k_�b�4��uh:����w ���۰�@{�]W�W�2�d��Bi0�'�4V����9���d��u���}n���.���^��d���ii� b�����*������~ղ�&�����f�0��<����Փ1ߡ������l�����iX��R��u����YT���������)[e|����<�j�v�t.*��:�Ɍ�Q2�0@�� ���� ��8�>�DWX�R���b�b���l��ep/�z��)�%b��C�O]_��kC~ �5�eG}�>"R�z'��p�����gdž�)�+��ZC�h�a�w���־��]H��И�Ӊ�o��W����R�N���[�p��e�vN�L9P� #= L�"��| =�}6��#/�uPk�K��9�� ǔcO����7ê:I���A��)P,�`��T�&�?����.ɹ��Q!>��*n���?DхCtxs=�$W���3��X���J��főC2�{0WJѢ��C�xN�{ �NT�ծ�=��$���I��W����w_\����5q�ԑ���R�q���$_I�7�/@A��T?����1�}zɰW�g~�><g>�]m[�S��Ϥ)�>�s�u��+_G�"��EA*�(a�x=�NE�`�f2E7��R!c�� +��M���}L\�Jr'mq��\��##���3�ګ��]���a��${3�qs�ꩠ+��H^w��)�4�v�ؐ�2����-��@pӁ� q"����yi03������h#�E�L'qJ �� ��5E���]�p�r\Zw4�tUC��l�]���|6#h���"�U �P�n�|����3�g�w� ����&nj呝M���&�U�3j�n��h�w]`,B�κ�=8��Xw�6�L��A���� �p�,�~��rP|DlY�.݀5��d�����ȇ����R:H��>ϛ���<%ϖU5����� ��]ߧ��`��}�]��zq�|��a��[��D�q�� ?S7���3�z���4�xq�^�:�)�z���bȧnSx�|'{U�-� �ȱ��/�G�m�� ������GܱIu-ԗ��t�"�q8����QP�d���IUY�Զ��D^�,P0UP5�c��}��kGK4B�'�u>�~�Ա�m�|cb_�ac ��jn�p���M�D���W�z�T���nE���/�Wp�K妿�%Եz�B�ͧ��N��ٖ�}]�c����j�R��G;Ȱ��!����q�<1�Khe}#��A�Xd(�e����1[^^W���FyQ� ��u"F&����s:^����)Tܤ� 𰄡�ˊ&�&��ߋ^�q����Ŵ� &, 9�н+e�!v^�B6h�r�W �>����A �e��EH2E���!�ߟ�c���ay��R1�z �m�v�nH*�Eb����/y��-?�ɜ����1���Cي�ZU�-.$,��{�ܤ^�jK߿:d,�Xӗ�V�;�; �k ����w?�>3�!�; O�2܅ܼ�a���?C8���+��[�J�N�fm��x=��#*0 Z�_����8=w�"���Q>�~qk����T��F�g�O�'�H2F��C�o�:��*b�&���i�����@)�3��y5c��ׯS����EHW���϶6m1Q5���^hΉ�0�Z��eah�^�t*7+A�T�j�����vT�*MW��R�+�yc��(�a�HL��}��k6Y�!L{m-7Xa��p���d��?@��� S��<�����,4�IU�([~�e��Pn��F1H����Uy&��x3�F����9��y;�v�_H5�\�g��^%)�~#�6�0=�h�e�� �he���7�ǩ�C�h~�y�y%�,�)���#�c^�}��i�i,�~�Ob �월-Z� ���Am?���_�g���^��e� �S^@[�'�YWl��P'��bʾқg��tհ1��� �H��[$\X���Do�v��qc���|Q0���;[�fࠔ�v�ȋIb��/Pn-2��0��g[�����3�g�������扦B\���-�t��h&d�%������"�R�N~r�7ȷUq�E�zB�D ���03}m�<��~˫�!�r%�{E�y%�F�q��R��59�Zv2G�wBG�?))Dl�+���L�'4���O!h<n{���#K���6����k���z�gQ��R�3�Iπ&0�^���iNɉڈ����S�����)([�:Ȉa�"��J�tr��^8������G������c���1���&�F��H�YL&f�@�$<���7[X����)&>���>g�A��U7�u���n|�w`�uGt�uK��, �<ݲ믓��)�tSM �?�A5����7�r�� zs�G��lʢ1�.�����w���1 ��(�H]<&��/l�� ˖�0R"/wm��M�T���{�m����Ӯ0��hM��Z��Q; ���]�>-�w"�p�p��+VR�J��|`�6�[\���Ν�"d�PV�t���-���� tug�q�����ׅ�ݮʃ� �ֹI��(��[��/�F,V�,`n%*�)>�tPX�6������D���nؑ�����K���iQ7eUA���mtG\q�s>�oW��c�L���iD�uW���-0��!�v��Ҵ���:3Xc�G>���'x�A��t�ݔe��cL�(����|�j�ml��V�\�.���G��Rٚ�R��H�V�ԥ�]Q�xt��Ǿ�]m�k��D�/���M�Θ�q�K'�I���6 V���Q\�z�h�?��ئ�@h \�P�=�uU�;?K�ً�V��,���<@�gv��v�Rz�x�q"�{w߯�(��O��5��,���3��:LUd)=�vɑ�;���3(m��n������8�+���l���H��U�N.J�R%!r)U[��G-�H��W�x���(P>�*{����!g��1���{�z}�����*\Bo���6����{a��hR���vH�ɠ��;Ô��3�HП(�,*X �Ĝ3�d@��h�Ƙs ���p�Q܆c<4��sJt�� �ւ(
Static task
static1
Behavioral task
behavioral1
Sample
67b0c3a4ad5effa057261894c6cc0f1facb8f81650d0f0ab1bb6761f07430a2c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
67b0c3a4ad5effa057261894c6cc0f1facb8f81650d0f0ab1bb6761f07430a2c.exe
Resource
win10v2004-20230915-en
General
-
Target
67b0c3a4ad5effa057261894c6cc0f1facb8f81650d0f0ab1bb6761f07430a2c
-
Size
5.9MB
-
MD5
06d868fb67ae0786e97107ba7afdd0d4
-
SHA1
edb9d6670bf9cbe323fbe80d62f550eb7905e805
-
SHA256
67b0c3a4ad5effa057261894c6cc0f1facb8f81650d0f0ab1bb6761f07430a2c
-
SHA512
83a47aa7a968545f413f725436d05d01a48cf7cdabaa34a08a99d9b9a7d1ee171d3689e6860c0e3b3f0875b3c9a790ed2b93a919dd2b0e57f9bd93e2e75f331f
-
SSDEEP
98304:uMWVaikZ11c0s/1fywZd/51stBwjwJDUqHWcYbwdiAsK:wob6uwZpyBrWNyin
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 67b0c3a4ad5effa057261894c6cc0f1facb8f81650d0f0ab1bb6761f07430a2c
Files
-
67b0c3a4ad5effa057261894c6cc0f1facb8f81650d0f0ab1bb6761f07430a2c.exe windows:5 windows x86
76761dcc4fb484e8967b4b125ea374f1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaCyMul
__vbaAryMove
__vbaFreeVar
__vbaLineInputStr
__vbaStrVarMove
__vbaLenBstr
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaPut4
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaLenBstrB
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaLateMemSt
__vbaCyErrVar
__vbaExitProc
__vbaFileCloseAll
__vbaCyAdd
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
__vbaCyStr
__vbaStrFixstr
__vbaFPFix
__vbaVargVar
__vbaFpR8
__vbaRefVarAry
__vbaBoolVarNull
__vbaVarTstLt
_CIsin
__vbaErase
__vbaVargVarMove
__vbaVarCmpGt
__vbaChkstk
__vbaCyVar
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaCyI2
__vbaStrCmp
__vbaVarTstEq
__vbaPutOwner3
__vbaAryConstruct2
__vbaCyI4
__vbaDateR8
__vbaObjVar
__vbaI2I4
__vbaPrintObj
DllFunctionCall
__vbaVarLateMemSt
__vbaCySub
__vbaFpUI1
__vbaCastObjVar
__vbaStrR4
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaR8Cy
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaLateIdCallSt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaFpCmpCy
__vbaVarMul
__vbaUI1I4
__vbaStr2Vec
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
__vbaFPException
__vbaInStrVar
__vbaGetOwner3
__vbaStrVarVal
__vbaUbound
__vbaGetOwner4
__vbaVarCat
__vbaDateVar
__vbaI2Var
__vbaLsetFixstrFree
__vbaFileSeek
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaR8Str
__vbaInStr
__vbaNew2
__vbaCyMulI2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaVarNot
__vbaVarCmpLt
__vbaFreeStrList
_adj_fdivr_m32
__vbaR8Var
__vbaPowerR8
_adj_fdiv_r
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaFpCy
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaFpI4
__vbaLateMemCallLd
__vbaRecDestructAnsi
__vbaVarSetObjAddref
_CIatan
__vbaAryCopy
__vbaStrMove
__vbaCastObj
__vbaI4Cy
__vbaStrVarCopy
_allmul
__vbaLateIdSt
_CItan
__vbaAryUnlock
_CIexp
__vbaStrCy
__vbaMidStmtBstr
__vbaFreeStr
__vbaFreeObj
kernel32
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: 776KB - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9v] Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Z-r Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sfD Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 483KB - Virtual size: 483KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE