���)!@�R�d)�%r(��@��� �T��{ ������}[��[��YX���Q0�����A� ��z[�� ��X����3sXo�'�%<g��^�w�e�P�#͏�kYƆ��>0�y���U���]�o;c�`�<x4����D5�t �g�F����|�^��J�Eq���(h�N�P�=.�&��/��8 i7IB\(�����J���=�Aa�4S9�'��L8$;Ё_�Y����H9q�k��O�koټ�F�>&L�=�$�lcg}�H1���Å����E��}����z��'x�!E��5�{��2�`����7�:\�����ײۉ��H��X@D���i��~��������� 9._���i�5M_8�&E�>N3�o�������8���;'n*WG�QI��5��T�0���t ��.�!pl��6�tz^C���H��h@�!��_mI���^[a��Q}/�:��xwI8~�K}�p�f�k���e4P�w`���YV?� �����KeT<S)sؕy�f����me�9�q�`��|;�T9�F�r��5�`p'�C4��f����d�6�x�L�����Đ���k�sGL"/��*��A]�i��!���*e͚f� ��8\�� ��0PO�� w�;��K�j���lչ���e �����ؕ�����1&mª�kF���8��y�l,{�='��$�q\�J'Y��������V}�/Kt#E�GYI�M��H$Չ����%�����F�~�����e�A�v�G��Tz��x�D4KF� �w4���uքH�O�ҵ�u/� ��9����Y��"#;���Awb��FO ѱ�`?�M�xŠ�yHγ9euS���Pe��=�\��~���]M_��Y� ��AYrDH�����y���Y'�ZkUҹ�,�+�R"9z$�w +P��<K�q�}�K)��ֶ+ɨ?��P$���������JҳԶ"��ÎH �v>RR�R�ȗE�[�ů��|�0��D�$bϘ#۞��?bÀ�>S�=�q�ll���V*�/\��u�u��y�t���ԟ�HC�7b ���8Qb��l���2�(������_t�~�a?$�<#13�!f~�ӂܜ�Uh ^u�Y֞�}ٗ�G��˒��P�Us��W�PC��P&S�zt�t9����� �W�6x��F���,Ĝ�7}�����_Qv`����bsa2���K�Z��]+wbΔd���o�=�X�'ȹM^X#:z}�����e���ͦ�iӶ&}��lOzh(�A�,���-�5�����1?��Tn\�g�����ȹS�,!ӓꂺsȴ�������W���g�!�����<m�P"��eZRfn� S�w��|�e�H�[D1���Sf�L�?^~�t,���5����� ��@��M�1��� �|���U{u`G���C�R3�܂�k��j��BY��TM"^�]pG(��C; �t�<��P���O�-@���'���+6�3�s�Q����D�[\���%x�� ;8�Dp^�����_+� ���Q��<�pz���ɮ�F��)�C� m\�7���!c��W�q�t���x��6�b��xǮc��Í�Uu��߫&�#��O6�Y��)��;������rG55��b��3!O������4�����yq�NĬ�Z���v��t���� ���i�o�2����'�T\�q�����h?)Yc|�I���M����� F2Ԟ�ۊ�3�:��7ɺnT&��n=aj�;O��K�LH��j�3��N��Ȏ`�9�~��_��8����7����CN8��i�O&c���f�}��X����㎞'��>8���L_����Y��q~�hq��hu����ǜq�o�W�yd�����U��]��6Z�9 �D�yg�����$� O����+l����nW���3ᔶ�I4 ��fEU2Ah`G�eɄN{��&�R2Hp\S(��l<�m�[ �����Y��@�Ra����8��x���^�a\��n}ȸ�<�����u��)��\:��'tXa�J��� �jE�'i0�����f_a��Xx��*���s�c�K�dK��n��R=�L=Rn � ��TW�w>�:�+'�����<��H��%=�Օ���X�)�2��5{pm�-;a�is�627���'ħ���d��9���f]4y6��^R� �吝�d��A)���c��F��hb2-&Q��ɘ��{�m㬼��k�l��t1��Dר2ݥs�`�D����\��rt�"O����4��-F���>�K�����λ!s���%Z�߬ �?�#����&¯�� s�"��)U/�v ����t����F������ OB�4챃�&��v�n��ub�y��L���(� �C[��M\�Ŵ��3)�m�孩g�X��%�q�!�s���X�G���3m�,ƒ~�E�G�$��\pk�F�N��;�ݦ�p�a�� 3�t-),�ΐ�O)A�*l&e����Qm��K���̠v�LN���ҍ�{(~7�:v��`Kϡ�E�~$��''�2xhxg_�Y�����Q@�i3 ��T���f�o� 6OUn곣�l���sfy��7��sDP�����0Pk���I�41��M��I@��0?�j��=7��h8��μvE�Hdqo��!2Z�� ��~�cM �N�ש�6�z�ǢtV�s�9�o,��E�MDv=v�����K�(�.` �� ���)g��������^�����vX�'���]�VI~�E,��@�Y9gw8����.Kd���I���<T{�P2�s�Au;�q� O=~EW�kP1��%��p�P;�*�w���]��K�\�� J�_��.���?�]�Tǔ�å �=LkK������N�"�D�i&���:����tLeOh�N�x�I�p�5�%Lw�Ь_K�5�����^o��#Ц��sgGn�$�����vQ�0��~,Hh�pT����ۉ�h4�*��t�q�G��bVN��a�*&C���s�E�J^���� ����R��?K�� �W{���ai=m�K�N ��~�z�j!�'}0��XhX�p֟������;%�Z#���$^> �0��Dh��'�Lv��ɖ�
Static task
static1
Behavioral task
behavioral1
Sample
868cb633dce70496aa8d294dc83fa665d65193cb8ca95d1102aa51224155891c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
868cb633dce70496aa8d294dc83fa665d65193cb8ca95d1102aa51224155891c.exe
Resource
win10v2004-20230915-en
General
-
Target
868cb633dce70496aa8d294dc83fa665d65193cb8ca95d1102aa51224155891c
-
Size
648KB
-
MD5
897f390a9b9d060023da69e1f933e518
-
SHA1
72edc8967e70dae89436d194b0dc429bf4084b71
-
SHA256
868cb633dce70496aa8d294dc83fa665d65193cb8ca95d1102aa51224155891c
-
SHA512
559bcbe6db5891717ac019cfba3d687e9ad2820af862d2fbad4570ebfe61b0507fdba6d92c638b8fe82d94540a3f0c74b6bd570acc07972a0491debbe567cb65
-
SSDEEP
12288:GfhWrouh/hHVU9AUv0Ulfd+2BVE1dWsEEL98zG9uF+1rX15oZv/k3rTcmrX:GfhW8uFhwgSE1csEEL98q5V15oN/kbTf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 868cb633dce70496aa8d294dc83fa665d65193cb8ca95d1102aa51224155891c
Files
-
868cb633dce70496aa8d294dc83fa665d65193cb8ca95d1102aa51224155891c.exe windows:5 windows x86
cc815d4d5d6e85a55376eba8387d5843
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord716
kernel32
Thread32First
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3.67 Size: - Virtual size: 592KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3.67 Size: 636KB - Virtual size: 634KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ