s�dώ��d�D�"�VYB�O����GJ�v�s!dz�`7���wD����- ����/��j�nu��I�%Uf�x]s� �h��Hw��=��KU%]%��}��Ũ�-u&��9��f�m���h����|� ��mw]�,�1��W��zLx x@^?�0��8��yG��~7���� ~Ɯ8�h�fSX��@��R=m�ꉒƨT�^Fn�}AW9������J�%O7.��/�~[��gm3�P�?��c)J'~��+QgnQ�`�a_�t��V�������Q�%p�|��요t}��T�2Z�n,�������%��㨦eM����0� ��*�W2=g�e��R���o�j��4��`�yo�+w�� m�0Q}侌1��#��.�;S�����)�i�������Ca��͔��֗��2+���^���e���d�N��;�4��B�L� �9����ڑ�;|��&��?l"��TnG�O�q����Aˈ"�m���5���EQ+�+Z��n������RV'7��ˁ��STt1���!)WS��\�o��[����_�; �[�HQ��}�l�o7�S@C�����U� ����}R|��������or�/�4MVVT�RLb���C�My�) ����:��Sg�0�nAٯ�'�}8 �mԛ&����m���T��J\Ԓ��+�T�5_qyoD�H/k:qu/��~�<�q�R����|Bh�O���(2=��Tӥ`T�|� mj��é���mi;�)�:)Fɬq���J�L<������V ����1&,Z�0�8�u�>�G[\(y��+��]��?�]�`j>�C�w)O��IS(�<�����8EG/v>Ud6��rRϓm���Wyxl$V���������� �z��E����+s%F�n� J���>&�2��|\�O����u:�9W�F��;�}��ο������r�\�:���ZWd*���I�k_�e_���em�\�/����'wI� d���@M�t�a�j�M�D���R�|�P�����h�Sڃ -���(�4�b�p�\�*̐��}Gߨ/@��qC��Xp��L��T.TƏ��C=Kv��o�H���1�q�6D���PLX9�J�B��8�g���]3c����HZuW�a�J΅�s ��f'�F��S1�E���ZA�%m%0���m�;ES뜖����Kۅ�)�c�o�y��ݐ��V����٨<�H,�)U3!�J*�i���.���+��q����Ο��D�Cc�Χ�`9x�|�t�����T �=��� �J�NHjw���:�˻g!J��>��C�$� �6K��pF9�F��#� ���k-�uU��E��E���=lN��3$'��`��<���%��8Ð��_�JM �kؒIQg�w*�Ơ���s�$i��e8�|ײyI \9����'�-��O;��t������2C���L����ݮ �->wv )���t���q����JK%F*FM��>ß����M��L�6t�&�6z&a�����y��Y������t��zEN�����'[!��4�Y�����K�E��a��,(����2m�jxҲ�P��m�^�fBm�?Б;J������&����r�I�m�(ֳKH�I@-Q��UK!�yhGU�E3��V�����RR��#���4���fD�����6��w�>Ǵs�tQ&R��"��}(>���G���4˞�B#�e�P����t�Pix� �U$0DB_�1_�:lZQ�"M%ˑ���7f�����Q+&�b����us���p�����L����CN��i��jJ��_�yI��j�۟6N�/���Vc������پ͇}��ĹI���:\��^�r~���X�����-)2��o,UW�9�*��/�j<n��`6�����t�����э��{B,$�@�)]��Qk���֏VczR���EC��)�w&�;di�;�"�v� 5�ͯq�wI�����)�#,G�A����A3!��Qqk �Z������Vݏ������RB�6�*��z�j�0u�-����z��q #����+�2���)[��/sh���4�aL��z Zo M�l�"�m�Ş3�*�Aw��Bd!C�Y�v���C��p��C됁@M�,��_�����=�#d:X�^�L�I}�,� $ϔ���7��+�IՔj��GMzT�M�˪��|n��N=���*�8|�� �I��vcN��rV��u����{У"��,O\���� ɦ^ �x�KD�,ݪ�EQ�[@��`wRr�(Nۧ�%�/b�����"ƋX��T=��~�n��v��y8���w�@6'u�<�a�����H���:c3U�W��)���[q����F�����LB�Q�q'wN�V,7�_�7E8�x'z�nO[ԭ@`�tDn�l*��(�lz�������% ��,�kBܽ9)�����di>u���g5l��"�8���@������xY������e(��!a9Z����C�&|�P���ՊcA�7����ԟ�`�l#g�{���=1A*x ;M���O�D�E�}Khvno����Xu���`�b�ݹbMk�����E��*׃'^ԟ��L%ze%O���4�v�s��b}]8o���QV�����C=r�@,�*���^5Ǿ�\������z��Vo����a�T��(��u�_D˒��l2}�U�������o��dÓvN)���/2[y� ߺTO���5T[ى�9�H�dzC����S�[V��Lci7=x��{ M<�d�4��U�lN̻�?�С���֑���`�|8_�b��}D��lFX)���[���j����,~r>;ޮAd��x�>$�n����ZIx���L*��G6��~D*@X�Q�6t��0��>N����!Gm}��R���6�Lʞj���T��,��|ۍ3�@j�p��Wh'����1���-gH}|��w��e�x���ɏ�IJ1s�QR(yx����Oxa�����<0�̸�'����j��q!��[�F��s�*�2qyYAwXP\IRq|���ѵcD�?)�9$�N��������u@ ��N��Iq����Ԥ&mH��^F�?���D��<�,�~d
Static task
static1
Behavioral task
behavioral1
Sample
73b5e0d1c76dfc5903cfc232b17b8520_exe32.exe
Resource
win7-20230831-en
General
-
Target
73b5e0d1c76dfc5903cfc232b17b8520_exe32.exe
-
Size
1.2MB
-
MD5
73b5e0d1c76dfc5903cfc232b17b8520
-
SHA1
50992f597933cf9dbeca5a49dcd146838dbba5b1
-
SHA256
d06ef454f9b2cb09ccd01597e9e44222e566f0e7df415aeb9d1eba2da94b59e3
-
SHA512
39dc72e10b7631dd52c2b7e422da836b7a694214dbd8e954ed6fcdb5c8cf7217cef20c3f1f41d74a66e3b8d6ed535b7303f89a35b017f886ec2ab566c825525b
-
SSDEEP
24576:tdINf3yLgE3DwtrltuYYGkYpJVTgaX0eQoaBHaDO:jINfikc+3uYxvJgTeXal
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73b5e0d1c76dfc5903cfc232b17b8520_exe32.exe
Files
-
73b5e0d1c76dfc5903cfc232b17b8520_exe32.exe.exe windows:4 windows x86
05824adfea3e378839e428205d348876
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
TlsGetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DefFrameProcA
advapi32
RegOpenKeyExA
oleaut32
SafeArrayPtrOfIndex
version
VerQueryValueA
gdi32
SetViewportOrgEx
ole32
CoTaskMemFree
comctl32
ImageList_BeginDrag
shell32
Shell_NotifyIconA
urlmon
URLDownloadToFileA
wsock32
WSAGetLastError
Exports
Exports
Sections
CODE Size: - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ