Qb����`Q���i �?Y�w�p%H�Rg���]�a������:����U�a��%�w =�$��p!��H�;>,Om����=RK3`Q��U ��b��q���-�� m}�3L��#y��l�]d�[@rU����訙�����N}����,$����j^�p-�@�)s�������oqAeV��������o�GV$#�L��0�t���ϥ�L�X|�_��W+�3-��6�e�:e��_��<i�m���h@gY5��eW���n�������ֵ�2��U>�6Ý@��� )?JqF�h-g0Z�C�zYh�FM�n-��wTr��&llyU�O���! ���/�Giv�͚榇�"Ij>�hd 1]�R���}D����\����Q�4y�h�����]����tM�S�`G,��v��g� ��ξ!#ry�V����b���3��td9����S|W�#�D�[�yd� A"��h�7ˈگ������vB�[]��d���R����/@��)�{"/��i�5U;K̲��g����u�0/>�J�w�TƗ�PK��ןX;uKlNtb۹f{ެr�0����:{!�y~�\P��'��vQ���Uf� ��r+��ZIhbV\Vw� w�T9��T8�=gP�.��̈ȱk�U�����-���F�������I�����G(ϵ�ϻg��D����<�8��{� �N���H�A^�e�M͞���s�=>R[�R��C��H��_kK7�G�KuӾ��:йb�n')�n�xל;�ݧ�"�����6��q���D����>�0���5�����M�s�`�4l�&V��_Y�q_7T�!&*)&��0l��6�3w��j���� K�x�c=�R��� �y��1�� �46�p��U>8����ZH|E�ҧ���Kp�vo9��Ū��G��8��L"3���r�Z��J�Y=S\�� 8И�u'|�|�Fnm� ��:xy(������G:�:�.=oǗe�Ɔ�'�AC�N5���P9؟����/Jڿ�~��o�$"a�� ��t��FQ�?X���{��8vӤ)�Ї����:m��*���!Ɉ��w��nTEQ��{H�����y�sV2��� ��{Md-�ٚ_4���j���r&���ӭ�2�����\U����.L�p��OU���;�o|?&]C�}p�~"&M��A�d��D�|)泍$��z�p�k����? ���ʇ����<�3�q��C�$�Wl��W#{��s,��% �{��^��Y�纋���o�;�ˢ��������Hp�۱�ۖQ�V�����sy�H��+���(��$����P����%�Y�>��{�k�N4s3Q�B�-�����;K7g�9jZ^�!<n;����q�r��B�B(C>�3v�ǫZ����C{�'��Q���.�y�Ӂkh�����7���20bt�l�j�<R#��b�$�z��x!�����l��M�M3���,�g��$��;�� X��� A�r����B����s��xp���=ϗނa�l&Du8$�=��{?µy����$����t��)J��yO��7�����TMnOz�M�l����w������2O&��淀�k��"���Geo�2�0 �^9JQ��Mﻨ�����M��Z�I6�I_�O�SksK$:H(B����8�uIN��'`��i���z/-�9ڲ�`�#�H����&F+�V s��x��YUS}�[VcBB3���D��w�]=�"�[�2�c}�������k �b��{ ���o�Gwʹ/��9��uhԃ���ʠǓC���-;��|{&� �ê�����uab��{�9@?���Ed��㧐�i�6 �i�e= �'�t�y4��=6ohJ�Y����s �CTQ�ny��B������ ��l��0C��Z ���f���SLז�{h5��8���-c���� 2R�����+8E�(g��9������,>�y��̜v~�åe��M��@�o�9]S��Fz����5t8d:8�@q(������ώ}�Y�f#b�P�*$$�#O�xA$cO���R�S'X��Q �ز|�l�A�\��JD'�~�0�Qϡ(�Td�k��+-Pߤ�����]&h������RwJ�F�⤋6��N)��6��ͩaC�]�����_����,�����,�L0�xcr���4�<h���D��0�%�v���>X�Tv����>L�rnCf�Е�{��G;�̟����)��酼f`�E�뻩=>)yu����!��i�fR+F�D ��g%�F��]�!�V�H�vv`a靌}�M�������v��T��z���-i"e�=cKY������O�2�p��mD���T�p��\ /�����D{3�O��'_�2�I�C5[e4�R��nº�.[ rӪ��=�V[lc1�� �t��Y8GcL�}�%-g� ��$�~Q���=<��ڜ�%��L�_\��bX���tKP �G�����m�*�!�%�^}� �7�ސ�W� ��-�m�i'��I��f���L��� iH�����=R����Pױ �e�L6߮�(/4�Һ��!6�O�K�]C��Ȋ��B� �Q1T�nU���W2�p�j��[ᐫ] w[���O��H�~J-��t���}K�;�n)s)y��U6�� N �R�,?NX8��u����g��Y�J�:�v������i��9�[V�k,W^��W��#�$M�+Q�x����9�G���$wө��J�% �A#F�*���SNJR=�4U^�.�4��Q $�㪺A�:u5���h�r��H���_Wj\~��H2�ot�3��n�{(�,%2���d�����WG�^���Z��#FA_^ua~]��Ŗ��]��1ML�%���!r������usH��*0Ψ٪��ԙ C����h����e���\#�U쏽�J�cg��nLe� ��i&Q���h���Y됛!��+��s.o#k3V9Fg�$;C�X�N��|��uc�#�gUMEr�'ܧ%��^�bs:f�T��qY�� � �`ZRuh7�R���t�L��I�l��]����!�&j�J/�(7"��
Static task
static1
Behavioral task
behavioral1
Sample
d8ce88fafaeee28d61bf22af3230e2999b042d2e241a32c9ca2ac1298ebcae61.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d8ce88fafaeee28d61bf22af3230e2999b042d2e241a32c9ca2ac1298ebcae61.exe
Resource
win10v2004-20230915-en
General
-
Target
d8ce88fafaeee28d61bf22af3230e2999b042d2e241a32c9ca2ac1298ebcae61
-
Size
10.8MB
-
MD5
95bba3515156d000f545fa88802af976
-
SHA1
3174bb33cfd70570dd3bd22185d68ab7f2cc911f
-
SHA256
d8ce88fafaeee28d61bf22af3230e2999b042d2e241a32c9ca2ac1298ebcae61
-
SHA512
5d47984fd45a031b85e9d8e1010c92e124429f400c524609f43aa3ea46631925a8df33559b75bcdd89a8cbe1314db7bed3a98b3afa8dcb511e6435a760d9ce9a
-
SSDEEP
196608:kdhBP4HSuLAsIl9YOlcu24omU/XvqEMGXpIB/dIaaTPjMbvgzWRC49aTVw0:Ch5KkzlxlX2BvTp0dIaaviviW7gVw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8ce88fafaeee28d61bf22af3230e2999b042d2e241a32c9ca2ac1298ebcae61
Files
-
d8ce88fafaeee28d61bf22af3230e2999b042d2e241a32c9ca2ac1298ebcae61.exe windows x86
4250ec15c45db52910fe80b8e2df21bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPrepareHeader
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScreenToClient
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
Escape
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 999KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 341KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 10.3MB - Virtual size: 10.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 552KB - Virtual size: 552KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ