{8�M�n ���[�5%�qҩYj���Z�d9��!l2�nך�or,�.��i�/ �\c��J$�c�L����Z�D����v���N��-:�����7A������bGb7l�V�z�J�������V�wZ��5��v~.�Vtf>/�nȺ���1K����-����ށ,��Ÿ �Υ#Es�4ñcz���_�z�VZ��*@�ve�5p�����Z���f8<h�9-[x���� ���HW��n@zu�R9����s�#;����z��d������.��J�gm�}�n��hE�ߗ�z��)%>o�u��Xe�碒�I��"2\[���.�?g@�[�R5`�C��ȡ|a#m ��>?7�T�Ql =�t�7�3ɫ�DN wl��̱˹759I:j_~D�\��~-� ~}���j4Q;�QaӋ!!'�<�3q{�@�v���wdo�%�����%J0=��4��T��-I&b�i]血,Yޅ�U�ZOd�K���a̿��_`��땔�^�C�� ��)���eQ����ߔN2b�u1���~1yZ�hM r$/x�|w�s�;N<E%� 8&��{�̑�0)_D~��̡>�p��p!4���9R"�̽��7���Y�r�m�x���5���Cq|�+���>)�{����0���O?<�z�UFy;ٱ>��_�nFbB�4�`���;a�v�$��|oK��ᗼ�XX�4�����>�l�Mo����=����`��[�ߒDu�4ov!e���! ���f��vI�� �K7XTQÅ���yq�l�E;m��7��8oj%�q� ����r���mwh-�����V��.շ�n[��ܰ�!�;U ��+���6���β4Y�v�d/n���l��8��z{櫓�Fy?� �弤V�$u2Y�&��nȁ�<z�>�tXn�<�Ғ.������4pv���S�6U)�>wр�w�q>l(b�'@i��)R���;1Z'i�$�^c��`�\�G�9��ʐ@d�;.>��"u�EV���k}2���ƭ'�7����˵C���8 �͏��CX��겞֝$?�5.���1�����z�z�: XL�J�F6꤉nǺ�� �j*H��ע�Y.�q�G����df�N���q��{c9�����D\�O�� H�`�?�ΩM��.�[Ԃ��O�W�3x����;��[!��NXU|�8��tF�Zֺv�x��Wg�(<[gX'�H>�X�H�ʫ����~������u'�2g� %��%&?��N���u�J���_J��y�� ��Z&���x榔u|@j��n�W��9�4{��W� {ݥ���ۢo�A�oN��KO���/Aj�/ͫ�w���YJ�����������,?�$-a U��5Yd�w��ɓ��ⴰ����1�×ǡȤ���ə)'W�7-�S�k>�bY�+�nʷȥ�1��ԙ�w�h�aV),ŕ>HZZ#��e#��1ן���2b�aҸwP� @z��.2�ԍ����T��L��=��u��(�-<S�'a�F��tX��t�A���>�Mܞt�wa̸T�̕���6��q��7;}��J��Y>a:^RLBB!��3�W$ھ�fgl �?��=㢈6vd1�#�m�/���,ݍ,�9j��R�_�3q~6�|�V��L�-=�p���O9.7��I7�����`=�����[��j�o�&A$FT���']mt��%QW.H�/�#|�@�f�n��g�Zd *G:�.a��ݷ���aS*�������� ���� m�����P��rnt�~���@�ʺ����0t����D�$u�St-��֛*t�B���4v]& �1o0Ew�y���zo/̓lS����6������;����f�#Bv����fc� �<����=��&�S;���ɕ��GI��}���*���"�ECBЛV����)�՜���U�R+��ʥSĞt���*~BB�tD�y#I�Mw\I�o�Y"|��6��) X���'�1;��ճ+x���#��U�>���!?f���>J�㟘B��#ϓ+5���uj⽳�@�F�R�� '9�z�_��#����5�w�t�,�@㭊�̈́k0��=��|O�D����1��d�S*���"���������QX��\'���0rx�~���$��GB�d1���� �d�D�Ư��o^Һ�=._��z�d������g�/#?�*\��qq5�6���f�U8W ��w��Y��v���)Z�E��Ub�"�������l�6e�ځ�"ЎB�+���4.�k�BFZz��N�Z�!��1'���n�.&t����R�o����t���}rl��s�lq8�����Sä�/W,Z��Ǧzè���+ޞ�j�P��M<��w�r��.������H�\'Z�G,q�lqv�N>Ň׆7���'C�� K�Θ"@� �p�c��Y�b�;���/��uiLR,��;Q<�^���L�(���'*_�aL /��M�ч���+c6��9�����i�эX�u.6���S%��ý� � <[��~X�������è���j��� � :�{gn��ǖ�%��6�s"���Qp��a!��t|8����6�0m/�kD���OcVj(fKc�#B�Fk�t?_��z�A��>8�3{�y��eB?A�L��3j����Rg(�38j�v]�_���g��3�#e������;7F�D��hv�-�*0��ҿ I\zM���r0�x鍣�����>��(�$�~��� �n�ܝ� �������+Yr�?�ۮ�w����?q2�$����o���e�z��v��Z��L?�J�U5��>R��*��Ԙ�fu�"N:�L�ݨ���#��x�.��x}�)�G���K�7��� �OK�h��Z�zp�{�!��� ��!���n��@(qZīkS�Ɏ���4��X�[�c�t���܌W�l��g�lQ2D���Q�ֳE�@`7 p@ X�1[��K�d�KL3�/Ky� 7eqr���\B��%-=��5�9�w�;����ԧ�`Ehi� �ih@�=�js��,�����̹�9���o /��-�"CzQ>�Y
Static task
static1
Behavioral task
behavioral1
Sample
4766d43dc31f294734c4d4ffd50c3be77d0a4b606b036f895d22cc8adb41feb6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4766d43dc31f294734c4d4ffd50c3be77d0a4b606b036f895d22cc8adb41feb6.exe
Resource
win10v2004-20230915-en
General
-
Target
4766d43dc31f294734c4d4ffd50c3be77d0a4b606b036f895d22cc8adb41feb6
-
Size
15.1MB
-
MD5
7cdb04cb6fa5d6bc535472911f332cd2
-
SHA1
caaae6ce7fbb0460a6b45cd74a2bae9935215403
-
SHA256
4766d43dc31f294734c4d4ffd50c3be77d0a4b606b036f895d22cc8adb41feb6
-
SHA512
cdede0f1ba6150f06c2385f6783ec2744ed4ef18c4a17a1b1dd1f10faba9178ff6ef5c6f1ad6a8d123ee57d2b9b86589ee9f839a82592ddf863957240698a37b
-
SSDEEP
393216:yRulAxRW4RHuPckXpYVL5CdrYfNIQFK+Bho7ARI:iu6/OP9Ylec1IU5Bhoz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4766d43dc31f294734c4d4ffd50c3be77d0a4b606b036f895d22cc8adb41feb6
Files
-
4766d43dc31f294734c4d4ffd50c3be77d0a4b606b036f895d22cc8adb41feb6.exe windows:6 windows x86
4e2231c3e83947d447c3e644202ac884
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winhttp
WinHttpOpenRequest
kernel32
GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendDlgItemMessageA
CharUpperBuffW
gdi32
CreateHatchBrush
msimg32
AlphaBlend
comdlg32
GetFileTitleW
winspool.drv
OpenPrinterW
advapi32
RegEnumValueW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHAppBarMessage
comctl32
ImageList_Draw
shlwapi
PathIsUNCW
uxtheme
GetThemeSysColor
ole32
CoInitialize
oleaut32
SafeArrayDestroy
oledlg
OleUIBusyW
ws2_32
WSASetLastError
gdiplus
GdipFree
iphlpapi
GetAdaptersInfo
pdh
PdhCollectQueryData
dxgi
CreateDXGIFactory
winmm
PlaySoundW
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 390KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 60.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.giats Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 15.1MB - Virtual size: 15.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ