^mX�XoS�Uܤ��:��ٙ@h|�ע�)��&S�}�}�d�쒔��p��A��֫�h��� �,M�-��Z6e�Pe�ݬl�R����m@(YE�xkLU��e��� �+��5c���oh^�m=<�*9��c\*�W�E���*r92���c�wm�@*��+5�1��������W���wF �]Ҫ��<g{f��Y�Kc����$������]<�A�X��z94m���!��N3���ݗ ��ƋP����/h�i6%o�_M���t�#S�pXP{&7E�+�$m^֤�� F/B�H��U!�X�Uw��i��Vr��)[h��%g�:����C��ݳ�>4�=��E����LK�b~W�9%�j�3ɞɞ�� `�rʓ���UR��^bQ�s&������[Pſ|Ɉ�"Ԡ 6�Ab]=�Y��*(�!���"i��9��$�)���^+��������7琀۸��@�u��څ ��=�>U�P}#׀�&&����}j�4��+����E��#x#b`���ϒ���oN t���ܚb�J�(����$��y9Yey����!Z��z�^j�"�s Q�pz�h�#��ZCkh���M�$��9�,�����m�����kb�yr�P��B|�Z�� ��ӺY� EK<�[��7�v'�a�7�fU߁ `4!�#�����96w8e�ᝧ��t{�s{���� d<�����9�m8�������yئ�'�^>R�U�? ~d�4���ߐ����c���zGqz[�i��³���%����t9����l�̷'�ݩf��la���M���?Q���P����ܾ|:�i�b��Ǵ~�٨G������ ���DW�qg|��4���Bȁ�@���k��g=� ��7�ϕ<�[q�GVԿF�UR������S&���5��R Τ�Ρ~v�{@�?��FL �3r���1O���?qY*_M�m�&m��ȅ�l�kJ�'t3�L��G"����m�j���A!:"jv1�х�C�n������9�i�E���Z�MЙC�t���ɣ0���Z߶�٥���n��x�4�t� �PO�7�3�%�+�!��~ �#A���v�mJB������%T�B`)��佱����@n� �rJ�Ul��jm��1�3�5�v8C 8P�YA�n�Ԫ0:NAI�����(�pz�{C؊�E*�o4q�}=��(��c��B�F4�K0z?݄-�?�Ē�����[U9s6_�7H� ��'=�����r<�X����(���_ol��eR�����\�.��H��� e�/t6NC[-3�2YQ�)!�'h�!pl�/LiF��������]�e`����7�I�sX�(a��6W�����/���g���0-ɘs��|k��Z�i�Xߠ� �om���ѭ�^4�YDT�*����M�m�$}����ţ�Ix���j����ڠ�O|� �=����5ƿ�������� >��:�a�7>.|i@E2cp�+kw�+[�@>j"��6���s��v�6.zpO�xP��j.Ẫ�w��(v��g�"�?֦G#.��f{0��0�-90�3�$����$X^< �5J,8�fn�����;V�[�D2z7�/���M�ٟL�`���9�qԜ���X�x��P�z040��Y�����`2I&;u\�V^jŪ�'!�ܟ0)�:fRu�E�Y~��Ĵ�\K�w�7/�m�d�g.�[a�R������P��hI'l �r+8蝅��U��An��@l3�C%�W7<�GJL"R�Y�R�҃�܈V��/�nbk�>��tbB˄��������l�Ԯ����&E^sm'���h���db�hYsͺc�臟��l,�P��+�@�/ �|{���������Ċ9�8��Ui��WWu-Q�쮼��I"9�K˖����w�*W%HS�~���X�0}2�n�<��S.Zݩ�(�,��jom14xٛGd��|��|2 �r� ������ �O ��[��Y���~6�e 1� vԸu��ځ.�YƞQ�q_Vha�B+|`���k\YJ���������!�� �M? !XhRT� ���P�ĉ8x���6 ���b9f;�o����p@�LC��l7�xUv�J@�b�߮fU�ˋ�_��>��.�e������Y�9g�'`i�����,�g���r�\��hς�����Zd<<�%FU��%q�g�56��,h�" aQﷳ|�$%:T1�qv��F��9����ئ���k&�����F��w_w:ݎVP�ɗ����Y���ڨ�!ғь���y�~0��\�se�D���vX(��k쉨"�,�ڬ::��e���c��y �c��9��bG7�զ����uC�H��l✦uG=��zQ~�j���>.����d���|M�J��������\��Α\�����4��.��"�S�Ƴ|4��1s��v�T��� c!�!�a���j�Nυ��^b�/d<Z"k\��6�&�����3x�Ղ������&� w3�E���A�)W dH����킜e�|-��2�扇l$��M)�LJGr�-�Q�Vr��&W���rgRl����#��9F��|~휤���CrN��6@���g��^] �����B%Th/�?����'x�4Y.sM���i�_VQQ��p���ɔ��bia� UQ��f;wHk�Mu�����Z R�M�x��x����I�@7����� }�K`;�*2��Wu�5o� M]�D擅X���W � NO��)ɼQ<b��y����w���nr�G�� Yres���sRE��S�$?��yw%B���q$�����⸶��㷧w_9`�W;u"����Ȋ�qm�cP������Q �n�Ot.��eL�7��?�x�Ys b�����?Z:���� B��N4 NF���'��S`O�0� Y�C�a���G�w |��H2�b\��i��1p������Q*fw�4�N��o��f��')T�j��}�8'�{Bh�Y�,pw.B�ҍ��D���Y���-5�6D�W����X�f ms9=����e��&�"�،�[�SFv#)���&.�&�� ��2_
Static task
static1
Behavioral task
behavioral1
Sample
dbb77550b1d269381c97091aebc003daa667d0517518241b396057449af1e58e.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
dbb77550b1d269381c97091aebc003daa667d0517518241b396057449af1e58e.exe
Resource
win10v2004-20230703-en
General
-
Target
dbb77550b1d269381c97091aebc003daa667d0517518241b396057449af1e58e
-
Size
6.2MB
-
MD5
fa2717ece2e52d0497d5afd364a82eae
-
SHA1
dafc1c8d7acaee253357ce8268c696b9c4b6bee4
-
SHA256
dbb77550b1d269381c97091aebc003daa667d0517518241b396057449af1e58e
-
SHA512
6f019d6ca1993c102ec70d6b48dbde06a26e4e60f3d5339568da140f3a8351a149af401b164afb5683981ecf1fd6c2b8553c07edeb0bbb1ef162ce688d80f282
-
SSDEEP
98304:OCJMxjdYNjSpAo60KQLuDIoSmSIrePF4jbfsdtYq0xQNrM:OqMxjdYJSyNdQTmSIrePFECp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dbb77550b1d269381c97091aebc003daa667d0517518241b396057449af1e58e
Files
-
dbb77550b1d269381c97091aebc003daa667d0517518241b396057449af1e58e.exe windows x86
c24ce2934dd9e17d6f67b228b2744461
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcW
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.{u? Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Q&A Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.f>\ Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ