wuK��J<OO�B��#�8@.�z:y��ժ�lw��6?�<8s��~QO�ɒ�ge:%QI]��|�}AgǨq�Zf.��G�$��C;G3�9P �u+� -3]�S,ۿ*�<�v��Y��a�b;�ɜe�q �まf�0r�q&��Yz��DŽe�e/˾/: �I:3�G`)��j�����mF=��X&�pj ����qi|X+N_��n)�^5��1�ؔ�rS7�������?zt��z�x i���B�01��&Qf�c��!�I���#����$DPj[���?\2�"Wls.ؙ�"7G6�ų��_�o�T���������h!i�����@�"��l@��i�'�'�,S�6��<|*�6=��{����7�L�A����WΪ2���d��{q�k#��dr��JɊ��������Y���$�O�Zh}b]`�-�������g� ��i �b]��%ԁ�KB���oiF����K~��:Dn{M�RL�˓Y:A�v*���qR�f��:��X�m� g����Q�qC$q u~�XfA��IJ���*�JX?f�3�W�¯1���^qf�Zc���g���v+V�R B��{����1���B��5U�U����(��SQ M�E��A���C����Ԃ�,��^�@���(&Ϻ�������Rҕ���Q/�G|ܨ��v�̠��s�qrhE��+<[��)���(V�`�o*E�s��n+{�d���E��ޢ_D�Vy,��wLӛ�D��J��EΎ\7�3����6@*1u�)���ǻ<��}�-,Y�B(=TJH���Gk��+�Q�aC�W�3�H��������3&���HLp$S���uDMgnI�s! :�A�C����}���|Q��U�,X�6ҘH24���o/}���Geǂ��0��%eP�"�R���Ś�o!�_�Y����2,���n��O�@�����}.3�֕c�%��/�P��)�š2�����C;��������T؊�6� ��h�����@�Ey`� �%ecօ<j�eq��l�9�s� �/4>A��B�yfx�D�?)���� �"���1�Ȫ���o��t50Y��k�8�[{n�� ��&�.�c[�d�+W�J�N��uo&Z�4JQDV'���h̦~����,Xt*� ٺ���^B9�T�{xƩ���ڎ �L�mvq���e�&���g%(B=%)�S����N��1M:����� #��mu�n�2�,TF{�ԀYd����;"�n�M���M��+��Ӑ�zB;�<������ӆ� �� ��ޓ�ڟj��t��f�=��Eh �����Zئ~C�շÏl���'T��c����qO�J��@iT�QX0l�T� �{��}�{\^�q��x�m��.���7@jͬ9ȭ��6�_�� R\�Ɉ��AՈ���]r�������P4L�9�Ɛ��y�ǽ���c�7�moe��*C_�b�rhX���A5�Q�2���ȥ�o z[�p��Q<����������t ��x(r��4�K�p���:O>�%"r��v�� ��?��M\�%��y;�@�3��u��`un�!=��� �����9�,5iW<�*����,���s �� C��-�vBfV���3���3y�VoW��U�;)O��e�V�������m��w%A���ϴ�cC��hqV���K�ƼP~+n2��3�Ѱ������p5Yzu[�9e`��r�x�-ak?���]���n���n� �����Q��Sڹ _� �ItL6yp�k�z���q��y�=#mo�d����NV����(��xY�c����91L3��-ak�_S�7:X��~�!��+�~^��k���;Y�~$���r�x�,%6��CoY�.��q{lF���#6�@C�n��P��v��'�Q��t���#ܽ����p[_�"��͑]/�X4k���w����j���l���˷|������Q'�J� Kw<bU�AӉ�a��������\�34T#A�d%�����Q�L�*}�� ��<��H-�T "t���p�⛺�L��a��c�F�h���#Q��5�^-��a6�o�ifU�X�tT=\D��|q�F��}�ʞO�����Q��m��nj�+q�$�y;��P��P�C^<�w�\( �${R n���'V\ �_O���6$��t�;Q�M��#��=�-�@���XO}/�_������!>,���bf5?f�w�� _��$�T�u؏�>KQ~�r~�j@���{�jF��tS:%��慆�8'*�l�n����f�#t�=�(��?a4B��������MŐ�V�Dp� ���p���p��iJU�0���sZ�� ��,�^��#h�����u���/u�c!O�V"��$2����`1!�]H�W�nㄝ1��.�KP�ʔ��h���A�c�8�>b¡����5<�x�To�G�>S����+ڸ.O�3_�>@;������'�����B�/ �O2��9]�6�~�=�:u�0oCE��䋳0�����f]3UT��fR��v&��?�h'��ԏ��I�O�@�X����VW��/s��.4�@9״ E�a0/����U�Q��Բ��Ȇr��,�~Q���uOŲ ��>���V��s6-�s;j�I,a������Ս�{���oo=r��,j�׀����� �^V۲�g�j����'���:�vK] �������7��n�����^���[� �3$sAuN�s��b����T�>�M��ǹ�U=�]n(t�ö�4��f�&ڃ��Y0�"����Rk��&�ѥ�R}~)D���{��^7���6|�� �yO~�4���u� �}ȯ���l]��K_w��A�n�� �k��$bg�{Y4<C^�Ox�"�ak9 !9�+0�X��ܛ2�� �P^8Z�_���s���b��8�Yi��ַ@5���:C`��M'��Y?�e��&���)"�O���n��ʸOᇖ�0ѽ誣��Q��y�M����c�Q�,� ���������"K��]��9N�[SgM��~��Nx��k�� ;8�.az�a����;H��
Static task
static1
Behavioral task
behavioral1
Sample
b48522f7e56d2a731a0a6687222aa7b2444ec806b97e27e7bdd0a6aaa7e9ee42.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
b48522f7e56d2a731a0a6687222aa7b2444ec806b97e27e7bdd0a6aaa7e9ee42.exe
Resource
win10v2004-20231020-en
General
-
Target
b48522f7e56d2a731a0a6687222aa7b2444ec806b97e27e7bdd0a6aaa7e9ee42
-
Size
10.5MB
-
MD5
39713fc87fb63596ed01738b58f4de2a
-
SHA1
521ed0b7003f78718811c97fb03d3820c2710ae5
-
SHA256
b48522f7e56d2a731a0a6687222aa7b2444ec806b97e27e7bdd0a6aaa7e9ee42
-
SHA512
dd5a3614b16d6332a1d6317ceb86a100fb3f92c89bfa87209ce4cef63d24a3d56d2b8aeddff50aba5fbabecfddb141aef9afbf32840fb670a4e7405785d0ef17
-
SSDEEP
196608:qMGHwl1H/DbumVD2/QzcvK69Ovf+gbR4hjwrsDkgM:hGEH/DbuU2/QzSevjSgKbM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b48522f7e56d2a731a0a6687222aa7b2444ec806b97e27e7bdd0a6aaa7e9ee42
Files
-
b48522f7e56d2a731a0a6687222aa7b2444ec806b97e27e7bdd0a6aaa7e9ee42.exe windows:5 windows x86
0e187224d756e82f92a3646bf5b83f13
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetFocus
CharUpperBuffW
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetIcon
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 984KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 851KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dat0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dat1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dat2 Size: 10.3MB - Virtual size: 10.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ