���� ɬu�J@�����4w|L��#W��w\�˱h!,��Q �h��m�5��o�e���[�Jқ��_]��M+�Fv��}�?���j�C�d�� �#���z���"=a��N��X��A�̷h�h�v�-�Ѵ�Zll� ��?Ig5B��ѕw'C�LbO��f�l�oO��a}�[����p�KXg�Lɵ��/+�R�_�]\�ۮ�b].͛�ѹ�|A�� !S�ٯ՜a�L�.� �D v��X#lp;u Kr:w(�l�I+���R�W�C>X=���2��Y��m�kX��^r͕ ��#$.��N��S=zF�a����2kaq}��^�CS�r�)(ԟ#%�ck ������e��k�,c�G�2߲ht���H����� h�{P2������Ix��X�n,j�B1��\��4 ��%��C�K>�/= �)�aZ'-�����0��<��|g?�Z����!z�MTdH�[��L'��[:��ج�PezmP�Pȧ:�ܣ}D'���Ϲ��u0�_������#MK�ρ��.{ٗ��`�V����{�|�{ �*��v*b�h=C��wPc��A�0�?�Vn��kb���6��F&�Oٴ�u~0S��W��ZQ���b���?�Ɓl�!�e���&�b��Oa�GL�<@�/d�pgd��S2��Y�-��g �-�B�W�S��=�mt܄e�<��J��vJ�cƍ���HjV��g��w��RxFQ�JCAg������Q� �v���CF�E^b�������xY-�����f�!�2"B�.�LeO���K�-4�'r�f�k3����;�܃O鞰��6Q_7r�1<g؈��ܶ�.s�����!�K� A� ��j��߳c=V��xHY8)a[���f�l+�L0�}�4�!(�S�fEQ7`�!�MU�+�4�����'�$f���Y;�Q�G�>�����A�V֦+q��-�h��O�~��%��C��\��[{�f����Y�`O;�����7�6H��s��8[�{D����z������ԣ#xC��/ U9�n��cp2���}�0Eyv�xg y`,���O3�@�P��~����sut(�v��[ݦEu]Pc��3QK����6�R�[s� ��s늳}�� ��eD�o���ڗ�4 �':� �=���5;�$4����3?Xp���w�����ʂ�_>[*{R��[��٠j���_���=َtD��)G�Io��� k+�����P����o3 b��� �\q�~Ft�y���\&`���1b�V����)6�"��� FgL�7�BD��P�-Y� �|�ꝃ��&�N�����GW2yܞu�5�fFEs�s��D��������6V10��! ����ċ����?�Jwc8H#�k�����U�k���H]S�(GY��:v���ϱ ��jƾF"�B��r碘ޗcB���p�*��g%Z�`�����_ 4IȢ���O2 ˗����EK,aM�e������tvX*��s�$�I,B�P�݉�MAe��4:ά��6��L��D��ߘ5��A���A��𰁂b���)�آ͚�R��NM���_��.pLs?Q��5l�9��&�aZ�T���t�s� �gg٠2hKD�a��h�|�|�`��p�y���������+͊�/�J�Ae��J4�ȏY^����͏NJi;��c8ç�m\��.l�^Bf��a��?� �{q����ѓ"�4q���q���W�2��I ��\��K�a�@�����Z�o0�{�ҌFf����f�U��_�"�%�[��s�3l�s��~�="�q6�A������a�8�4�)Tf���f4]��/+o�A���xp�3��[��#K�y�A����[۰(����Y��L��|�q����d�p������ ��k���],~Y��>��>�K���,M%�k�@a�������m+ �Qiv'���_�to��ٽ��z�y_��Z�uI��{��X��tN�8T<���@B1a� ���nפ%���q��9=3��TI����Ɗ��xA�8����`T��F͗�J�~������mm}xߑ�rR�d/��w���PM���(W�{'i�ku�T�w�Va�c���K�t�}/6�T����X����+�<nS���?%�qXn��+��W�a\y���B�zX�<(�u��}�*�˱@����=��+�>�ϰ>JiyO��ў�{5�=�C@�[0����;V~֦*����]r���gz���d���_Iƌ�B#Y��ŀ�4��❶��2 XZ����$�"�_��M��X��ECo`�5�@�Ӫ<,�@��U�*�A����5/,�¼�M�Ă�G�L�"���(��!8sƀn�����B��TÆvDaO��GF/��^�+���������_�0{�i}���aLUH�4̕���o�~����kp�֩��b��4'5����</�o�mb(`߅�[��@ϡ�+鎽������ƿ�&��M���;�(��H9l������]CWN@ t_�:[��`�������X *t�3Y��̅h���hvX�~�:%���x��D�h��T��|z*v�E�� �e����&J���8;+z���������r0�sj������ a'�����j�����e�O2�rS�D#̔\��ޢ��o�z��!����h��{�z -������<��t��͵s� j���*i㤤���H������S=�-{O��_�@�ur{���=�u�3 � 2�T_d��%��x��p�^��'qq��r-XH�������&�u�Txinr�܇��sEm���TuR�8ۏD��u|S��Q�F0!{�m=�q�Н����/~��Eo �'�[[E�ӊ���썔���(��=X�R�zR� ԙ�+�����H�kJ���G]O���[B��9v)�fIz���k����o�*v���>����:<���5���ǩrش���I�`B�:2�8�?"��:���+t\�BD�j�ا���K�(�y� �y���F�����?9��7�� �����1 �"-�`4З*y!���F +O�����+r��|k�ܦ�^�R�),�V
Static task
static1
Behavioral task
behavioral1
Sample
dada3f93735ef2e0b2722e5177b7589fd9b843de9ec47bd5abdec19cd436fa0e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dada3f93735ef2e0b2722e5177b7589fd9b843de9ec47bd5abdec19cd436fa0e.exe
Resource
win10v2004-20230915-en
General
-
Target
dada3f93735ef2e0b2722e5177b7589fd9b843de9ec47bd5abdec19cd436fa0e
-
Size
812KB
-
MD5
7c9e776be78b9d6b40595a3be58862a0
-
SHA1
5203fa99902f91f319d4ccdd5118377e6c214f75
-
SHA256
dada3f93735ef2e0b2722e5177b7589fd9b843de9ec47bd5abdec19cd436fa0e
-
SHA512
a4a55d852383119754303e94cd42e6facde2a5541663ba50f82d36ef11026c87542c897bef1d3031b55fa7c0707b0e5ce22d6694bdc5ccebc84ee62ece5a3f68
-
SSDEEP
12288:IqmytVdB0rPEDb3kCoI641jxy7GHEX2rnAv8MktrOKxp22CMOZ/1Sq:IqxtVfNDb31oT41+aneOrO4p2zMOZ/V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dada3f93735ef2e0b2722e5177b7589fd9b843de9ec47bd5abdec19cd436fa0e
Files
-
dada3f93735ef2e0b2722e5177b7589fd9b843de9ec47bd5abdec19cd436fa0e.exe windows:5 windows x86
b64cb8f2a09d465fee22eda05e27148d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
FindFirstFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
TranslateMessage
advapi32
CryptGetHashParam
shlwapi
PathFindFileNameA
Exports
Exports
Sections
TsNhQ Size: - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
TsNhQW Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TsNhQ Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TsNhQ Size: - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TsNh Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TsNhQ Size: 800KB - Virtual size: 797KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TsNhQ Size: 4KB - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ