O��r�H����1�,P����;�L"��~\�-���!'<��Zu���Oܖ0 8�����������-��>V.d� �}���+$`��>~k�L=�a\��bqy�.��zɬ͠M�v���K�{h�'}�������ǫ4��O����N�4"�{U���#yP�{�%�5^�� ��g� y"p�n�45�Wc��Ā[�^2���6@FWS`Q��-��SH,�4�c����q����3�QY θ�m���N�D��X�˾���� ���¤a<g �^T�Ys6��Mgf;3�����{�g��!����O���S/�u6�G����ω� ��E ��]F�4$l�[}�s,x-�^��:(ǯ��GŐ��WnC�?U����T_�M�2M�м :9蒜���f����b�B���}�m�T��(�s�q�]_"�I3[���%�`r)3[eG����Y��=P�9?�L�������&�=esT��DŽ6�O/ �͏�(@���5o������ko��"��[q ���,�a�3����d ��pgT�U�X�����-���������� b �D ���q;r�1r.㠿�U��_�� �d?e���N�S�%f�ֿcJ�J��^����Rdfu�����P�n�)�S��B�E���|t�v��a\TB�c�ؖ":t{5r?a��Ssd_���q�K�8�9q��''����w�`�<F��L��N�7Y���%!?��qE0j=�x��AR8����S [6h��>j���q�@L���3��|�T��[���� (�_@�� Q,?��EA�-(��N8,�������"pe㻎D��]���OGe\_=���1�w>/55�D�)Ѻ��R��3&�`�5�+W���;�S�p̤�Oڈ��#�o��ٍ29���ōZ ���i/�;ZV�w�k�(3�������Xb������aҚxv��`r��"ӡPo�s���%ȝ��ڕ�p3oi)Qb��Z��q����(m.���T��ls���=��L�T�.�(�=��aM#��3Xx��:���u�����㚬�I�'�L-'��[�L��*���ƍ��d���v4�� ]���}�t�"�����l[ ��d��j��Ut��2�� ��8���F ��P�I���o���g;�9K�o��^G-(24��]�}#I���>䳧hv�qj*).=�NI�!��bm>��2��]��xy��Jӗ����,Y��+����P��ނ�%fTa� ���N�H�5�BZ�����O��K�^�d��b�C�R����XMY�-���xR"��ڭ%|'�e���p�e=$�����xw�'7�^�|�ʭ#�=(��%z���9� ��)>�*lg>ƻL��b$g"+�;�6v~�����Qh:d5�{l6 ���<���1������*П�$+����9yT�'��#����3Z�8�%�Pl,u�|9�6����P�\�a-��jc�fs��uA%(:��������55/��F&y�h���I�%hz��B��L�U�� �W�d��x����-����W�8+ޢ�x�]�� �jc��w��Ռb���k2����҇'z�b���z�MJ �pq��CH���;1x͢m��!��Bȹ�����~�-�1_�lX�SUpZ7���.�.6\-D�9i����ÿr�Фއ�8H�[:rn�n�����JO���R3����%�rs�� �P��z����� l�ן��p����m�g�!������)����{�̆�f e����.4E��#�^JĖK^�9��ڰMjLSWA� ��3�1�Cb�����,C�/��{>�V�\� ��e st��\��+�Ӓ���;��e��34 W��%��i1U�ާw#��t,uH��N�Y.�ߥ5n�\.sm\�����4��s{���|������5w��y����j~�f�`�Zw���˯�n��=.�e������Q;�hZ )'�H<l��Q�����Q7�"x��V�C����3H�G��! Nu�ui��w�u�+f#�5ĐCD����M߉�4�å7*g�iiku����TgS����~*�9g)�?|Kە�(���b*��P� S�(�T�t��R�+��5�N_���6)"$����u/^�N��7��:��)@�&�d�����͢yH���p����Ƹ�MR���&�$�D#(� �2��L���>�m������tt���F5b^��g�����@k��~� 0�X���ذZZh=�D�62�S��������N���3���ǣO��&����mNs`��si<~��̱&4F_�uW�[�ZL�M#Px}QH�'o�{�$?^�R�`�(�7�1è��<E�1w^M$��@��L-$�Y�y4k�� s�����}:������2Z�V��D�����%!�A�ɨ��W�6��kU�%�'����(�&�w�B��sc���ϷҼD@�m�A� �[p�uڛ�Ɓd�Ip���S���ӯ�w�ƽ�M�㿒t<���'\��S �x3T<&$���? � �=2��w�nZ�X�Ę�T6o+��]ĉ�Z�X3,G�u�h���gaw��o_Ho=U+�4q�o75j�-Σ ?�.�?+4�3&������F���dH�o�y�<�T6t3�M�pD Q8x��R����,� ���q�l�3�/���Y:^������X ��L-w3�kWn���! YL��_-�f�&�>~ HH����ۆ��$����y��hA�5 ��XJ}:�o�5��}$G�˷l>��GN9��t&��S��OV `�Tqbna����O���@���; ꦉM+��֣ �C�Lg��u���$��6_�`*��㶭�%��ψ�G̲� H��H�p-�*�ls�-+�V��;RR!UZ,_��Mj�����dPQ�8zH6Zs��RkJ�S������[PױN'x#����n7=t��i��C��D�2�����:~-SD�$wX�6��:&T.�G����u�IȻm�Y���-�5���e)���s�snk�S�$�R��o�YQ���!�my)����*�����)\;�_��R����k^�V�����
Static task
static1
Behavioral task
behavioral1
Sample
c638593284640d5b6d9f63f2f54fbd2ac241cd2a4fb88b0af5066076a0b4ed67.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c638593284640d5b6d9f63f2f54fbd2ac241cd2a4fb88b0af5066076a0b4ed67.exe
Resource
win10v2004-20230915-en
General
-
Target
c638593284640d5b6d9f63f2f54fbd2ac241cd2a4fb88b0af5066076a0b4ed67
-
Size
4.7MB
-
MD5
b751524a3a7131d000f2029492f21f41
-
SHA1
5d8574ed922eb60538908e1f91f39dd102f24b9b
-
SHA256
c638593284640d5b6d9f63f2f54fbd2ac241cd2a4fb88b0af5066076a0b4ed67
-
SHA512
8a01197b892c5a7ae2c3ee7d52e172a006944e706c9b55dc4d4079806fd20ab1ba7d830fbee29650cdb627441b407d3b9630f739b499570c1ac15a3c1b1f8261
-
SSDEEP
98304:g/sSDNVYSi1HkfXB3ZFPylMuvMoVzojsn:GsSRCSSkfX5Zpy10oJoj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c638593284640d5b6d9f63f2f54fbd2ac241cd2a4fb88b0af5066076a0b4ed67
Files
-
c638593284640d5b6d9f63f2f54fbd2ac241cd2a4fb88b0af5066076a0b4ed67.exe windows:5 windows x86
132b1ea3ff7488ba24fa936b88962ae4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
LCMapStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InvalidateRect
gdi32
SetViewportOrgEx
winmm
waveOutUnprepareHeader
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
VariantCopyInd
odbc32
ord61
comctl32
ImageList_GetIcon
ws2_32
select
wininet
InternetCrackUrlA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 543KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 368KB - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ