�jslvNw��Qv�6�(��G�.�����ċ�c!y���>�3P��]�w�ƣ�����/*.���Qf=�к"���uE�`�r�ru���v�!j����&�&���7%wO��?o� �%A���u�DA�<$m����BG���'�Q�2������M�)e���9#{i��[�T�X���K4���i�����J��M��qt�,��� *@2�e�����:�EE�5�ܙ���J�,=uF�%;3��,S�;��,c�~��vB4by+�P�4��͜�dᥐ�!O.Y�P�������}J|�����u:;�n�$`�e���l���x�*K���f�u�:�v�����Ep.B�����P����o_�ɮ���/i#��W"\ǻ��1�R�������K�8�k�@1�!,.Eݠp8����`8���X��ҙ���C����f��p���*���6����|��d��>P���i�{1w)L��*��PÉ9P�}�h3�<��gs3���kk�EmcWh_���O�%F��@�����h�g�'1ڽ���Vj���E��)X=�|4���9��z��nCd�U��ɦ�{��Zn��|��a!�����;����@��]w�J��B��C�GFb���#{��^�+)U��,��z��sӷ|�N�2��R'�_�e��5�,o:��i����X�0��u��'������Y>�Gd�8.a@PE=L����V�g".����(���0tL>�BLbV���r���Rv�Y�N+յVR�J�؎�*@��gf���v�>��?^�e��V�tN�]s���3�+G�O� ����>����ca�~B����n�L�o����v̅�����-`�Z�Q�wqc�i�B��UQ������H�#���;{c�o<��X�����qK��hxȏ������@9�{E�?���^E��\��U�|ʡ�{�S��_k6uM�\x,6% �)��/ߊ�L.�^e�}��ߩ�;8���QF��-��=���=����T��/*�a�C �"v�w�kF�T�tχbe��1��K������#(�"e?��e��`�� ���0�k���NM����r�(|-����;o��yHC�}�o,IW�%����/л˗)h.P��ZHRz%��P#"p��N��t�0�v~qYX�Gg�\����X��0�(_��U�17�(;W����.Kti��g'n���E�0��k���J8��]�IKv�P��NU�'H1��{���*�g�@E���Z,�<������۹%��9�� Up<��_�*��c,�����Z*åέ^� �@"���YlP���}����b-w*�c�R�֪ ���B��ԣg~벀��^�̛���DR-��U�˨��wt�Tu��Bh�k�\Q�Θ��v閻Q�ד�����[�6�1�rچ[��h�ٵ�9����SgVM�U��[���z{�3D� �!��hv�������)���=.���z�/��h���B��S�1n�X,x`�мʸ���r�y��c�!V-~�S��\͜� w��C���t�3%`��fN��D|UD���ɿ��t�ۊ@��p����N�8����jo�pZ�,@�4��:���Q��:n�:��s8�ƙf3�z�u�ѷ4w�m7Wp12yɒ�ׇR�&9rT�+*P���\�>ض�ƞHN�r!��u�FD ����}�n1 vy[�gg�H��;i��|a� :�����}ZnlE���;T���vsԡEkw{M��r�Z���$C�׆裈3�?�cD�K��j�k?��!�Ʋ���T�x���ߖ�P��3oJJ\�:�� !�@ĝ�"Y�j��}���Fra`ZFw��H���aӚx��\�A�Rz��>�Q�M�|Dw��� 8���u�'g!ܤ�On��u����m�t1Z�մ�>ZZ�: �p� \z�{L�'�2aJX<���n �S(��� �]h`�qoG�d��D`��4��vh��{���T��� �y/��%吽�V~�%iB��2P\�k�뎈Y<�QV�n�p�˾�M���]c5)����Q%�^�u�_D+�?䪿�|=`�BA�Í�R�#+��wd7�7*�m�R�%�<���[��A����I�FW�D�T�)��G��n,�|P��x끛���k ����g��6�U��r\?�>bz{��L��mAL�m}��o�V^oH2&�yY����֏1����n���h'1����@mQ*���o�,�d�G���������b5غ���w�}IJ��@�*�?%1�)n�C�R=�sXS0 ��ū�V6�o���� ��p-�w�(t� Z�h�T$�ϑ�`c/d�J�oF�����V̘��M���d��vxp�jb����˞�q�����$���B�%$s��0�� ��1/��r>0t�Xb5E@Ob�e\!�y����U�4��x�K��g9 D��Q����<�|�l�"]��ڢ��7�&�ap�H���4�.���#}�9L'A�s�S/2 g��P�G�u6f�/r���/��W�ͻ�I�_F����5��j$�C�E��U�%r���3sPԫN�_��K�����t�������fR�Z�Mr�,�,:�����z �<�b��i�e��������ǖ�PQ^Q ���}�#����R��|���)<���!��x7̕�1��`o�l�2�d!y'��o�.v��T�� د�w�nEpފ���.��+ܢl� c����\s��k���4z���XS�۫9ˇ�ڊ���F����:^�/'>�Ǔ!v=�1��Ԇ��� ?�O��u��;����k��s�g��M\�n��=ZָPH��59L����ϛ�F��;eƙ&���7�MN,}���^�<��\.Xŕz���g��w��{Dx���*JK_lw٦����$��Na�����8�|�Y��.תWw,�̔_�ǎ���KZ�g!w�~Y�د�zn�W��:�\װ�n�V[�̀0���-q�7�t{��E�6[�t�E��Ҵ[���������t��|s�.�$����x�GH)��5T N����U�Ğ���\x�� �и ��:�(wH _.H���W�
Static task
static1
Behavioral task
behavioral1
Sample
3e182305d6e83ac66f3c93584e3abc54184f42e9cf42c6896a3228ad3a9caa16.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3e182305d6e83ac66f3c93584e3abc54184f42e9cf42c6896a3228ad3a9caa16.exe
Resource
win10v2004-20230915-en
General
-
Target
3e182305d6e83ac66f3c93584e3abc54184f42e9cf42c6896a3228ad3a9caa16
-
Size
8.3MB
-
MD5
a73ce06e79e129d0c9be3e3605e69350
-
SHA1
0f9c17be5de59c5184dbee0e4e8be94acc1f8651
-
SHA256
3e182305d6e83ac66f3c93584e3abc54184f42e9cf42c6896a3228ad3a9caa16
-
SHA512
e4070e4a040c4d55145bb83e9ae923c8b2f28b7223c664ffee6a8c7e29437e991e6a4140a63d4ab3ce2fd1b259c05d29013a791ea8aada041383591bda13bebd
-
SSDEEP
196608:iCbcvnC0sglIZJWW32ly2mNnDpGeyvtWR48D/Yu:/onCXglIjWWKy2ik4R4/u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e182305d6e83ac66f3c93584e3abc54184f42e9cf42c6896a3228ad3a9caa16
Files
-
3e182305d6e83ac66f3c93584e3abc54184f42e9cf42c6896a3228ad3a9caa16.exe windows:5 windows x86
fcd410348ff34133501cd5e373fc0b4a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
iphlpapi
GetAdaptersInfo
winmm
midiOutPrepareHeader
ws2_32
inet_addr
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharNextA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
EndPage
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
OleIsCurrentClipboard
oleaut32
RegisterTypeLi
comctl32
ImageList_Duplicate
oledlg
ord8
wininet
InternetCanonicalizeUrlA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 740KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dbtlbb0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dbtlbb1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 380KB - Virtual size: 379KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ