�NL�&��SM�-E��Y$�N$e���'��eڍ $�$ ����)�2s�I�L�N� �VV�>3��%��$���a_�,tBj����i������Cs�"�a�t�� �N*�(���¬�7M�n�V�\�GY�������=K�9�p���US�@-�b� |gΠ��a:�WW�pݝ�a��W05 J�D�ê��,|����z=�9�0��\)��ᚴˈ�z�c��J�ON�=����k��C����/LN�M*Li?�5����t׆���ě�t u�3N�l��C�j]��4�3�ʒ\vm|Pwp<��^�Z�X�a��33� �#pT�h�`�5�د3�o�b'�ϳ� ܳ0�%�7��b��\�2L��Jb-qY��jr�b;�Vq�+0�˪!� ��x����`+}�5�����)�)s�~��4�v)��#���� ;�/�dHjG!X�L9tR���0&�[�����s�`�O윝�GP����8!������=�_L���nh}� ���UxH�RS&���@��AFX~5���$��_+g�WO��k@�?ߙ����L���H�� O�}>�%c�6g���\:���n���T0��9�( ����h&����+���wDb� �fX1�]� ��3<���C�ސ5���%4����[t�<C'属pG]}^�O��� ��_=�8���S�X^�ȸ��MM���2�D����lņ �f��/=^Ub!J���xHצ3��wu�j�����������]�wX��ȫ_�(���Ց�����!������BY�|9Rw^�f��=_�&����OD���x��o� ]��봈�p |}t%�����Lٻ�V��8n�n4�)9�\�dL�~`��M�9t��b�s�H�������\�r��X4_��ы�����d �v�'ڭ�A�B���|��ɩ���gD� ��9�< �} �Ԯ'7�r��䖋^�u!\P!!+�`/4E �;$b?�͋0$���z?�d�v�[f$�A{S�@dSd�]2� ��J����Ta��D�Mu�����Ye]YW滗� ���v�����C�@ ��6-�`zw^$�����mRN�[��_��][T�]]15^�"J��cWz+A�m�z}�\�����5i]9�'�F�$��Ai5k�Mx`�5�6�5��,��/�S��5�g�Ӆ�� '*Í�]���Q:< hlX�S@`��U>]���ڴT����N%8��Q\�|���H������?n\�O� �{�f��ß��1z�}����������C|��n�܌wH��&�0�[���O��U�RҌ+2���'�����'Z�W},�ƕ7�#�x����q����X��M��=�+�Rɸ �%���✲�Ι���.'�I��.܇��&��H_l��#s�6���A�٭�����G�:y[��`��� �R�5��.��TUk_��^�ǚT��*�V>�.&���[�mb�T�2p+���v��i=:�.C���tbu�����{�X*7������GȤ���e�/XA7�Tm�89�c�-�عaم��F����BD}����$�Ļ\���&sH%�ARdu^����a��(6y@w���M��i�6 V�AP�ke�@��I�Gk���R-��"��� e�����=R̥$��;:?!yDD�%%.c@'a�P\��U3������'^����)���_ kq�j��������'��m\d�L���%�oj�AE�p�c*N�MJ@�{֓�C2��&Z�.�U~5�~�'���xP��ٸL���ybcRg�����f��` 7_$f>����^a{�T�2�����f��^?��5�f� ��0j�.�g��khef���h��/�b3��.Œ���CIrv���`0m��w��c ��ޞ�*�#V���@ı����d��i)S �{$�lT[��z��xX|`��K��W>V��\zf����W֫���&�~����#)�$JAPOc��L�/b���|���� N�����$�a <�L3*ħ���Y�+�1G~��a�~�Nf���!H>e<�u5��6�x�H3�=�]���H4G����� �)��5#��ep�Qѻe."�uwf���v�@:1��I'�����a֞F��~Յ�����+H��<��{�@����i�Y��H<�e��ͬǜ�}� �8�{����0$�Q��(�u���3WgI������T ���v3���� MF��x��^'�倯��(�%��u���6NȞ���DD�X��������X�UM��U_�2R�R��4�.���}~�R��J~Ypӄ�-�DoN]p��+�5J<.#@$v5#�U��Uz����s [s��Z����+�8�G�h"_ 5�Cms{l�P*�:��{���W ?����vh�m*�V2���RU����r����p �tV����~�M]6F�Ǝ5�/�=֪Q��HyhO8�\p���s+b�>�Ԓ�pKl&N� ��d0�^���A��� ���u5i<� �׀�>����#�^�A�W��sp������=�yĉ[i�c닅;Mtү+hts5���N��B�z��S�ȏNL 3;E桫�NԲ� ����\��qj��9���]�a�r��? 9��ȹ�\(�=���Ȏ�»�z3Z���yTh��� nn)86ħ�ζ*�1c�9R���� ��Ǻ0�GU(�%nj�Ց�Ԟ>{j㤦������P>(�6�KA�〓�)�J�ݪ�[+��V�Nv�ҳ���G���c�;�@���t>�w�tVq�IC �0B��W��{��vbU??��]Q���\q%�]:´F��Ҹ0Ђ����֭��Xb(!9�!�pA�O�3ȵ���|~�:\4Im�(�fw�a��d�gI͘�R��i�ߋ�M �J��8}QM��Đ�)��7�,ԏ�G�"@�z�� /��e��"Z����pIkhQ�Z���\?��B�h��2�u�*�C��a��ڳ���_ �K7FVhR�kg�{��afa�������D��t�X2��W#Rf��Ig�cT�m�v��JK�y��7�I6�^�k�]�Į7���͐R�w%֫��v�Jj�
Static task
static1
Behavioral task
behavioral1
Sample
da18a8da316e32fdc896c10c2c0d41bd985f00c10a4b292a8bc01cfdf3a505bf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
da18a8da316e32fdc896c10c2c0d41bd985f00c10a4b292a8bc01cfdf3a505bf.exe
Resource
win10v2004-20230915-en
General
-
Target
da18a8da316e32fdc896c10c2c0d41bd985f00c10a4b292a8bc01cfdf3a505bf
-
Size
12.8MB
-
MD5
d031a9a8b38c5ad0e5b4366256542db3
-
SHA1
047c5dd72b32f443c03f8d652d91ee646f164da2
-
SHA256
da18a8da316e32fdc896c10c2c0d41bd985f00c10a4b292a8bc01cfdf3a505bf
-
SHA512
bc75121a3f04b7684ae4fd70ae6490b1a4fdb83bc88c9f74610a1d2d3506238c384aaaa919743857513b5994137706556f0847721133c80e376ced1daec5ef07
-
SSDEEP
196608:mB1tCAglq9w4INvs3Y9wAJ8wTBGZws1kEFpFCzEz+D838PyL9ozK4ciU7d139MhL:QLMqaA3jA/4Zw8kEFw8MP29GvUX9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da18a8da316e32fdc896c10c2c0d41bd985f00c10a4b292a8bc01cfdf3a505bf
Files
-
da18a8da316e32fdc896c10c2c0d41bd985f00c10a4b292a8bc01cfdf3a505bf.exe windows:5 windows x86
f9a898da00664e478c1da437dea89aa0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsWindowVisible
CharUpperBuffW
shell32
ShellExecuteA
ole32
CreateStreamOnHGlobal
gdiplus
GdipDrawImageRectRect
oleaut32
VarR8FromCy
ws2_32
select
gdi32
BitBlt
imm32
ImmGetContext
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: - Virtual size: 861KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.}]; Size: - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Phe Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tqr Size: 12.8MB - Virtual size: 12.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ