I��Zԣ���6�-��a�[�ݷ6+�Wƣ��+�$_���PB��TY婛䔿~��� 6�����0�4���r� �7�HG���y1�c2�U��d�����v�I�/���ſHݞ������r�X�����;��ɸ���Ζ�4�wz]���N.�� ����eI�N e�+jm�]��KG9ocY���" ��I�T�~/��yc�����K�pwk��E���T�������B�]\1�1X�D��ߜ�w"��������:�>����Q�VQi�s�1�N��cr:���� ݊~��'�uP� �r��? �N�ݰi�"��U]��d<�<�"��a:�_�2��x�1���<`ǜU~@�+r�k�:1�j����=���sB�3�#� ����\����0�b��l��܊K�WU%��"���?�j+��cA��Tl[||���)Z�x���� Oo<�<o����?�@A���+;~`R�1���!u�����ג{flT���� ,7ʥi=4��\Ąf���$WK�6���S�b����-�_OP�F����j�a�5.�#;�7����dB�3|J纮���l���'��s$���K�a�f?���S��)��=�]?.L��٪�c������C�F���p-쉂M n��?M�C�Ŏ�/Ӿi�\�~�� �kp�Wδ�; �bՁ;�߰ք��r� sr8;+ ?7AYy�0����7ٓ��x��g��HH2*�W4[v�~A�丳-3��L`�]���~�*��{��b��#G�aTs�F�E �)Hk�P��_���"S?0���k��8��|w���bO���S�f��B��N&�x�Fszj��8���Σ\Ӕϭ���5v���*�"����������=�*�I��p�N������`#>(�:�?N�����X���Ҕ�H���L���B�lP�ym� Ҳ$k�hQ��ec�⛴cg|���ģ���S�Qk�6�O]���|t.�{98э�g}�kǁU�n�q����<}�;=��EŃH��jdž�+% �w+��)������_[@A�X�Ӆ��rT1GHtԥBlZ�6����);Q�~�2=Ύ�`=�rK�a0�%ηaY��i7�{����� ���p�e��Ů��Ҳ =֫='��+��h* w|C��eQ�_Z������,���홲z��-[G����&��\��[D˦��h�R筌x&� ���D�O�Yޚ���� X0�#k^K�(�oZ�>�_�~X�jj�Q\jO:?�,s�/г++@�����d��+������/I���!��3�X�����d��I�\�%B��p�p�I}�M����+ɗ��I&Ml���K���SO�_g�����f��W�1z��d��W��dؠ�K�Sq3K�:CD�J.x5G�/���T�XHq&�8��t���̮�MH�F[<�+��������D���`�4�<&w�}��#������2_i��qӿ���yե`c� yVUI>�"�9s��|+wP�i7@�|�!x��7�t-��G;��N7A���ә��h�ܠ�S�yq�*t8J%'�A��uUN��$��}��*��\���(��n�7���sA=�~�����E�5U�,5p���K��z!2���������I���}�������v�k)h��5��x`�����yy��*��%����K�-s���L����N)UĠ\��z�dz��'�o��F�������� �M3Iť���%Z�R����}R=M ��J���Y���ψ�����cJ�aXc�PP8��Eh�yU�>H��d�q�\d^\BۗȆ���l�Y�3: 5��D�Xo�y7�/�*�Dn��O�2df�& N��Ҏ���PI��������٠�<��v"_�iv��M�����Vmge���7o!�MƜ���QGFM�&�!�OX�`�N�q����}q�3�_���8��a˦'��1Zc���, C©~��&����F�� ���z��+8Tn��F���ʭ;~�`�����Qu��K���H�U�w����)B�4�Y��#��D��s��½bd7;,;��,^�RL�aŊߙ�I��a3v�w��/��.��������5������6����MN�7�J5m�f�t��GW�i�]���xjG`���h���$����z�ʑT�&�WV�y�̴��n=��m��<?)� Аg��9�P�5�A�֯� �KOMIOT.˲']���Bs"�M9�8��0�#{7(� ����o��jC%������'Zr�����0s�#��I�=� �9J��+]Ps|��0 "�5�i����l�ދI�2gm-��8�I� ��M��G����k�g����ϩF6�w�'�Fsfσ�.qr�%���R:}y;�J��� &F�B.�Dk��]�e�z�}�&��f�K�Ýo� �s �[i�I�zJ�\3P���\g�V�x�%� y��lA�\2��)��?�*����ή�cI�g`������t�ν�ϳ�J/K�Z�tP�0�gfER�ʹ�N�/�yc��U������;��I�V���w�uť�6s&������T�W%�0j-����5���o��r�u�,�e����g� (�q��*y~�;��*�=�-聒�I�b�R`|-�l燏 �\����Kv�T���%LB�����7�[��k���Yt��}�1˅~���# �����:E�]"��5{�79@k%� ��;���� �2�y���ST2�wX,�i���r�� D0����� O\�t�E���\cA_�Y�hau��R�Ӄ������\z�}��X���QKX�_���i&��X�6s♞���It����4��u C�YZ}9&A�����x:�{�rW�*�/���u[�%�}=�d.4g|�9\hf7��H������V!z�%�)�O�zD=����+�1?%�l�.Pz{��]�vj�`\B"�����C�4V)�T���^<^��)��af[ᦳ���`�����.M�1��[� f} ��V1q-8�)��������|j�7e=��A�N�j/S�m �"���߫��쎹��٦��*h�V��0/����ivZ$5O��T��%GbI쟶s:�� ���Sdi(��
Static task
static1
Behavioral task
behavioral1
Sample
02193ea9d250fe4a8e6074599b1d6d324a3b5fd163ac37e4f48011e23b10c6f5.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
02193ea9d250fe4a8e6074599b1d6d324a3b5fd163ac37e4f48011e23b10c6f5.exe
Resource
win10v2004-20230915-en
General
-
Target
02193ea9d250fe4a8e6074599b1d6d324a3b5fd163ac37e4f48011e23b10c6f5
-
Size
5.4MB
-
MD5
6f2b483ddb066e6a6dc0415be313e972
-
SHA1
e70ec613793312f6fbcd571c16df93f5642b0603
-
SHA256
02193ea9d250fe4a8e6074599b1d6d324a3b5fd163ac37e4f48011e23b10c6f5
-
SHA512
72b4b40e58660b081bf926aa616d03ad89f060e96e91abad33c85fb64297af5a3823a0ee4a6406c3171ec1c26e8dab4fbc3b65f78b6d98229c2cdf9e71b2bded
-
SSDEEP
98304:PNxeBu9/V5kg4/jXZmpCKoorgUXk9E++wRFghtjfxSxvbaniaB4yEpMYEl:PNxf5kpJmMdorgxGBwRFoSh+UpEl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02193ea9d250fe4a8e6074599b1d6d324a3b5fd163ac37e4f48011e23b10c6f5
Files
-
02193ea9d250fe4a8e6074599b1d6d324a3b5fd163ac37e4f48011e23b10c6f5.exe windows:5 windows x86
1f2f097cb1813f60ada77c70e3780f28
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4424
msvcrt
fopen
kernel32
CreateProcessA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadIconA
gdi32
GetPixel
msvcp60
??1Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ