>sL��x"�����HƨB��h�ԝ>H�q���&T�;T��;���������8������gp�����N�ξ�@nz�ݕ]�J?σ��n�s�D����]BJշs��US�i �-�W.��3���p4�c������~{/L��H/ g��y��Ъ��::DFC�LZ�7v-R�ͷIX�ܱE�}�.�tǧzc- 1��X����6ֹ!�� ��F�\̱�ݏ���E�{�Z��*�c���� �5�zƽ��u=���P��a�>�b�_h�&W��#�嗉6�B�tcoЮ��愝�>߉5vr���U3eڟ��$@!Ii��?[\�bs���뉜fd�R. �߾�! 8�����Uk�N�e�&� db�v9c�~������(�Vו�e�Mre�;�'*���b�g3?G��n~�K,i��C5����Z���Ѣ6ޑ!�� �)#�'���Y�Td�fg�<[�Z� �P �v���4@@V�!������h��5_G�kS��q��з�|��P�9����f-��]��" W�����;F�5!)J�F��Ӳ��g��&)#L$T���7�Ν�K�r|8aY=o;>�t!�h��s~M��pj��r�z��#g1����%|[<g�bln�a5yj'��*W.�F�K�Q�vq^F^Υ ���JQ獫^�I@�5�L8J*��B�S�% �*���)�~�~_�Ź��/0DZ��e$������: ���'tu�9z����68�xfۻ��� sH_,�O��2�7�l��1��,{�]�}�&<�����Ch� 3����,H��H�a)�w�eS!d�ފJ�%@aW�:>�Ew+�F_�?�� P�Kk������4'��:XΈ`�Y��b�a¡��!{�״�}��qN>�&�U[`=�bG��M̞Z���rm���?��b%>�n�����-נ�f�H�3��Ӌ&؝���oP�P2uQ��1����fb��E���š<AI��\�J�)�Ĵ�0��j�G���=��S$�&�� y�i{֠������MM�HҬ{�WT~����[=��*�G�`�����!~t�R�Y���A�q̽Q�����pRտ���������H���0 �^gtX�VJ/��{j�d̄c}��_ș7������`�K�y۱(O�47��kU"G�Y����s�s���9�}�6\�z�i��7�cm�H���AsQ^n�So����-#�5a%a��3{������E )��E[�0L#,k嵊�+��:4��-�� ��ժ%^Bl�6V"�r$�_U(�m�ȶ�w�]��I�ƭG���&����"��CTw� 4�3Q!���#�������\Q�f�K�Y���"�pH٢Z$��bA�nw�\q��"���z��o�K.�,&�*q��Ч�4Ԋ�*SG���g)�����ԡ��I�Fjh����B���A�ͅ~�i��(In �#ML�/?��[B�߅�z:�Ƃk|ד�5���'r&�wt&���o.�F�>��~�"�e#)&W�Y��<���OT�N$nA6�-�i� ww�ò��{`�uδ;�V��L�j~��0����afn刐���M���������w�|��3e��U?jo*LTů��,�>��zL�����O��������PYݿ2-&�8t�)6�����՜8cʼn��W����yO�7,?����'X����w ������_�Κ��olv�Ņ%����R3T����hx�f7�����ji/�q{��͵�"^�q��m�~�ُP �7}����T�ݺ� wf#t.P-w���cY2X�������l��#�ZyX_���v����Ǚ��y�jp���*5�r?gL����<��NvR��I[���h��H�.s�!����C�e��N#�.6���7���# ��\����0N�7N��W�k#ӟ/4,���c���3<���4���l���V�e�O�|���ۖ�c���@eǒ��o@u��s��>�j2�(KPF%#� C.|0�o8@��0��]�L�V�B�_Dۢ�`��Z��N�vL�f�B�i�t�Fcu��F�iP7>�y7����Ɣ�|�jj�&�4�1a$���̀,�mX�B2o�<���mI��f�*.�z��i���b�ޤ(��eu��!����2��[G>�����S������ˢrp�L��;��L҆���x� >���C���y���i0Pm���}��nz���c۫n4�/��ZSD :s<�N%t���R�N�yq<�1��9�~�谱������6�`�����d�z�9&�+������)zC�S�D�{���Y^O�m���8g���S��'��Wи��AM�4�D&���3����B�9�͈�(ؓ��E���馯�^�2��2yP�q �.��YV� inŌ�5������I�%*�y{HmU9������gI�wzj=����Ry�N[�����}��Xu�5$�7���E����?4���b� D!��K,7�0&���D�{u%Ъ#�g�Z4��D��x�s�{s3�1'qeƔ��L�%�t��%b���}�.ລa��};=LO�"����Ј��Mg�7#����h9��^�N���}Z-J}��Y8#J��ʐ|_G7���w4|�a�l�R��.T�������U�1��X�8ҁ\$f(���tI j�Igs�F-j�#,�cQSū����cۭ��Y�q1��D��树�����������-�Y(z4wnP��� '`u����������i&�Vl+����#˙������$h�cVmD���k S::ژ��A}�칅�%Ԧ�'�k3�iP)tގ��ưE��\CV��o��eV�-P�0l�10�S�L�F�T?�[���uh�r��)��-�q�����p��ˀfa���1x���G����n:�,������mD3�^�un�Cq5ؼ_$?M&v�o�w��_��^�9�R�d��z��_��l��}¶���"��*���t�'���d�Z��#� ` �j��b�$�%�ш��)R���-�R����<��?>Wlv���̕�M��ߝ1 ~�W=��|�B����I��# (�'��] ��6��R���A~�]N�����\M
Static task
static1
Behavioral task
behavioral1
Sample
dec82b997b63d28718708c0cabd9d8b0f20a9675b9ae6d7799f63de2108062e9.exe
Resource
win7-20230831-en
General
-
Target
dec82b997b63d28718708c0cabd9d8b0f20a9675b9ae6d7799f63de2108062e9
-
Size
14.1MB
-
MD5
a970c410ae813ad002423808ed3e3a13
-
SHA1
bf2587bfaa2b559aefce8099b440c1ad644733a6
-
SHA256
dec82b997b63d28718708c0cabd9d8b0f20a9675b9ae6d7799f63de2108062e9
-
SHA512
dccb48fe144d6c230568207ca179ec05d0d0bf8ad44d3de09197e5dee884d30b2cb36d88d42292eb16db50b20fc734fb4eb298724a98d8f82cab0257029351d3
-
SSDEEP
393216:qp3FIUx/bN0/mo2w1RWdesesT4uGvegxNwniQin1L:qp1lxD2mnwCd1esrG2gx11L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dec82b997b63d28718708c0cabd9d8b0f20a9675b9ae6d7799f63de2108062e9
Files
-
dec82b997b63d28718708c0cabd9d8b0f20a9675b9ae6d7799f63de2108062e9.exe windows:5 windows x86
899136e23adddf2bbca5aa96cb7d54e1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
midiStreamClose
ws2_32
recvfrom
version
VerLanguageNameA
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSysColorBrush
CharUpperBuffW
gdi32
CreateCompatibleBitmap
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
GetUserNameA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantClear
comctl32
ImageList_DrawIndirect
wininet
InternetCrackUrlA
Exports
Exports
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 575KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 755KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XA0 Size: - Virtual size: 10.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.XA1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XA2 Size: 13.9MB - Virtual size: 13.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ