7_����d��}�P�S�I��o�X��YhQUI�:[�g']~�!;yғ������N������*%�!2[ ��L��v�0�B�M�6��uI6..����oU�xRA�%�m$!�Be� ����(�v?�3L1Q3u)LP<�r�ntU(ʡ��ҵ�H��B_�� J�.���R%�-����+��;2�b���E��p����nU�����`_�w<���1���.�s�6(^ �)u��0R�� A%���%��Œ�����n����4�'M��w�z�Q��:K(�ZD���A�_sQ�p�8���X�\0~�����uyK�g|��U�������߬�2�\�QMT�!��}�a��䡡�Ւ&b�F9�'�����_��RCP����2^�����0i�S9���=����nV_p�9��T�[�tm�dA+a��d�{4y0��c�#�M�/^((���hi�+����c^}x��C��b��,��_f��G�����0C��M�Lĥf�A!_����^���y�9��h���ӎ����9��@�_>Q�%O�ثq ��{���,qW�2�7�H���y:-2K�hv*C!��D:���n�\���;��N��ry��!z�?���w����&߱l��ߓ���-��F)��I�^!ڨ�k�2�4 )�������a�h��X6&�;hU+��G�RA����Vҕ2=.p�>�V���[�'"M 躽()F�O/�0��HsY��:�)TN��r�F�k�����k�*�!��y���T���Qw3�o���N� ��˚�-ɡ��gM!��(�3M�?��5����7J+#뱢� t��2�'58�Ay^��Aw��-.�ĺ����f��~�]a_�otNp�f�x�����\��+��:�&e1Nz���#�(��%�?�1�����P������VjDXn�B���TޗQs������XN���t�����`����_�MZ�d�D��J���o��[�W(��Tq�it,�ؽD�Ħ81�x��W����iL ��0>>x��%�ue�!��һ>HY�t������>�vs� ���cd�÷��9ыI�UX*���T����:����&���Ll�x1�tjv���?I�[��&���Fި�K+r�E��ùڙ�H)0�3+D��>��\�xڶO�9�&��)a�#���#�Z��ѧ!�oS��� �z6C��J��]�P�[��58;nFD�% kA�8�JKZ�]�{�Z�OJʚ�x�P���d�\�-=,�5*�my)�w7?/]�o�委�.� ծ��e�\�ڀ�nj�s���ukm�=��XC-�I��p����'],�)�c��H\q��Ȅ��#���A���J������?48GxЯ��S�xޛ��{�$/��|�X�K����N��w` �%���XÇD�14|����$�d�råp�"���H�"�r�˕1t�,����].FH�G!Qj�a.2!m\�]�.�����3�F�W�>�_�X��h��rU����?;bfZg2�Z�E]��"=n"=c�Ǹ`R���E�I^�c�YI�V����;�z0��0�m�G��4j���Ƭ��tQU7�������A�w5�����v�� ���������c����m��G$�߽�Mh}�.�����Qd݉�b�`�A�I�x�������Wl늍&�g{�`��%�,E�1~.����OcY���ðp_�)�#���:L�u]��an=�n�P� ^ν#���lK�1�l�Z�G1��#%�$�r�M�YҸ�����Q��]]Q6�?o?�4��J��sLd���C�?�O&1�{� ��)��}%��P~���F��G8-���@a�`>=4��n$d�D�<A�Ν��sˮ#���6��_��"\���\������Fˁ � $͝��l��������T٬$�';mĎ��4V��?|��yP��)��Y��l��B B_�:���"��YF�c� ��ף�����q�s��T���N�x�I-`�y���mK*���e��v�dr)���̬�zǪ�c��Ʊ��s~����$����*��ۿtmf �iU5��ޕ��Y��X������C&���HO���I�����5O$�w'g3~¥�r�~v��z� R W�.^�_#��"�\����O̦�� 2��u��ub���"�����R�K?�;T��`S5�w �?0=�y�J�����>�����m9}��~d6\�=��8�>Pyo���\��%l�r �a���{BK�n��5�t� ��@�'��$��[U�H�F9�!@`D]\�VL�p�i�p������$� A���vˢ���t����g\��P�m���5�_����fV��hƐ:N��% �ȁ��7�'Q���j���gCR^�:`T�c��B�e�i�1 ��1�DTo�l�+m@^�P�y�/9|�T��i��2��a�/9]���;�0_���5k�,�Q���=�>Z�:�+�ꕱC���&PD�2���&�5j���e��-k��(�,=9��f"_�A� ���#�9����$2Q���E�x��a�� t�P79r��S#t5!�� ap�������b�����������.$o��k�k�N ��ЛA�gYt/�^4�/�{U]�I��U�tHPWB�3�Q��� �TÛI��>��.���.�.G�oH�q�JQ���ک�6�6.E�=[Ҽ�f5��᱿B�FH���{۸V���`D�-7,>�p�n4,K�����_s����G��od��QRaR����(��{*�����R=*� C:�3�ş�t��rD�@خ�h��V�sUu��UD�f�����{Y�~ ����g#�eT��9c�ɨ��%l!���Fѿ������_p���p���3�A����4��j3�����jE:X)����E���3�_��r�[��n�Ӵ]�?�e8���I��ϸ9-6l������@��}��k� ��\MM%f����٪�ր�ڇ�ye���3�b�1;Ca�����з[w�À��F�� ��6)�W�.����|:O����s��-I=蝦zN8��^���F�-e�Z�
Static task
static1
Behavioral task
behavioral1
Sample
184cb7db94911a22baccce44d29503d12f71488a3071b3e5de79ca0b4ee6ca94.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
184cb7db94911a22baccce44d29503d12f71488a3071b3e5de79ca0b4ee6ca94.exe
Resource
win10v2004-20230915-en
General
-
Target
184cb7db94911a22baccce44d29503d12f71488a3071b3e5de79ca0b4ee6ca94
-
Size
5.9MB
-
MD5
6f2c89bda7455a66194f7b7cd6f5af9d
-
SHA1
0f55929d0f9e7f443a52696af6fbf3c548e8b7c7
-
SHA256
184cb7db94911a22baccce44d29503d12f71488a3071b3e5de79ca0b4ee6ca94
-
SHA512
f54a0d90d474c7e58b40e7bc98b4448aa4a155be461a627337a7e38c33b73a3e5140a3fcf1fa9a111cdf7e8ffbd985adc7202e4a6af6a6d42db70289443419ee
-
SSDEEP
98304:8R2oFhRYHhibMmhdYDQGKEPeqwHQ9oELp+XW2Y9YJ+FMQ1w7i21irXx5:O/whibMmjYLBPe1wJdlvSoVBX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 184cb7db94911a22baccce44d29503d12f71488a3071b3e5de79ca0b4ee6ca94
Files
-
184cb7db94911a22baccce44d29503d12f71488a3071b3e5de79ca0b4ee6ca94.exe windows x86
9a4a08f841810ac713503dae3fc9eadd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
WaitForInputIdle
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreatePalette
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantCopy
comctl32
ImageList_Destroy
ws2_32
recvfrom
comdlg32
GetFileTitleA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 688KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 960KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ