q��m�<3-�*,�����X�jI��o�Q� t�;v����Y��_)��iNW~ߐ��fv�}�$�i���n�!]��>��c�i�����OCxy=���(ū�l�#]����UI��37,nC�p\�n D/h]�}�]��pě���\��(����U��\w3�&�h$3D'����6������ b��P�r�*�G�ʛ8>�;@�����5*^M$R����T������c�"W���c�A��Tp�pU�'��;ӧ��u^p=�e0O;%���J�(R��Í`���0�qZێ���"�"�}��l���Z�䬙�<>i����ᴬ��)�P�D�kË� �&��rO��]��� VOσ�?�b�Rr5��}3DiTɴ&��fG*�FC &J�{�~�]�����X/#3QXB�o>��_<0)a�r�7ÇKA��k��}L������7�xi�~��Ѱ-�N��ͦQ ��^�}"ŭ̾~gKU�?���n��o�����y3�/#b1�r*!DB`G������ f��=ҿ ����i�[G��s�C��E?,<`A�Ҳ���Qyd��,�����8�TN��+��.��2qU��ً����VҦ8~� A45~� Ϳ�-Ƨ�@b�g����'�h�F;2�Ϡ�w(n'�s�ˤ����?i����{�"���+�902���U�d|8_�!���8K��<8 ��9���s���baRS�N� �J�ޣ(&_a��<!�N�#��a�����§i�#�0F�S{���[`���j�5�Ϋm��V���j��=�+4��W��؞���i��Bɮ������Io�7+�DYt����i���vo�5������T�Ȉڥ�=�r��&�g���[�s��X�1�{m��D�,�fx�X���Gʷ���J]������J�����9O-����*�N�C��)���.��\�e����,����r�?��;Wv��ߋ���?!@=k������j�>E�PM �u���6�q��M&M�ʃ���_�(|�xQ���y69r%�_����ƛ���&����q��D2����t���bS*�����-n[�W��N ��j�f��3�\;*��;,H�r���f���-jn����Z�р�}t0��#�#U+; RN$&�����$�)$�ZY�E*^�����r�fcx��E,�s�8�+����x�r��O2�vSϲ�KMQ�����A�������O�q�L��q���9^��%`��3ed���"Q�l�l(R�:Q� �5�I��DB�Y�#>�lԣR*� ��' ��r�0��Ģ��4@v�ӓK{�l3Y��!�9?p:�,d��t��U��s�; S���������6e-ՙ)!mz`��[��|e{v~3i�,�3�6�+�z��Y��|wM�>[\['�D�H�Y���L�f�-B��`�-Fvlo\s��0ɶ��q���`e�r_�Iړ�8� 6`��G]�/V�|6���\�f��}.4a�m�\{n?)9�h����l�&~O'���O��Ɉ'�Ya$0ɔ�]R�I�z`�a�q/��#�q X'AM�7���t�I��k:�&����)7�Y"0O�*�N�.{��ƀ�3���EIw/�����1���c�5�A�۸�^�1�T���'��q��iۺ!Á%^����R��� �͂�͇w�T�T`"\�ٖ)�4@D���TTyS��K@���hl���HZ��S� �bp���C@��)3E��D�ᆌ�Q�Y_ۃ�i*t��B97~�Z5Hw��b��[�O��Ŗe�Y/�k���o��p�\'@�9џl��&�V��=��X��4ճ����䅂��T{5cGEJ�ԽN� ��z>��t��4�O�a�i�����������R�����:f�m����;��1�g��[V�7�����z��S�纊�]�'I,:�������%�FK�[��( ��vW`��,�f}|��b��41^I[�N��VI���u��/L��������w��m��}����!)����)����Q��9�h�A��Z"Ȏ�A���y�=��V��ȼR��\�bg� p�B�B��X�XhJ<fe�!��{u�2���iX�|��5�OI@�o����:����NL�>�@ 6����! ���J�u5K��Ơ�r��Ô�ٛ�YYTj&'ņb"L�ͣ�nX��j;3�ա-�%��V|��HP-��5� �7F�?�o��Ah�H��b�?��%22�x�Ʀ_�����n:V(C��\�j:�_O\�e���7�+/�Y�W���Yp��"���q�4�D}�rx��IDƫX���xnG�h�w ժ��N���(��6��=^����U&K���*��;Z���]�`�-) ����ݤ���S$ڮ�R��t���JŜ�<���d�ӗ=r�HR������Ae��n|�Hn��>e�;�r��H���̀Jd��a�6GA��M�5���(�7�@�� Ӄ^OC�?Dp��C�)X vY^w��� ��}�QԸ��_D�B�H���{���V.F��E�����#�/f������)܆/�w�č���^A6���W�I`������MSf��b���i���*.���)���㴗��.��1`�J%�KٌA�ߋj��L�E��Hm��������J[eʃH�?��'D,�i�5�Z�c��ZZE�@G��+F�]��G��i�l�(@����M�7����w�Ons�F��-��H�d��[�'��F�D);[�3��m�}�F� ��G *�t쀝=8p�]5Zo=k&a��#���le�P!{�op����ݾu`ϒ�)��Y�ڐ�g"��-�3f+��ĺWi�N����5)w͕A���Vc��#=1�{��jd*� �nb�^i�٘d"�=Jy����`�5.��f�?g�D��.��a*�`T���zO�q�U��R�4\�v]lN�?"��-ᗮ.�J�Jͬ�쟓�g��%k��( � (���S����(��m`��b���.���pS% ���R�pk���L���S� ����;�7�X)���F���z�&�n������c9��b��cM�:q ��4
Static task
static1
Behavioral task
behavioral1
Sample
f41b00cac450c2f1466a02ed85746127a3b6480f3ce6caccf5637e9f09b6e4fc.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f41b00cac450c2f1466a02ed85746127a3b6480f3ce6caccf5637e9f09b6e4fc.exe
Resource
win10v2004-20230915-en
General
-
Target
f41b00cac450c2f1466a02ed85746127a3b6480f3ce6caccf5637e9f09b6e4fc
-
Size
10.0MB
-
MD5
cea6ebc746f75f0735337f4cb66d77f2
-
SHA1
b6f3e4f73e3651c640d3114940c4457af39b6b08
-
SHA256
f41b00cac450c2f1466a02ed85746127a3b6480f3ce6caccf5637e9f09b6e4fc
-
SHA512
6806363605dd0432bd06bd8df8347fff34caf3e22afa8f732e6ac2e37e3598f362a7a701e147f83262b0e8942c1d5d7efee1a38a874631a67702ead22fef3654
-
SSDEEP
196608:+j4fiv7EVK4UYeyCQbd7gXwGrB4N56ZU74cXh+bAxqEnFXXgBBoJieok0e/mXcRw:+QwRYcMd7kwGt4SZ6s4qyFHKBeiHk1mx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f41b00cac450c2f1466a02ed85746127a3b6480f3ce6caccf5637e9f09b6e4fc
Files
-
f41b00cac450c2f1466a02ed85746127a3b6480f3ce6caccf5637e9f09b6e4fc.exe windows:5 windows x86
9fe68bb76a6c323b6234a4eed695272e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysReAllocStringLen
advapi32
RegOpenKeyExA
user32
DefFrameProcA
kernel32
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateHalftonePalette
version
VerQueryValueA
ole32
IsAccelerator
imagehlp
CheckSumMappedFile
comctl32
ImageList_Replace
shell32
SHGetMalloc
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1006KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 10.0MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ