�� ~d
Static task
static1
Behavioral task
behavioral1
Sample
5319eeebf02d576ba51aa55fd78da8af4e40f4b07f71f0c92d87bba0f2da9122.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5319eeebf02d576ba51aa55fd78da8af4e40f4b07f71f0c92d87bba0f2da9122.exe
Resource
win10v2004-20230703-en
General
-
Target
5319eeebf02d576ba51aa55fd78da8af4e40f4b07f71f0c92d87bba0f2da9122
-
Size
6.5MB
-
MD5
5ffcea98e9f96cf371dd26763929e2be
-
SHA1
d373363c390bfc94ef7b5c9ebb21daa19e63107b
-
SHA256
5319eeebf02d576ba51aa55fd78da8af4e40f4b07f71f0c92d87bba0f2da9122
-
SHA512
5240684cfb6c2a811544d5350023992c1aab3d7b12356176c8377b0a9b00b407dc87f07e4be620b8b15fb478be794f68befb515c5057a0c83aaf0742ec3e7c3a
-
SSDEEP
196608:UHilH48Yqso4Xf9z/UFtKJVJ6635keuBm5:UHilYm34Xf9zGQH8KLEY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5319eeebf02d576ba51aa55fd78da8af4e40f4b07f71f0c92d87bba0f2da9122
Files
-
5319eeebf02d576ba51aa55fd78da8af4e40f4b07f71f0c92d87bba0f2da9122.exe windows x86
c24ce2934dd9e17d6f67b228b2744461
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcW
CharUpperBuffW
Exports
Exports
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.&zf Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.`C: Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.=Gi Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ