5w�Y�m��������]?#�<c�&�a:�P{U��#��s ������'��������MJ��G�=�nT]�u��)�p��0��;1W���� O��L��9t`.�"�-.�y;�i՟^��6m�T́ aQjP(�{��s���&�R�jz��m����- ����ׇ-�"����;*��� �}t��Rdd{(�j��n���f(�����9�H���W�)��vN1b@7j�Qdh��*7����߉���xY��'��ۼnN� �p��(��'_E� 'f�(�Q�X�ޅ����FXy���,M� ��ٹ������i��ψ9d #X��������K�SI�yl�T�`n����i�w[rP:FƀU���� ['�#�e��<�Բ����:?������ő�~l^2�qY`|��pb����Ӧ&x2<+������ q��x��Q]����-}��\���Q��}]zv�d�{���ߖ� ���\��� T�M�@y���5ըz�_'o����� J��I��9���9�Q�[sª�J+�k�'kV�4��O�K��� 7�i�Vkr&f~��M�W8���9µ�����Ng�����"����G����H�c̹�j\Mr�.��mLY�I�?O3�j-���� ��@�B�4��΅J���l�Mn���0*�'6� �E���a�&�T?���P��K��<��]r8Qu�i��X?��&�n\�CFM� ~1{3����&4F�����0 '�j�`���v�7O�a#7��Q��o��lZ�`�NwG���_�o�,�7�`M0a"3!C��$��f���l���+�?��:�y�}�ԩ|��9bZ�l�%��4���t�/C*��]h��e᳄>k��|~�#`�%�^�H��J1�vëY�Q�M��Ű9��d���C�ɵ����n�س�� ��Y� �8cdэ�h���Q j�q�gJ��g��C���O�6"�+����V��U��r7��dߖƙ_#�6N�ͮ�U=��p�� ��B��I�3�%"�oC��@��/��.�������R�t����A����5�7bv��fc�w+��������n� N�(>i���~e���!�q˜�A���+5H�c?�ؼ��{�D��Xzô�cEj��Ve�����eژ��d�{�Y^�e��TQy:�wZǶ��x�<7�*_��Bq ��,d�Eo>T ƙF]�+��W����+�bYK����������.VTpk;�b��>�x��2�Rj�mG���PdQ�&d������y��<��ta�����4��Ke�\Vދ^G�x��Q!Ҿ:�q�!G�o黶���3\�:�-x�Җ> ���#?j�9�r����>�˂�s� �\��I���fU Q��lP��Ԓ=h�P�$abw[��zn�-�A,;����0�E |�52\�Zp��`�P��-4+�B�:��g0�E��X��i�X(�Z���Is�zv>�Oej"P��dp�uH��*(�m�����<5��8� ��ֱ`���v��q1i� ��b�#����������_����՛MeQ?y�h� �\�;�r"�$��Ŵ i�#5p�x�O<�Ź�Z;�!��q�ϰ��{�{��I�E �����b<�P����u���`��h��hU�hȈ�C�W!���93�D~�= �oNvH������~5���\{J��.�(x����X�A�D9�@9�_.���������[�����:?���Q�9+��A���̟5m��|�� )�g��Ii6V~�ȩ��p����(��m� �����y���H�7r�)�) �.������T��FL6�V���pY�so�`p�k�O�QW�5�m�ČD�dm��AԾ��=ܛ\��Q�,��5��@���Z���[5Zm�觕"K�;I�l��JPCO�Ǖ��!@���!X�k�u�-��η���X�S��.4+�j�;�l�4��ܕ�u��)�T���Uߝ�Ĉ�]NCq��+nvA�\�^�� �}������jj/��n��u{�������B��4�����C�QW�m��%�l��js%��7�L��e��K��Pv�^]�U��E1�������h�����d{�+F�`���u�'��D��i��Gv��Ċ�I���� '� ���[o�^!zf�L�@��eA� ȼz����I��ⅴbG[���z�[^xF$�9��_���m-���P�4��^�m�q�GJ�}������.R3��G�(�/m���z8���FA~F���*1Xke�HUV���<��������jʒ���#�]�'��f��ߥ�3I�z�tb�3飜I4=�}]&���{`@�&�Ix�Ƒy��%��i�f��j�/�a��JѤ���E=��1�(�UIt�,H 3��F��5�ZgǸ��}S-�k��=܆ r�)�J)Ӓ���n0�� L҂O �CtD��b�X�v+���C=�>/�/f�Â}�N�䊈����*��+pGsJ!�����g~G��;��v�e.�DZI�:���⊎�!�B���5�k����՜/� ���1�&ZO�3ޒe�*ѳPWG�{ }�ⶒX�>�x����R�m��Y��E�ㅥ����d{��� q���DP�`��Q�����̺�:�m�n�/��W�ט��c�Eܒ�k@�}l`119�v2gh��ٻn�ӭ��s�R�x!�C&;�����KF�;Z��Ҋ�r�$<�E��GѱhjIow{~Eſ6ĎKT2��~�&�VgF����0�\m�OǺ[z���AL�O轙m���f�m���ܭ�h�,���(�5�M��{K�A=��%�dI�Y���g,��V,������4�/7�_����Z���}x-�C�x��ez F���4�%�Yf���k��I[�BLjYg���K�[^L�����wx�3���Y�V�.�P�'}[��#����������v���Sa�8�K���m���������&�7R�z�=��jS�翯��*κ��/(A�����6�.u��� ܁��y/3l�V���Z| ��]�ݑ
Static task
static1
Behavioral task
behavioral1
Sample
a5b759f6bd8d912653bdbab336ce546fb81494c704a06ce83c05ca327d26c533.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a5b759f6bd8d912653bdbab336ce546fb81494c704a06ce83c05ca327d26c533.exe
Resource
win10v2004-20230915-en
General
-
Target
a5b759f6bd8d912653bdbab336ce546fb81494c704a06ce83c05ca327d26c533
-
Size
7.5MB
-
MD5
c3d6a9f5eb51ef8ccb554c67e54ccedb
-
SHA1
81417f1e42f2ce56543f25b84e1ebc33035d8458
-
SHA256
a5b759f6bd8d912653bdbab336ce546fb81494c704a06ce83c05ca327d26c533
-
SHA512
477a7c7b0193f207417b35bedbb4202058b67ba0bc428768a9bf758450bbbe7a905b42f8b0f3b8f769fc43bb7367da17189084576c2ae20695ad6c35250d9a29
-
SSDEEP
196608:a5Rw6a3vDiaRjZBXgw3REqjYGl9Y8uqFARkcEl6VVj0FCwzn5/BpH2CNNDAkymGw:2+3tRddgj49enkb6XjQCon5/B7NNDAGJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5b759f6bd8d912653bdbab336ce546fb81494c704a06ce83c05ca327d26c533
Files
-
a5b759f6bd8d912653bdbab336ce546fb81494c704a06ce83c05ca327d26c533.exe windows:5 windows x86
2970b24f2e2331a0e98ac8dd65cae9b0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetErrorInfo
advapi32
DeleteService
user32
GetMessagePos
kernel32
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateFontIndirectA
version
GetFileVersionInfoSizeA
mpr
WNetGetConnectionA
ole32
IsAccelerator
comctl32
_TrackMouseEvent
urlmon
URLDownloadToFileA
shell32
SHGetDesktopFolder
comdlg32
GetOpenFileNameA
wsock32
getservbyname
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 49KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ