ٜ�H}N2F��-}�/�ۓ��:����%nz��է��:_}r�����3��^A~1S M�9�M �D�e�]�~Æ�Q���f����<�����B��y�J>mB_�!�����H �PG�đ��Ŗݵځ����4$����\4��isuC���O�E�C�0�����$R3pt�@\�}���,h�#�e+����۲䳮�&q�H�I��E1��i�u�갠o��7̀����������c�Q�3�Tpn������BM�W�1;.,��B���ք.x�Q��#�.�&�j#&�G9n-�� �����i�z��A���Y6���#� �vc^��U��jYهv�$6���>�:�q�i�����Ϥ��Ϫ��Gk��S���,:��Ù:��79��<G���vn��ɢ�WO��kY����ѩo(�ά� �r���1�^Z�����~o= ����a���N�1hr���k}f�܀����M�ϳ�G:(� �/��`gl��^d�O��d^ 6t��a(SAۆ�����9��� �V�f��̽w*�ߛ ���@�?҉2�k�Z���`����6���H���S�mF�Y6����X=�} ݜw_ȿ5(��QN�!�~_���PF3�su��(�#���#Fq�����t�w���+���K��B�V��yO�{H���J�ou��`�z��U��cS���p��Աs�F��2��6Ҡ{����˨����1e��7^�~ D$�Y��qm�x�ͥ�����p!�'צ�dN���J�^�h���#�>E�����"��]Dt΄LH�2���4L���fo�j[����.Q3�o���*�}��#�\n��n�&E�";EtY:��Ӡ�R���-)JZ�rѱ�Is�a&e#Ҝ;#�3���D$~�s��#YQ��#����~O�H��\]����������7ٓ��"�Z��8��o��41<gYn��!nG��.�O}�)��aj���;0���� �5c��I]ci.Cl͋�Z5���/Z]#�M�o@��Vo�Ьߙ�͙-��}A�u�5�t��Jas�����C�8=��Q�R���X ���@�m��LPB�)�QG��Ieo�WW��f���kEkd�8��ni��$Qm�����Y�y�w��R��������1eY�)d;�4�E�} �9�"�úA'�D;AU+�?�/�U�LG�s�Cҽ��ˍ������Rz��dwl4���%BHH\Ɂ�A8���%�m'��8CȸN��x���7�4=�N��V�*m �Z�wl��V�l������K��s<aL2�1L[�G���� �A��� ���������%K�� LZ5�f�[��!Y�lp����,5GAN^U�M9� �d5Y"�6��>�|��G|U F�^�OIN�*��=�C,�L�����>xW}?��8���Ǩx0�9��,�6��:��Q�`?[|$��9OC��z��ɀ1�{�_��Ѻ����p0�4E����Nl������T�ݒ�G�ˣ���������ƺ�wʙ+�l���2yj'�;�:�.{�h�n� ��y,Ш�hR"��~�B|v�?U�|1z���ѻ���ˋ��T��)��4.*�[���Z����~����05eu��T�vV#.ϫ{!p�I�j,&Ѧ�\#�����m��Bgo���H�j`b���:N�H�S2�ῡ�1RP���@ʧ��� G���~9*Ğm�i8�����BQM�q��������>��ò`�s�,=�F����0���}���&�t^��h��]��� p!�" *aܢ�ۮ���{7�� M8 ��D �8�5�dE�:���s���s�V�|A2S��HF��i�N��}�u�{VǤ",�]W_A�'�u�:!��=���2g��uj]��2]�ue�Z���֜�����y>R=_��=�*������GI�5����Y6� 4r#}��O��9�����}��������v\o�k͖-��n�~k����(��$���9��X��h�Q���d����y��X��plY�h�h܁��a������~���.� p � h��4�I��|�R /(3A�q�L�J��FӲj��W��_dE=���N��oo���d F�J1��� Zz#�x�$��h��*�WӞ�t��&?,�5YI� DG�����a�ω�w[�`yZ�)�8%��[�� ^����?�V���[����tY��P~,^���~ ���Ic%�{���D���-���}��`RR�ʧ��w��#�9��ӂЋQ��t���\s��,#����]������n|e����zh��X�1 �p^����"���NJ��4NE�P]���*�����X8��z�)3��oF<�V���������!"3Gp�S>����tXGa�_t��hD$Kb �4��V��ۢ1ʚ<$ɺ۬r$CZ0��e�;��4��Zj/�&��d�n��aA���)��n� �`��=uVܯ�@����s(� ��A��SB�}�����4��!�8� G@D%�ґ@ ���Y�l�+_"�Ԁ�)�'�:$;7s��F;�q-���qmLI��g�L���@�-:1�I��:��@3j���gl��'� AL#b�F:�|N=�t;�>X����"��V�*����)��K9@ M�xi��ϊ}[~~�@����.<m&G��mT�[@3�M��O�R���=!LT?d5[Pu��WB~ܭ�L���s�[3a��'`!Ȟ��48��3���,�.��)Iq%M��7 �'h\��vˬBsy���e/�TX��L�+K�`�>��]����F��^�٤����;$����n��F1SD��%-x��+��{�Ҏ�����'���w�p��&Y�e�_�,�"��2���1�BӨ��Qz�6��ҁr[���@4��Gg3�J���n���Q�^\Ю�u��4|���de6H���q�k@��5�Nǭ�V�����cv1��.���t�q��c��E�p����ĤG���nj��v�{�hY�ўn�'VoML��/v�(?�=���!#e}��1��3��;�T���`�7�;,*ܸH��A��;�uQK
Static task
static1
Behavioral task
behavioral1
Sample
83f6823c73f387e2c2d55b0cf9d665f6d29c392dbeab60d30fd4837f8fcd9346.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
83f6823c73f387e2c2d55b0cf9d665f6d29c392dbeab60d30fd4837f8fcd9346.exe
Resource
win10v2004-20230915-en
General
-
Target
83f6823c73f387e2c2d55b0cf9d665f6d29c392dbeab60d30fd4837f8fcd9346
-
Size
12.7MB
-
MD5
86d3dfd56c8f8edf7c04cb8b6a73d09c
-
SHA1
d8b46b73e7c907efdd2155ac88b58ef60aaf445f
-
SHA256
83f6823c73f387e2c2d55b0cf9d665f6d29c392dbeab60d30fd4837f8fcd9346
-
SHA512
cf34e1df277e857af187a790e33f7c4902d43629f4b1344b5d3b2e8dd811482caefac247c2fae01768b7bdffa6bc7910914ef1b8e29411141c0daa98932a8bb8
-
SSDEEP
393216:+vAGDdFIhR0lTYh3AiQm/jB6983Zpg56tN:+oGDQXaTC3Rjdk5O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83f6823c73f387e2c2d55b0cf9d665f6d29c392dbeab60d30fd4837f8fcd9346
Files
-
83f6823c73f387e2c2d55b0cf9d665f6d29c392dbeab60d30fd4837f8fcd9346.exe windows x86
20581298a1219af0fe9edefa55924199
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wldap32
ord35
ws2_32
gethostbyname
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EqualRect
CharUpperBuffW
gdi32
SetStretchBltMode
shell32
CommandLineToArgvW
ole32
CoUninitialize
oleaut32
SysAllocStringByteLen
comdlg32
GetOpenFileNameW
advapi32
RegDeleteValueA
imm32
ImmReleaseContext
comctl32
_TrackMouseEvent
gdiplus
GdipGetPropertyItem
wtsapi32
WTSFreeMemory
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 323KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 12.7MB - Virtual size: 12.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ