�۽`�[��`��F�dHR�D�湻W�-e��G�����}jƳ?~$����VZ?!��@��Ʒ)��Gl�t �k���{�����+չ��4$P2�'�������d����<���ld�;�a�Hz���۳N�=����t!�����k��6#�]͒�0�xp�S�,ܸ6���Y(��k��"m��$�R�,1-5T �m��#uA���ӎ4P�i�*���s߹���Lpm�����nA3���Q�n]k�gBQ�yZ~}��hQ�%w���ܸ�O�x�ℑN��R�%��VVfJ�4�-R��`�h����@|�N���b� �kM��1���9�0*[��Go���Z��W�w����.�Z}���K�����l=O D��*�7�c ���v�1<'^��q�Fv*�������Ɠ�%2I�p�����o{� l;�e=���dHeK7�ɳ+��-�^����*�^[��#D���vd3_����n�?^�@�� �����������۾e(��ط��H�5�*{�p��/!S%�JZ� t�ٶHNR"S�D'����H���������'�0�:�|�>���1X�?��ݏ0�X0���k�W���-b3@� ᤹�t���>C.<�a�"���F�E�,G�7����A_��s���!���:��J���۴cʩ.V�$\@��?g�( !��e���o� �F��͓�I�$ ,��X�����k�n+_�L��f�ҴbDڹ0��9������^��vH=�����T4;���e�����ZQ|(��\b�nQvչШ�k·���͙[�� z�eA :�Q��0����at�����(o,T&v�wͶK�7X5���R�,]H���T������q�-�qP���sV�@�8=����H�!���m�Q����g=���Z��t��k.أ~��a�������j�o (|�'Ȳw��x��;���VH��,b�#J�J�����&K����7L�� ^bjj|DZ��4�/��l�v� �u*��b�KS# ��=�@���KP�����x �[���nr��Od��W�+�p|����dD��Y��S���g�����]C���gG���N��k�u$7sÐs"�F��˫f������9t ���>��5MA���bi���+�b;T_8\����K��(?{��9��l#A�a����X>�p�a���ge�ϠR-I�=Ԭq�����@T��p �-vǖ�����������]���*�c �؆�� �£^��]Rn:;�yL�ݒo�A�;<b�H�;g���G�W8����������OIs�� �I4\�\�UX��[ �������9���X�rޗ x�5m;�fW�<�O���i���{�?Nz���p"�d0 �}�Q/������@4���;/e�=%M��_�[�I-At���=����#l���Rm�D�;џ�� 7{J)���\fPd`��Z�����v������}�������h��7������}w6��VZ�r=���D?m)d����Ԟ��H8%���s}�� �ýJl�xp���&`̮�䦶Q��}��TQ��B��*]����t�@�s���#���\`0�����'�X5�{��7�2q=�`gIQ1��w9��C��:g������+S�W���.?�k��8q�ߚr1�Z�<v$?R�Bwu&-�Xi4���"�-ua�����!l�{}X�7�ÓHx%��rU]K0|�[F��v֑]���%c�\c��d$��ޟr)������a��g��"��4�K ���3A�|��� ����G���Dv;�����e�t9��4��]/�R]g���S�A��H�'r'��N��Q�쨀ґn�s*5 �џ��Qe���R�ȃ�ߴ��?�D�O�1�J����8���T���Ѽ���"�ǡ�mV���$�B�L}�xr2�����՜x8o��q��z6X� {ywy��˂��'Ԥ�N�J\x���9Q2��M������J�cH��=� ��VM��RH ��uiTԯ�I�&^�ɮ;B�����Ø;P�"�|��T����Kel �gl��21;��;��l5~bj�� �MZ�gd��m��X�CO�N��������5�(���}M��0J�(}zC괹 �B����Qs��^<Ӏ�ϝ'V�|@k�����~��� ���n=c(QJXˋ��m!�àZ����нm|�Lf���)?�5ʣ�L`*O�X�ԨRZ`�T��l(�Eiwܘ�ѶYx��#�_FfB�Ip��S�B��'���$� 5�V[5��?0U�Πm�Ucg�˨h�ߤU_+��T ��HP��l5�s�kvG@�L��+���� ��u��1����k�r�J|@7 ۫(�W>ڲ����m�b����B ��5��%Ѧ�0����x���`P?�6>"���9[������s�u���Dh�m����_,�6�U���>1�V����(�N!GƄ����E�y��,'���>O��8���qYJ큭�EX�UJ���0e��N��Q���^�iP�3^eJ�S ��m|˰,�c&w�#��y2>�B���l����CM���� �xƨk^��3j̔yxH�'�?�F�� ��!�ˬ�Ԫ��p@F���5�d$x��R��|�5�k.r��;��=�D��00Ǹ���}=��!�˧�h����L�����݁�� z����.�k�Jpq�'���~䱛��#���'��#�[��7�%��ǝd�]���Ub�r���Ӷ��q{YR �!�H�.38�H��аsOiH��MoŦ�k)=wE��7a�?�Xy'�m;����Y��*6ҲW��iG.�<gb�0�E�2T\�X��db�� ���F�{R�]���l��2kd�x�]k�4aT{C�7�!5a���2�B[��C��[�Qz�ӬMkk�R!P�yZ7���<0*�P�k���?"Nd���E���!�@��@˾�ݯ�����a��w!J. 潎i:n�3t>ɾ�ec>q�P,;A3q�V��'J�F0t� �.�[|3mQ��O���A���^�;_�,&Ϡ
Static task
static1
Behavioral task
behavioral1
Sample
505410b2ae1e438736792a251e5160a2d195924a075ae92b532a15f40bd81a7b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
505410b2ae1e438736792a251e5160a2d195924a075ae92b532a15f40bd81a7b.exe
Resource
win10v2004-20230915-en
General
-
Target
505410b2ae1e438736792a251e5160a2d195924a075ae92b532a15f40bd81a7b
-
Size
3.7MB
-
MD5
fe12900eab689ac3ca6bab1e9df35d3d
-
SHA1
1b40b9ee1236ebee67d1cf60943ccfc7d0462632
-
SHA256
505410b2ae1e438736792a251e5160a2d195924a075ae92b532a15f40bd81a7b
-
SHA512
3e3af996423d68ca8dba043555d93b72210546d3690400c3db7ca0601423ab041b7b8e76e90661cd3df7deae6d6824784f3f1cc56b5578149037279a99191c4b
-
SSDEEP
98304:5sTpO8JhOuaercbkh2JWZ2EVkEhC62acyI1uhD8WGZNwj:5s93J2Awkwwzkx63cyIQB8rD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 505410b2ae1e438736792a251e5160a2d195924a075ae92b532a15f40bd81a7b
Files
-
505410b2ae1e438736792a251e5160a2d195924a075ae92b532a15f40bd81a7b.exe windows:4 windows x86
4a965b9c35fac4464f692f96f399937e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord5163
msvcrt
fopen
kernel32
Process32First
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
gdi32
GetPixel
ole32
CoCreateInstance
msvcp60
??1_Winit@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE