s'��|\�k���3���UfYVK��2��#d�DdP�*��SPZy���o�����LFe��@�� � �O"����_��c�1���p�GÄn�v����nL�]�+уxAg��+\É����- IB����9�{�ί�}�e����ʬ{alA{�[��?"�ɤxm&&����*" Ȱ:��T� ��<{�*�H�O�G|�9<o���շF�5�{�lg�8ȨB����>� 0J8-�!)jQ�6�9��oja�a���������pF���˯'�µ�Ob�t)#��=;���z�E�4Z��40գ��x�KJ���`�싨h��1�,���[K�u_���3ǁ�^���pz`Nj�}��hQ�p�{z�1�<��?V�i�F[���� � �a�gVM�J�J��J��8E�� {j�n�k���[�?�=l?������˚�X��S�5����E��gE���yg@�%,��'Lj�������G���\��^Мxs5���"ԧw8s������.E�~�����6eV��9@D�4�_^�sʸj�i��fF�Z D�DŽ�VP��<2�"k �"��L��b*x�,�LU��*��H��6X\.���R���F�F U�c �*�w6�pd�f��O�겈�y*�T��}�z ������'�M=�<���F,��xO3��+�z9gx�����G��&AL�,m�L�Xs� ��wr+���^s[d/��s/gX}�UE�ӯ�r�o���/�7;���m[����zǣ�h��f\b!����czW�$�'ҥ�Φ}��h[�@��k������ℛPԂ[�(���>UjTûFB�f��u_$>�d��̦p�����$`�"����Ua_/�?�o�A�I! T,���0���ځA~�ot(T{�WQ���� �h��!�͠���n�J7r���l٩S*�R���5���p_X8[����d�Q��??��P����P�(���^�����S��[��*�% �.��m��&��d����-x�($��S}8���߫K_�-7̬}���m��"v���T@ �=�ǒ��Cb���GlxT(�,�]>j�t��֫ʗcD�� �<2W��'�{�?�v��d����~?�����$���:�|���� R��]f+���N(,�^�ǺE�K��>�՛��ubH�ӕх���u�c=�Μ�U���sYe�s�5�o99������K��VS�J�_�;��FMm���A������ms~�T��˻�H{"�%�B����_5�z�}�G�d��%^EJհ/6��_����S����i���R����3.1�{��q3��v[�N{�T��Fg��FN~-�(����ev�^��2� ��h��E[[��Y�/;|��Ǔ�<ĹZ���Y�U�W�\�ഞ��3˥��D�&)�x�?{y}R���� �-�#|���Z0��g<�������.�ہ��e�s>c�����+Уoˋ����-�V��d�� �ϺA5[Q��m�\}l�����Y���=n�`���ܞ���z�P���"��#����{��M�Ц��ѬDWW�����WI"?k>鯑�І�s�������;k���W�����R�� �:X�**<݃� j���ρC�X����FfN0¨:~{=eI~��,����O�sq��k����f�?�;K�;̥$;bi`�M$Ռ��noO�K��r�uy�QE���\_-^���z������ni�� H��~ڦx�����b�����-��� p{�d�Lܝ㚯���[R�J#��h���U0�wRγ-�pΓ�T�q�b�w�*��{wA �c�0�K#Z����v�1('���B�)�����";f6���*L��L�� ����1�ʅv��s�g��l�w�]�p��������s�bn�ȕ�(�#+%t5�h��nz�fٖ�4���@V�p%��ZC[����ƭ�0u:/��a��vݪW��ف���4��P���jN�;�ۖ�>���D��^�ٖ����F���)��nݺ��$��uR�*���-�w�|����uv���ݚ�)w����B ��߉cf=%=xv��攢{c�D�#����B��ӟ3Aц�ŵpа2��Љbŭ`s�6�i�y)�[�vS�0��̝�mj��U�v-T�l������<m�y�b& 5�s0G�r����*��� ��owɆ,�}�Rfj��M����%�}�� �eM��oKXo�>v�M����U����2�����Y%ДW Vi�ٷS:}�&� D�w�1|�r?T�c� �S�8 ��kK�0�,��r$`��i��;����ܺS��NVF�?MF�0�^B��9oqk ��J�*wq�j�C����^[R�����ǹ�@w���̞ʩ1o6R�_�K��1��9�B/��_R��f�R)Wn�^Kb��)�x������'{��3�T��j��D5%9��z�B7^�-�b��0lj�'��qs������ \������0�2a2��?��K6�x_~M�<��ϵK�F�wp-# �w��y��R^f� ��3�](��t��E�ފI � q�@AF����>�T�˲�=W�=�懲�4zO�=�i����D���_��*�A��I�W�@�o�Y;j�T �zl88���Em��ќ�T�3�9�(W�����ԖLpK�w���W� ����]�7_���(�Z��u���(eB�E�,qP��2��6<�!��AF�\��?4S<��q����J���kG�u����Oװ�r�Y/�V��u����8�jD����v=��A��5�DXָE�0@�x4� �����[�C�� �h@Ai������s�X��K#��� ,���1O_����9,��Y�D_eA�rVmM�b2v5��Q^����^�N#��蔛]}�L�I��g�����cJ�[zH�n�z{cQ�[��%�����-��b�a�S�?:�^H�$��!>�o(&�7��i���\�O�7���x2�I�|6�������c�n ��)q�Gμ�J;��/�hC��_}�������&MJ�z�K`a� ��<WR|��Z#�'��Z� ���
Static task
static1
Behavioral task
behavioral1
Sample
b4fb337c793eced294c6597182cf00231bd8c7efcaa772242bd168e5eee07f6d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b4fb337c793eced294c6597182cf00231bd8c7efcaa772242bd168e5eee07f6d.exe
Resource
win10v2004-20230915-en
General
-
Target
b4fb337c793eced294c6597182cf00231bd8c7efcaa772242bd168e5eee07f6d
-
Size
8.9MB
-
MD5
b08878eabbbd00dd89ac6d1e10d1e1e8
-
SHA1
4db3462c39b3f0f443bb16b07f5d3e62bc1905d4
-
SHA256
b4fb337c793eced294c6597182cf00231bd8c7efcaa772242bd168e5eee07f6d
-
SHA512
5cd59ab11b7721a559777b8ceb1ce4b0df81961e0df83e3594e131b45810c942ab2d900102ae1c9c4099f3135107331a0ceda9067e3f79f88feea0cc6f1f3d18
-
SSDEEP
196608:sYSLruSc6HZqsZfyLdAIUo/WV/OylKo45D3MVb2g1mUNyCK:sYNSsXhNUFZZlKZ5D3MJcz/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4fb337c793eced294c6597182cf00231bd8c7efcaa772242bd168e5eee07f6d
Files
-
b4fb337c793eced294c6597182cf00231bd8c7efcaa772242bd168e5eee07f6d.exe windows:5 windows x86
60f3a95a020d138b224ce1bf36ca2205
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMenu
CharUpperBuffW
gdi32
ExtSelectClipRgn
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetIcon
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 815KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps2 Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ