�HD<u�&&�Y�����ķ����+HC�J�������G@���[�����N���~�:0�@���l���-U�:<a>,�.�-3�'3���/��#��W5�<Z̦��3���A�*'gȟɱB~0сLM�%�([Sr�P e��� �ګg�-�m*����NH�dcm�7�ѠG�0m>Y ���f�ldV����9���Z���i�al�i@3T�v���� ��H/�Э��ks�b��*-��)�}���h���.$#��A�����:/̯�j� 4)VUY�����ޣ�i�/�D�5ϵ�tzr�z�(�1�����1��t���D�������P@��|�İ+�cc5**y�Nwαf,-&�0؞�����Ϡ�-�I��O�5���iYp��S�u�D�.:r�MU)�`-����%�Cl���6q0ߜ����a�%��V���ci���M5��P�q�J4RLj��Q�.�I(H�~/�p��B��F.2�p�1���W���Y\�kaf�s�\S�5�]�O�?�_����a�˹l�w&������ ��EIt�6g���[{lF��8�~�եaUԉ7�By1L��$��ĭqplWדR��J����� ���`���KW����mAضF�h��U��<ѩ�4���n������GV2=����.����a#[�Cם���\�䆺�b����mQ�>G��� vT����ly r�?+��2�l���y���&�m�����J*'����ysm ���=�G9���s���J�&�T�>7�LKQ�m�}ޔ'�jX7/�)71K��S�|���*VW��T�K) ̃2_�H$z|�T8#5�v�t�DžX)�Z�`$�����f���)˩�As}`��\!��Z4�����B��W��0c�� W�t��&�6L���X��q;;�oZ���gj{>�>y�pʯf�j���8�������!�y��R��*qPC]N� ``�ل��a6��{5I�G˝n�=��&I��|T������T5RT�5X��ɳ���Nv��bg��؟jT��*[$�6-����� Wϕ1�&�\��ר^f��"�D��j����ɣ0�Hys�]lv<�~ ˴*4��4�-N.���节γ�M=A� �8�RyuS>ju�;eڣ�s�Z3x��x%g$"�]�x^19����=��l�c>�l�m�6uBv��A5�h�yH��R����˥ù�_����]؞x6 �x�o�wN08��@���t1d�@r<�mڦ͙�N��e�Z�,���ҳpr��-���$��������u���T�8R/�%K�+��}�D/?Z��8�)�\���WͶ��"UekQ���̈́O���5r����?6�K6{�v�o���t N���������$���d�IO]�F�/&�M���'g-��IN]G�]�m9����g�A�&���4�]���<$��^Dt��֜N� �6i���������v��̱���E}7�~�إ� ᣖi:K�Æ�J�����w�{��l�%�8��AHǺ��{g���-�LF]��1������n^�l���/��1�U��2͔J�i�Kz?�����0���������bW��E�g�i�|�DM�������֍$����X�wԍ���i�6q�鉆�u�J ��+@��*�'*���g�`����Y�E���#|-_\�^�W�rbC�kt(��R���E����w��x���)z���L�("�V-p��S�>9�F�i�sĎ��ijt-��Z>2<����u�}��_e��#ըP${��dK�W��D7��\D��B����6Y�JrlR�7�n�:����q`�2�\�'W���������eu� ���������Y.�� FF+q.6F����Rg�Q�p'C7� g��0aAL���)�Pea1̙T���cJ���j������k��9�uZ�.�k�=��2n��(`Uy-v_<��I����뫢`+����@���͞�F�m�C��}�>�`������p� ������9#K�kf5�!+�.��k��/��_�L.���ҡ�{x����+�E�?s\m��X�`���ۈT Y�����!ݖ�|Aҧ�y���^�1�T�z��.�`�N�8�c�Z%�vg�������c������L�`���<�۩c��;���y���f�/Vc�*̾mh��DP�w;��%D��ٛG)_��" SRu0C쎳�����at4�"T6ۭ��;�:O�:�W'{=���U�e+P��G��������*��lf�r�fI��Z��:�uy�5��#��jd����i�[��a�'%��� P�)�QԧP��ߣ� �0�<0�b�Bj���y ��Ex�?��<�AF�ܭ��u{ ^>*�Pm�$�s�Q-Pa������O\WY��a^:.z5�Ӗ+=8+���hL�H��v��G�Iݲ���>E��2������ n��"���,�sV������M�tp��,յ�Rxe�����;��l����Ġ�/��A������2-n�v�S#�����_p�� ��֊����������Ԧz����(�H��c�j�M,�����=�R&��#�"A��a��J�%:<��݃s$a$ɬ��M� �.+�O���e��� ]�W�rn4}�½�i��G:8Xh�N�R�&�X~.��pL��i IG��L��N���'�^�̻���:��p Z��0���iV����]0�H&�z{B�1/�`�����X.�Y,Dnv�\�[.�ka���`�&`N�TѶ� &��3L��a6 ��b����յ�b~�2��w)D��p-qS'}q����c���4�K���0Q�MS<�Y>��&!���m��oc^�Z�-��YS.1�W}� C�V�r���;�剈�y'`���դ�A���O����CI��rS����# 錠���ﱰFvV]��O��ȉ����1"����z�X3͋����8�}ס� M<��P���W2E�V�I�k���ey�.hws��ԲL[�c�φp���d�X�����y��u�dͯA��ٍZ���p����C�5!͝N�Q
Static task
static1
Behavioral task
behavioral1
Sample
2cb306347e75992ec66e72253f4ca1e4c50c0198eb80b6f7edf96abc92731ff4.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2cb306347e75992ec66e72253f4ca1e4c50c0198eb80b6f7edf96abc92731ff4.exe
Resource
win10v2004-20230703-en
General
-
Target
2cb306347e75992ec66e72253f4ca1e4c50c0198eb80b6f7edf96abc92731ff4
-
Size
12.9MB
-
MD5
83cbc3004d046b9581b83b094e66055e
-
SHA1
f6e6fc6772369501373d89ef0e51277e3c3a48ad
-
SHA256
2cb306347e75992ec66e72253f4ca1e4c50c0198eb80b6f7edf96abc92731ff4
-
SHA512
5ce597a2c22c35aa46f35fcb79a566ce3df47db6918beb655d3ac23799213787b1d16c39e0ac2864755ac71b31567ae09af05c8fec135734da987ce25afd0160
-
SSDEEP
196608:PNRMvM2DHSF/bJs8veYcz3p1atOkZ2Q+ws1nj0a+idjVFeE39Z1p9AszIf:bM02DH+zq7nz3pSOY2TSaZdL39Z9As
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2cb306347e75992ec66e72253f4ca1e4c50c0198eb80b6f7edf96abc92731ff4
Files
-
2cb306347e75992ec66e72253f4ca1e4c50c0198eb80b6f7edf96abc92731ff4.exe windows x86
a69c3107c93e318bcff4c43b763b284f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
CharUpperBuffW
gdi32
SetPolyFillMode
winmm
waveOutGetNumDevs
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
SafeArrayAccessData
comctl32
ImageList_Read
ws2_32
WSAAsyncSelect
wininet
InternetSetOptionA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: 1004KB - Virtual size: 1002KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 100KB - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp0 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.svmp1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp2 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ