N�r�n��n1 ��a��<����,�t�C�I����=5_"����[�I+�%��Sl�i�,9�T])���_?<Xd���xG�)Q�[�1���rAX�x�^7��f]���a�W Z��q;:r���(b�NB̞WI�Ž��ER+�� m�t�7�/&�[�!�&qx�&Kj eTǫy8Ez� ��:��ZO��Sk5��K�<o)��B>���Lc�k�-�����9�,u�`��h�fg�b����n�_Zh��%��[���B�b�,@ 7��Cc�J�AL ?K�b�\b�>Ƒ�B\���p/�1 ¤+e~|��Ζ��t����@6��ƍ�� �!��z��d�_�G���4<����сfp��Q ֓/��zlS*�R�`���8�"��w1͙ 5ܷO�xxD���T��LE�����n�;�����ʧ�vxR�Q��#Vr���� ���(<�@��p����Pc9;�$���A4�������Y� �5����6�D�'��e��-9������=@.����Z��OTQ��d�枓/����^����`�Ɯ���}���#X�����B�O�Ij��5X��h�mߋj�m����g<�aK�sGZ��''i�,m�F�z����8ddLAXq��a�K5�s>p�9����xd�#g���6��竿��F�h�� �p�9a��m���諍&��3�/$6�&�hcU-P��V$������J,��i�$��SQ�g1�HH�x�5�v�Kg=�c�$��H=�kxf�,�gF��\d���%�a���p�t�Fu7�P7;D�=�Ъ��>����Y���tĨ�>�=n�O��Z/�֊N�a�?J5�e��4w�]I�6s��4�`rZY���Fm�*����*�ߒeT3���hDim�̪ ��3ο��y�"��M�lCt����E���Ϊ��g�@<E�y�1�HZp79>ـ�gE��EJ|�tT۽�4��#� �I����Pt9����\�HTE��ĥHO�ui����jf�Ұ��1�i�GH���Rr�$�ݑt}�VaѼ����t��Lh>�!1wө���0/v}� 8G��&�-vچr36�S�C���-��=sɄl�Acp��ü$;�jO�NN��&��sػ��/֡��W�m��/K��R�(�m/�8i�Z0� +��^eg����������^3�{�� �k3�0��b��om�aPwW��k�8 ^ �AC��]�����&z�� �3#ڥ⨟�y�����|C�G��HuU<�0R(ʔ��A��t3���ك�>�� ���{Ᾰ�)�;�g7'��P�=�����U���t�Z��- ��^N�+{&j�"A�{�{���ݷ�nc̊%B�]:]�@b�͚'�Ҷ��i���!f��K����$Y�a�Q�'P��ӭ�1�S����i���}�Q����rJQq��s�%Py�ɉ<���L����VF����m�O��</nN�ytRBJ��o&>�o��/��J4D�*�umw�(�J� P�tL;�8-*���6*��6>�XM7����qz��ˁ/fl ��{֗А�Mdq�OO�C!`�8�f�k浡�b��kۿI��'��p-o���,���d�\����q����/��h�q�á�����'AGM����B���`�@����\�yAi��Q�]c����o��$ �;�C�ܖ����#�1�n��SB��'�o���Aw�y�-on�(i̅v95���*���s�s�'R�m@��o1s��E�F`������n/��G/��T�R�OC���]�m��[Lw�ꖲOFgJ��2����Em�����[�v�;2���8%ay�����w{��s���B,C\�N���lX ���?�ieZb*�Y� >j�̄�U�\���B�y���*�:�:1�YwqQ!��0zi�� ��Ʃ/�v1�z:*��]��S�lF9m=������"�#��hP�b��9)�������,���q�$xk4a���^щ)�ԚTR�����I��ZrlY�v~�)��Q�4\X@�'�ׅ��<gH�����i�C�u�S��$~�Y��6^����\(�C���~�,H����dZyW�M�g/hW�B1�w2p1\�J㪼[�"�"�#�ӄ�J��~��"b��%��z���|���V�dn3�a'~ޑ�BF���t�~P"1��L�/����ZYi��?C�l7��#inO&�u�9�� �Ȋ[�y��|��B��Tz߆�;^���o���zt DՖ�R45��9�u��3Jt����b�뺲����eW�Xi������0e�+n���n\ �GE��^r����YgB\��Oj�B���j�9c[F0ܓ���� �M�@M�� ��`C6�O��� ~�і���,�� iV��tpA�dJ����@��5����߽ݍڅ��������[��I���Ӊ���<&��`[�poQ�e�E� Y�:w];t�h;^�a&�T�0���h�H-�����.�̉a1��1Z�~�$|~.F�5�� �T��0�<'\�j�AV�x-��72�:3���̲�4��ec_mJ�0ߺTR�̿ {#6tP��cAa,�nci���^�&��/Z�������P5qx�䬊�>/"�mnÈ4uJ�+ �=&J�k���U}�^�� ��V�V )t(���@-�?'Z_ǺA��<��E4�]` ��e�g�y������:��dk���ϔ�#tΪ��\��x�3-�ئf���W�L���B�l�J�h.Ο�0d�:��:,�1y-k�ə"�/$��GZm�\$%�b��|�TVC %�d�qH(�u=�WwvEy�}+�oJ�0�E� EȶV��A����l.�Co��T�w� $\�Bԙ�uC�k_e<n���E���Q{!�k�����oq�ͣ�#�-��Sh�( �GF�x��/�!�,p�:d��������\~5D��z�?LS�}Қ��{�n��On|%��|�g=�7k�v2'���_נ���-��� ����H��A����L�-�L<C0��T�WSc<�;�6�KR�u��F�r�^��E��
Static task
static1
Behavioral task
behavioral1
Sample
80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb.exe
Resource
win7-20230831-en
General
-
Target
80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb
-
Size
13.3MB
-
MD5
9ac3f09bbc9f5310ea51c15d347616ce
-
SHA1
3647ee26a5f8b629f9c29dfaec0e6ac42c71478b
-
SHA256
80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb
-
SHA512
2c357b6f51462c673fa82fb2941554a7735e9d30580c77707f0f9c7fac42a9c17e1d6f9494b2bb25ebc8cba458bde8af4c5868ee26e17597a2286d2f352b75e8
-
SSDEEP
393216:jq94Usc5SuJMW7cs2UtQqfJPLi4LMp+Vz:eeUzcuJMW73G0LibgV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb
Files
-
80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb.exe windows x86
baa93d47220682c04d92f7797d9224ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Exports
Exports
Sections
Size: 12.7MB - Virtual size: 15.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 744KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cedzraul Size: 616KB - Virtual size: 616KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bwblowcd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE