B6�����i��Y���Vs�uH����#�dW����w����b������"II¥�ύ�ڗ��G���_� �l��}`�U�['��M>���e��Ɵ�����P�5K�vRY7�Pw��y�܉:�P�2;j���O�Ҭ����7�F]�f�z���2��� A�jg��,�^�z�]����}���ϩy/b�VyR>�Ѧo�Ɵ���9�q�뢍xl�2���f�g��5��k�\N��"���d��q����.E��*"ȉp 廬`�\/nbO $E|���֬��/ٿ��~"qS��tr���R[#r{kS(��'�C�~v��*��#���)>Z$���9���$]�曀�VW'���?^�X�6��@;䶷�0Du1!Kk@��0(@�x~�����+,�xdҗt���!%�6Y�x�d�/�d's�w�/����`8��h^#�+^8�q}˟��U����''���|��ߗ��}�(�6iV�L������qSM���r7ɇn�Ț] qV����-�����=�����[���=1A�A�����(k鿂x�i��b���K���4oLZh��ro�`Y��.wP�ykf ���o���y��ņ���YXu���R�O}�5�� �\Q� ��9�����.��ҋ���������Q�Hib�� �%��t`C���e�zzl��4h���m������F�L�v| �o��Q��[��>����Oآ�[��Wh�}]�@�pR��xz??JK��WU�[2KyB���$�5��P��pv��4STN��r&AK;s���D�p�zWŲ�b��M @���uz�W��AQ��B����,OY�n��¿#E*Bu76#�%D+hެ�=���_�p�m�L��h�]�Q���8�c~F{�#�dؠ~a�./Tsgݿh\{-��Aj> ��h��R�e�P���-]�WJ)�|K��h���p>��u,�$�T*�ldv �:�sV���e7��������� �0#�s��!�n'�������Pw����� ����Ho��[��p����=������w� ���Ɩ�I&kutL- �'(���-��ȇ̕ٿr��~�)!!�������&�ODr��� ��Ä|SB;���0;����+{�Q��>m�{ �vf���ѲN9A���P7䣅��hV�ݻ��&���;�T�O�u�_N�K��؋��T�:�z��uD��o+��y�J=t�r^ K���px�� �����{�`r���г0�#�R���ۦ=�;�:h�0����J��\ډc��#_���|Y>��j�cd��E�G���R��d����q���^�+<�>�K8��!��9���{|1��[��X�Q�Y�j;Ҧr3�Z�h�7����z�@C��Po�U�R]�1�{AS���ՋE�=�Jrd�^���&���R��r�4��{���� ,lS�q��K D������>ڭuw��=���1�ܴ<����c�ƿQ��QX�I@z�zm��%�]���������������� ���)����M�E�.�BC[ƙ�3|����n�|�YO��B��ς�� �����U%N�,Pe f#�VqN��I�|��7�1|E�l�m4y����F��T���BV�_-���S�-��j��>���c�R:�n��k!b��u��)��!�4Δ�,Ֆ��m�s�TP+W��v�Z ����/Ť,eca��!|�u�$S��o������h��E�y1�pu�z{�l��IxK>-���~O�̰�����T9�@�$!��[�"�,�p�=W�����}@�!/��gv�#�O�|��K6�y��0}lY��"���W�y����h�5���mO�ᤉw��hj��g��� �'<�O��7N��Bª0@�:���A#mf���[ ���#�B������zJvӫc"���`�,� N�5��|���v �+pE�j����Ҩ���K���Ҷ���(����/�����}��m�_1y�j��M$� o�.Յ���&�I �l4x���N�����'�o�T�MFr�m���=b$��Ct�[�T��u��0P�|��vb>p3=��4�c�ջB�?1�kf4�s]�P���Y:K�Y������/tu\o�m� ��L��BĪ ��æm�RCc�>\qث�6}�S� ��N��Qb��q*oN[������<��$�V`>*W"��n�咙�^����j���mooȺ}�����u���?�2CZ��8��@��:��b ���wOY���ers8��Q����rx+M� k�̦��7��G�6�������9��<_E������l����6;�iVYY@��q"��0�l;[o̹����R��ӣ��l�ԡ5,��8_8���t#�,��TB�rε��r���کO��9t��ח�o��Xǯ��S�X�g����[P�Y����4ݪe���,�&�%0������b��)g|(� ��j�YP��`�|���)#:��9g��w�� ˓��H�6�����|G)�;{���\��g&��m<��C�#J�ti�LvL�E��Y���J�:�#�����k�kC�����(5��v�#�R,W�O����}�/!{�f��p$|�_fn�~ ��i��u�!�S5��o���G��331�{ƴy厷?��#�k��?�N�4�&���k���qu���`��������lP�ۢ,]��7*3�0��ʃ8;i6�(�j:"� )Ҙ�<R4�Q�.����A�ɝ�߽<3|t��-�Wv*f�{�|F���� ��#�� [�Lƾ�����7�E~=���f���ym^�;bgK�τ�����Ǐ�{�'~��6�<!,����%g�H�ye����=P�f�L]ƒ=lt�!���c(�5�6�\�I����Π��@���@cvg��M�=iFt�� �>D*A?b���`0 �A#�*<����c�H��u�4��}����r+�H_��e���p\zc�Bi��u(=!&/�~�rS�j�v��~|u���CA��8N�� X+�� �K~y�n���q��4S��bq)!S�e�\�! ۨy�z�c��]�0�C�w��u�gQ
Static task
static1
Behavioral task
behavioral1
Sample
d8047a4ea8950604a321bd0a2a3cdc6244443c9b44788690e07136b525c49d71.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d8047a4ea8950604a321bd0a2a3cdc6244443c9b44788690e07136b525c49d71.exe
Resource
win10v2004-20230831-en
General
-
Target
d8047a4ea8950604a321bd0a2a3cdc6244443c9b44788690e07136b525c49d71
-
Size
5.8MB
-
MD5
6bfd945e8539bb11f628c5015da94a71
-
SHA1
3f8a1bf2df6c76dc03116f3b520823f15a1ff1cf
-
SHA256
d8047a4ea8950604a321bd0a2a3cdc6244443c9b44788690e07136b525c49d71
-
SHA512
c5bb3ea67645f797eb04aac43fd228793006a5628d0b34d849bc363a0cbe94de940b7406198e4e188acf709990fb2c0da90686b6cf7941d5148892022e91f118
-
SSDEEP
98304:ZnPzpMgRw4P8hykl3FUnfOnrOksueVlB169abWFyBGnp+FD72Zrhin9H+V:FPzCjIQl1RrOHu2CLpKqFAn9e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8047a4ea8950604a321bd0a2a3cdc6244443c9b44788690e07136b525c49d71
Files
-
d8047a4ea8950604a321bd0a2a3cdc6244443c9b44788690e07136b525c49d71.exe windows x86
256091500a328159d76a10d4f97ceec1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetForegroundWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
Escape
winmm
waveOutUnprepareHeader
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
inet_ntoa
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 545KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ