Y�x�1=�ȵ�k�?�2�wJ�i��~@d�E=Z�5�6���!LnO]�ms`��)����H�~<���[��7�=e�G|*3W]�`��4l?�r{ ����o��*)T�O��K�R��$�o��Գ5x��>����y�A�˭<Dmk��/w�K����������2.���x"n�4(��3�����N� 5a�VW؞*}n\�����P2ԭ_�B`FS�L�t��63�f��&2���ܯ7��R���c���0��}�Q�6j�Z�n�m�it<���Q*�<֕n]{��TF&��m1�[�� �|Js����С��_�[��o�Mt�n*���iKmj_����;�"e <��M�6�%��mWG�*�͔�Y���P���1%��/6-lV"e��E�t���� �#��պ���������������uA|�����r'8��^�}�i���`�gU�_�⎵G�ð�Ǻq��yJ|� 2�?�(�Ab��K/���n�\ƪۅ`��XW�+�V�N���ڷm�����,&�t3Y��2?�/EIF��Aw5=��-��G?߾]��xs���Acht��i�[�.D��*�� V0����u�c�q�p (4_�>�,��8}k�)N�)(;̘�cw�?�{���X3����Fb<�i�9 �Sv �&�\�3���S�?ҚP�.��o���~�%�Φ�z��!��]jH�7��Db�Ѡ��d���@���N�4��(��|��1٦�!H�h� W�˘&��5:Ku�+c�&���_cv�s�O��^Ӥ��ɿ�qo�)i��4����j��9�J)]�u���×3��U��ovij�j5��6c�ꕉ�~��!�E���Y��d�;kT8~\����G9�]Il��e���T�=�g5�Y~%����t)��\ F��f��d,����O?�x�x˗�T~��gL{�o=�4�a`3�������dF�<�R��mk�i�I�s���5�d�2���~y,�PN�_�o���/��&n+Q(� \�<C�����h.������_��9b��L��^��l�����J5������\�B�fZ�������e��}�z�)8�Jп����n�2��]�{���m<D�DF��l]�ܰ�dtb��.*B'0�.3+X̍�xi�Q��O,H���B�`�|��7�k˅7{�)��� �� ��8S��(h�8�D.�hZxѭa?Y�����i re���������B�q:OWQx���A�7���q��t�{�h�zR�h�H\����F�.���1*��A.�ʌ)~t��*:�|�8����,��g��?<e�jN� �����n0{7�R�,t��_(9Rn�9X��r�a 6�g��Ȧ��I~����~��YS8Iv3�4l>�;R���;6_b@�Z~|��jˑx�����ڨ������4�s���a��x��·l�&�@2�l�q*ˆ��8~��bI����s8�Xv��IH�����4E����ʾ�0�~r��<-v�9�wmx�xK�k~�B�z�����A�\�3��e_?rQ�"f�2�,4�}(uQ��M�+l����t���pT�Ԯ#�N��C<|��3���@@���x�X�ݱ��,��=�ts&�X=8K-6��� �ܬ@�"�X�{� �VB�&��Kg����>��a'�7��>����g�I|L �@���i�Ow�h&����PRץ��K�j�n=����s����|va"� �[o��鸹��]M����u�����U��O���q�4d�g�ou틨�/`�Җ�����+�5��W,4'I49<��M�������I�S�%6��@� �3r �E��C�0�����"�]U!��(�R��RT���H%hM4�������&u���똄L������C�Yq0�3Y��>c/���dh�����J~���r}��Q����7"���_�lE1V?-�f��㜒(ىF�;���R��m����A��D��7`p�1�C�gnah���ė���@�{<3s�p%%� ��5�������l]A6��������{�����C�I������j�ܸ-,���O��@1��j�`�Gko�x�������]:�^XN�r��\Y�������ud�F�V�8���X�A/;����r����%����,�� �馆 �@�V7+ve�� �S����oV������y~��N_����7�0�/߶��HѶ�(8�V�`�</+�nD�2'P����A�ֆd�����+�w�p�x�'{d,��Ly(M�H�9 ajK|Mg����"Y�}�u�RdR� @�I3@���:8 \Lf���I�BW�n-��`�+y��w�l�*3�x�9���X)�����Л�Z:�Cy ˫��v�F&6 9��FݍR8�)0������@�K��:�B�O\�����]k¥0 rC�0�.LDD��|�ϡ����O��Jܑ� 2?�%�f�a�(����A��"��"S����p����F����Dp�6/LK�g�q���d]-�d�_(��K�#�t�܋c�W&�����3ϣ�w��xXy�Ϧ�`���<�`��F�����.��������p�(c�m�{³$=�-6�_��-G��w-d���Q� =�GW#�!l����%1�=^�ő0���I}��x#��u��Ă�{'7�v�����&@���o'7�YW�@�I]{�G��#������I�Qvt�!�Dd���{pq�� a�^Ŵܼ.Ty$>�o���f�D�d�]�j�&�L�nw~Uǧ������@��Ɋ0�Şف�}�n���C� 3���-n���$��Z��Έ(���5�<��T����8�[;�f���6U�?H��,#�*Dj����2��Tn;��1!$�����,�!�R���>[*cʹ'Y�i�j 3�����N˘�|�m�rL�����gX��c����h�Tl ��X�k��u��^ <O;�(�0vb}��������|0;ij e�< e�������+����1���e����Ms�e\,���aX�w>x�F&H��I��,C�4[�s�:Je�:dr��
Static task
static1
Behavioral task
behavioral1
Sample
039549231a4970f2ec8fcdba1e971ff6e2c3b74ea260c8be01327423cf1ed650.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
039549231a4970f2ec8fcdba1e971ff6e2c3b74ea260c8be01327423cf1ed650.exe
Resource
win10v2004-20230915-en
General
-
Target
039549231a4970f2ec8fcdba1e971ff6e2c3b74ea260c8be01327423cf1ed650
-
Size
6.5MB
-
MD5
a8ecb374d0edba872fdc9f17a4f19d9d
-
SHA1
fcf01bebc6df06b2c9e6528983c7e71c37e3eb34
-
SHA256
039549231a4970f2ec8fcdba1e971ff6e2c3b74ea260c8be01327423cf1ed650
-
SHA512
d790ca773afded53a277f5a27a213e5b04a4f944ddfd9d70e90f0049915a44c5decdcd0b8dac0573b8064525f60302c386683df3c7afef7e4c1052ac0aceb5e5
-
SSDEEP
196608:OgZezn8bvpFtDoKRXLiHpAu4YS+wrB7hWn:AnWXbBLCpApYg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 039549231a4970f2ec8fcdba1e971ff6e2c3b74ea260c8be01327423cf1ed650
Files
-
039549231a4970f2ec8fcdba1e971ff6e2c3b74ea260c8be01327423cf1ed650.exe windows:6 windows x86
e295f7ac5cfd5b1eccc92938ee409067
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetPropA
gdi32
SaveDC
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
SHChangeNotify
shlwapi
PathFindExtensionA
ole32
CoCreateInstance
oleaut32
VariantClear
oleacc
LresultFromObject
Exports
Exports
Sections
.text Size: - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 989KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 647B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ