c��g��A��-x�P�j&x���k��!B �A�$~���h��Ĺ*z@3)���v����D��sKk�5�u�'�e�$.�^�=��a)q����J�q��T"��$�{ة7�S[_;m��ki�+<��� 1���R^��!�`J�� rn��C�p���k�3���-�v��mT�ԍe���k�[F�ε��z��]}���|M���)~����I2n)߽؍���G�W1c6F_!:����ՙ<����[]���&�\Kcp˯��'(��A���f�J���]�P�x�x��id�ksmm�a~��'T���3��5�~���3��s�.�,\lb������j�v�����1��)/0M�tÖ�36_��:��C�c�����r���=ƙ!�[����a�#��o��LP�,�C��D��8�"�r_�3�=1�CE�E�n+��~�M3]��;�[������&3��g����ޭP��nC9$/�̙���q�������Xg�xT�0� �d�ƕ�~�/@}Dbs�f�&�:ci��_��H���Y}[;��o�� t����T�6���]DB�#�P����z��1;+w��s�pT��-K�e����v����X?�4�F�m����Vw�y��Xi%�J����E�j}1'�M�E\��{@R�!X���K��>�%?�Ю���:ʡ@�Z� ����2S�I<�����va� ���[��ly���� ��Ǟ�"j`���[�O��o�{���ܙB*�V^ ���Vm;�)�zK»��Z������T���6�����a,���V�I��XR3��s�q��M�pU����X��}t������r��[� �b� �Tܑ�Ʊ1���a�pw���c�_)��#��VG|-��`PV��-��M��"v�d.Z�i�K��Ց@~��[!۫��� ?7��[ya}� �g��.��Υ{ o� Ϩ�.0N����C�(b��τ$��g��ݽ��¯�j,R�H*�Ǿ-��Y��)�Ʌ�Oȭ{5ޗ"�M�6 �KD�lI���c�����w����`Dak'a^ɮ��WQ��A��P�����{ZM����ʩe*�� ���x�T�q�AI[�l��Er|�QPZ�@���$</ ���T|����.��e��N<�Te]���.j�I�������A��)�R��a�#ek��a� �Ӝ�31[B��2��\�����4i�B���[)7\E����<_P��g�����ɫߞŨ8�C_�{D?ŅG��qdž�_����I�TB��Ql��q� "{f#i8�l~�A8d�e�P�~wQ� �2J�_�Oq�Ϛ��3F��j���Ph��B��a�T��0V�t��T|�3������'5w��=�8)m4��ٓ�g�z;żT�.��R�\藌1��'�cFőG�s+M�O,�a����������=� ="͝�x�m3ډz�AO.��xK �Z�]_�$W���E_(�y8�@2�qMO�y7>��\��KAB!����9;V�J��͓�;�5��D��'[ء������h^����5v���w[�M���S4��z�":�k���k������+�v�Zs[W_�?ZB/�C��;�i�����~*�;���}�tq����d�%�a'���~��ӫ���O_%&�+UP�P�n����m@e�;�(�vy�F��7����1q�2��YM��C\��4�z��o��^�h�� /�6��͔�0��t����-�x�ؤjZ������P���gw�QXVT[�� 5��n��t�4�n�u�?nDž��H�*�l�:�����������WGFP���N$����Hno����@�S�8Uń�J�5a�����Q���⧿��zZ�Ú��dEֶ$�,l��N�i��0��ӧ��f����h�5�ƨޚ4���V��=Ᾱ���L�+Ԩ!њ���Q�n�m����н��A��"��d9�W����(��] �o����D<˫h(P����H��m"����J��ђb%3ƅZR���E����4�5n�5R�P�+x|��XM��?HZ�u;��- d��A�.E9�*L|�%�r�σ61���j|I���8�٢�x_|]��� G���Xrt;����u��4��T����f^�]2OTM�T�� �cEF����T�\+!�{mֺ��ڈ��kA�F(w�9z�Ǹ�������MY��iY��`={�s�V�(�(̴�.�����]�B]�t�⎖V���֎$Άb�$����#�jH�R��2�a��V,w���v�X�6�+�����-��< "��7�G|�3\�9thXV�|��_+_O���0���6�Oh��_3>��a���Agn�֜��.��CD�S�����q��qLH����]��U4jC�$<��!ç����uM�< Dw���|�����h��ހ�5j�U�FQ~zy�P�������ˉ+��k[�m>(;P ��w�Bu�^E�;X��1^�PB������B����̩��x���t7�`R�R��q�G�q���q�{�n&Y���M4�N���"���;nLi*@�e��A�㙏���{RD�:�q���ME�� ����?4I�a�|aBy�#��>"��t�\�N��R�HX ����k��R��L�C �B�~�T���* m��6Hs>[�~D�H��1�7�A�wO�HWp�&"x��x�|�t���:v]y�~[ P�=1� [��3��u��x>#��7��p`H � ?y���Yp'O2�քT:�_LOv��s&��&)����^ :�0�i�gJ+��?�8g*��m��d���Ze���;�r�p��2h��!���.�-t��_Ʒ���2^�1P�䊡/}@H��P�G���Y�OWj���Q���+����Y����E�Aw(�Y,��?�?���:a�p7+l��g�7j�����@~��oJV��SIO����i+���g�1�/hJ͇�� x��W�����9�P��U Ɓ�̳��D��� ���W�}$d��=�)-k�5��T��8_U���ю<�cis�9�[����lU��G\bh1�����;�8p^isO�W�Cs�����M��;��P+��1
Static task
static1
Behavioral task
behavioral1
Sample
37201de387173d2ca6ccc5aa2561a647ec4b1dd4bd2b3e96f26426676f414a09.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
37201de387173d2ca6ccc5aa2561a647ec4b1dd4bd2b3e96f26426676f414a09.exe
Resource
win10v2004-20230915-en
General
-
Target
37201de387173d2ca6ccc5aa2561a647ec4b1dd4bd2b3e96f26426676f414a09
-
Size
4.2MB
-
MD5
b8abf419917249f8b03f1ba01860cb68
-
SHA1
4b0a4faccb66739936e518054b85d56204a3239f
-
SHA256
37201de387173d2ca6ccc5aa2561a647ec4b1dd4bd2b3e96f26426676f414a09
-
SHA512
894829339a16b9121189b0a269229cd9f4013b966653e1a1b18380c6a8fe9e4036e3da35c414dbb0ed07e5dca1c8cd82955d2f8c87169c9ec7c5c13cfc34bf0b
-
SSDEEP
98304:TKrzaJdbuyrOgv0d6mfli6qYqCxzZo/VzrIip3:TKnAbuyLsd6RHYUprIM3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37201de387173d2ca6ccc5aa2561a647ec4b1dd4bd2b3e96f26426676f414a09
Files
-
37201de387173d2ca6ccc5aa2561a647ec4b1dd4bd2b3e96f26426676f414a09.exe windows:4 windows x86
c2f459cfa45385826b88dba57b2f8cda
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
RaiseException
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenu
gdi32
GetViewportOrgEx
winmm
midiOutReset
winspool.drv
ClosePrinter
comdlg32
ChooseColorA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_GetImageCount
ws2_32
WSAAsyncSelect
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 440KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xxfsf0 Size: - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xxfsf1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 456KB - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ