�"�/��],e��,֔�KG��z�%"��Ƅ���0 ��咃��R!��1�����5�~�� W!q��8�@*9`��ATP��XC� �z�֜4+>��%�~���[\��3��l,h�9|B@��͜�vF�7\�Ѧ-�@����f��� ��6�l)6̬_���� ���X��,�9�F�Q9���j���4xZ�����F&+լG�E���}��G��@��jU�NWa?�L�Ϟo�͑����� C���w��>%z]:d��R�e���\���?�Zw����m�-I�h�!`�}�Tp���\g3��͊�f3�A��ӽ~`�-� T2���l�Hcб�QZ�����:��(n�����tIU�_N��Г��@�?�6� �b���ɋ�x�<���������sش���$�U�H��_Z��k�Ċ�� À�^��\h�5h1�*@�uR���_3��Zob2,����[<�u�z�� r�=1l��m.=�_�#x��[w�%%J����Ά|}�[��:��l�$�o��qJT�T!z���J���h��c����:>�4�K����Z��ipL�*��G����Y�\�����������<feEg��*�7��L�NU�V���SUJ�Z_��t�⋕���3�MS̊<|"��S#��O��;Y���s�&ǰAA#��C���G����%�D9��Ն���_#5@� �U�e�/5�m�g��I��p�aw���SקּݽlX��<�)�W�ѯG�G�������r�����T����ve$fI��+���"�����W5��f&����T�DIₕ2ݺ�1��V���='�%���v��^h_ ��R��=��JD��i˖�F��� $�n֥6f�j��$� �{��X���MB<e�x �δ����K*kb'���Z��BC��Sl� ����y�IY��il� ^v�6��3��3��=�#�O�� ͫ�C�S�� `m8��̂X�I�~b�<�aq�hu�[4���?>�����§ $�wVS����/o�`�rI���z���;��/Wp��d�#k�8?��������%����36c~�Q��Ԭf'�n|kE�br�tA`����8���4���рV�l�_���8��0>f@4��RJJuAw�,a������L#��}���� �h�X�% �S�[N�t�,y���3��N�a�b���'�z�� �tQ���u=~��f/��'�&xNwfcq�n3M�<��d~SU䡌X���W���F!ݤ� 2���oVx�Ex@a��A�V, ���5��#rc?�CT$����ެd} ׅ�05��z���*�S��Xw�����.��dA�S��b��W����Ϊ^t��gH�ܙmM��Ȗ��e��>�����_ֵ���Z�N��K .��BZ ��|�ظϜ���{_nY�6�6�j�z�L��`���Q�.Yɵ5�f��!b%6*�ȴ�8&��K�*���P�ѐÄN�«s+D��ό#��h���Jͣ0Z���le�BըKFY�����R{�x��'�F3� ����y���'պ��P+�a崙~�Ձ\�7ɽ���E�ki �@s�d���'��2�WZs� �5��D[^f"�|3݊z2k �r�yW�wo����<�6rPW�dE�?C�9���\@��&�wv�F�w��%���%��O��\o�����Ěe�/�o�v��߅�w��Y�rB�� z1.��;옌���̭H�_kB#���a��ɨ�C���J=�e����� �c��V�$QF{s%����b��8$lQ6!��R� �X\|���g���4Q?�5��n*�{oVi#���y��X���F����m�Ψ3xFV�C�Ln���'��_�>5z�z�.�)������^Ĺ�u��_�U�� [a�YdT�QL����%�D��F)ڶ�q�K˻����af��� �3b��1�Qݸv���O�u��5��?�r-W:�e�b�@rw����\���q��X���u��K-�Ԍ�|2<�\�j�m^d����vƛ{��HYޏ}Xt����C��p�Q���۹�J��-�x,��:���8���� �msp81L�6Z�}8����'�jU(`j�b)��t�lI<�b�&j~����i��*N V���%�]�C��{X���-uB�(�@5@����r�����vPScO�۹M����^�;܁�)�1Hq��<�͊�{�C?�w�E�t���ff:�g�ػqK�,���ȴ���ϐ A��D�,�ל_ڡ�v��[�P��å����]���f"�t&�bՔG;Ե]j�F�Uq�ˏ��t�d �K�/���_,����;j��.�W��^�a^�)wG��L��|���w�Ԥ>���O-mx;[��p1��_r�_�ڡ�_zO0����"�����+ ���W,�nc�(��H������h����:�h��!7���خ��f7����"X���bɎť}6��ߟvJ��I��}�Qvّ��F *E1����jamVP�%r~*��j\�9��`&��OR�ws(�X�0TI��C���Օ^li���5O��S�YĎ7��b�Ȁ�l��b���I��}���G�A�������~��C��yn��D2�'�� �;u�)&�v�pM܋$�%Ea��� 0R��}Ψ���-���~?��M~k��3'�i����8��BQ+�W1�=�F&�:��vԱ�p����}bIGB8եU�@뱁�e�� -Z��a=pޣ����w����ާ�[0+�Ig��mWI�\�߳e:z�/����I��8�J?�ʭ��p���s8|X,U�NEkK����=t� �@A���Ϳ��k�d)����MC�>��]Z"o��8�-�x4c�3�h`��������0��+� l�?�'z˄{ʀ�Se �r��즸�`�L*/���,+)���vi5R�՟�2�O��6�����ű�U�M�Hx���Bk��R��yN�Č@~LZ&iy�X��ym�S���[�Yt�>nF 'qTƂ!��7L�kŰ���뫼�V�ˀ��!�*�J�w(�e(�e���u^Z�,�D����
Static task
static1
Behavioral task
behavioral1
Sample
c66f57d55635b13576e576b2c0224a1e2264882be0c25244bfa1a0f65cc460f6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c66f57d55635b13576e576b2c0224a1e2264882be0c25244bfa1a0f65cc460f6.exe
Resource
win10v2004-20230915-en
General
-
Target
c66f57d55635b13576e576b2c0224a1e2264882be0c25244bfa1a0f65cc460f6
-
Size
6.3MB
-
MD5
129b3c638f7b89430dd2a38ebf893605
-
SHA1
6322450b02e1a24a36d100e52a2829081c0da98a
-
SHA256
c66f57d55635b13576e576b2c0224a1e2264882be0c25244bfa1a0f65cc460f6
-
SHA512
9d72cff5ae2fe389eb713ebfa3dbe9d3c890717ecdc7b1014d1fb99a82a9c5c543ad851bd20586d663897831a7cc2f1fe8b635a7228caa11f115932ea71a49b2
-
SSDEEP
196608:P9WMA1+zvru/JE+WdMcGDp9eFRI4YIKhQBvTcg:1WMSyvr0WdMcweDsvorcg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c66f57d55635b13576e576b2c0224a1e2264882be0c25244bfa1a0f65cc460f6
Files
-
c66f57d55635b13576e576b2c0224a1e2264882be0c25244bfa1a0f65cc460f6.exe windows:5 windows x86
43560492ef70f4fccc75f180688bd2b0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantInit
advapi32
RegSetValueExA
user32
UnhookWindowsHookEx
kernel32
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateCompatibleBitmap
version
GetFileVersionInfoSizeA
mpr
WNetGetConnectionA
ole32
OleUninitialize
comctl32
ImageList_SetImageCount
urlmon
URLDownloadToFileA
shell32
SHGetDesktopFolder
comdlg32
GetOpenFileNameA
wsock32
closesocket
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 49KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 508B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ