�%͛�R��a�+ak_@�P�%�Һ��փ��j�\ �pjl��P0�Z���(b�0�Eu~�)*�2ҍ3��y��dn9��n&�eN4����m�(be�wx�����Vٔ ��`�PDcf�w�uTt0��a �"����v��Z�������R}T�O����'���.@�Y�f�o�^��\����?Eb�c4q������_g�7H����iG������a!��k^ੀ���ΠCj�+e>�� �&[�w� 2�ӝT�{�B�~h��[���&'��k�� �^H�ӹ#Y��Z����7��|206ÔgU~mM ��Id�ױ�����_�u��鞹�<8Ӻcu�Y����+'����,�e�7�gW��`h�xǤ&:ؼ�u��D�+?�`�<+IL�P���4��F�jf{T����MG����x$�����7���cF�=y�S��]�}��A���a��x�H,�J���JF��� 6M�~������O�)Ha��j�q3�Ӱ�0�K�e{�E��F'��_3h�%�C�X�wl�u2Wr��E v�]��L�q�cy�k�_ �T� �"'m�sc 8w�Ex3��^�����$��)Ƀ<q5{-+;�=p�I_G����*M�m*J�r��M�MC��O���J���i�j�췆�'Wu�$���~T���`ߗc'7�F�<�.Z�w��b����0�Q��Ҟ �˼�e�g5�J�8��Z�����>������?Pøn4��e�6�q�=�k�ɖ���3�1ѐ�ë�Ճ�z��k����xT�z_��(����6���-DR�����Hu*w��u�4���禮Z�����W^{iCq�v���6yY�O��\)"Q<��c����V! e�����-o�Y����AB?���Gp4�����pQ�r��_�b}���Z����.���/�uZQ y\��G�@Y�w���I�v�\���+1W�fG�q�Jc�V��DX��V�Ќ@��d�$ta�&���i}ҽ�u�)kl��k���M"�L���w�f���ѵA0I�@����[P��j����q}Md,���0�.s��U��zՇ�ؖ��n�r����y&S=�ɿ���P{���?��wr�z=���_��t�ϹջJB��+݉�v��d�T���,Q4��5�<��ʯrȴ���>�^�]�1�$[<�W}��K����*A��LT�W6����]1��5=.����B��QX�ae��g��iu#�&����u�pλ��}1`*Ro5A�%�� o)��J�_�/8-� n۫�o={��7��Չ���e\��o��2;���[�vCg���"����Id��U8L��(Nѩ�k�Ī�ڨΔ��O;�FA�}g�?B/.-y�[����ǖ����/�I7�,�.{E20�X�8R�M��1��3|�'�Ϫ���`k��M��՚R�\~� ������.P]��l��ϗ�0����n�����e!���?�^V�r.�m���x�i�[K%*a!�8���0���A_ʨ���~˄t��������V�� 2h�>EA��X�ʟQ4[w0��z�EI������ O�������(�v5�lhp+�����NۿsNd�cX�o��M��~��D�梗�Qt���M��YK�=�檞Rվ��rnS�ǼϤ웧���G��� =3�~ a�cA��i���5�� ��=d��|��.'IN<[���ol�ߗ�k����*;�V�zF�)�xAz�HlMm�P~:�Օ!l�bPEо��H�����|Ȥ����ݳb1'����34H=���Z����έH�;��E�Tv�����;c��<C� P�&�S�Ԉ�"!�2\R�Я ���7��V~ғk��k����s�l���� ɵ��w�,��M��1�CɌ���K����9�E4�@�� ���]�i�P��s<;�`�GZ���C�3N��Y$&�%f����g>�2 ~�a���ԅR�X�-���ma@��u��D���[��gc),������G ������I������d�.<l�^�e~!���������)bw.�n+u*����e�c�Y�����Oq0r%w�{1'>ϻ�W�b;�cTX�º�"x�-}d���!�Iߍj;S�။OH�d����?�o�MT{�rr���1�ki��� }\d��� ֖���!Q ���_{������q�%V���tˉ�����nMw�쿤�U�=9�J̨'�u�# @�V���$D���j@L}��N� �.�0@����Y���!�g!t�r�<��"��`��9�eF�����������_�h�&G$�́|l�[�Bdx�� #Z�c�9����;��S�B%��W��`�4V�s `���#s8��W-�d�TeE=S��Ƃ�8�d�y�����DDlL�ufJ�L'���k��|-�?m� ?F�2G�@�XA7���_JC�c����`��fhTҊ��[a�.�O� !V�p��Q#r���N|X�H�U"Ơ^iM�k���b]�ϛ$���Q$�s��d<� \Tq. �Ff���n]���,de ��u��!;_�K[���=Io�"���,5��)uC�$X ��Q�!m��2�&�����R�{����m;+�l����F,��U#��m\BՁ�a�#��K3 ���ϋ?�0jZ{���{։�ҟ�n~ٍ5A!LC!�M�H��eS3��j�h�fj> /�c�h��p���V�w�u�7c*4��y��-�� �jy�EC q�i�F��0���� ��`��`r�Q����c���̲�H��)�q���u{�z��L\,Zgo,)I@-#;CB'"������՝7��'��7\90������r1H�mY�&�f �|r�1,��#I.��q&(���s����|�5T{��7�>\ڂťN �d`^���Xǯ���o�W���.�g�e�.ܐ�yA\��D#G�� �)i��M�eqC��������;)0y����uOOq�;���� 4�|Fۀet;C��G�W� }��*+�LC´��l�[�W;��3�(�͍��zĵ�6r ���|�6��y�'�/ɉ��T��CD��fD
Static task
static1
Behavioral task
behavioral1
Sample
6b7c643c86b736c957b5966ce4b578c3a62bda605af2b0e571cc2a266e323ad4.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6b7c643c86b736c957b5966ce4b578c3a62bda605af2b0e571cc2a266e323ad4.exe
Resource
win10v2004-20231020-en
General
-
Target
6b7c643c86b736c957b5966ce4b578c3a62bda605af2b0e571cc2a266e323ad4
-
Size
15.2MB
-
MD5
cc9757fbbd1702a8ec874a1856e5a7a2
-
SHA1
fcc42e44817c274f193605d0016a8fda4e6ae2c1
-
SHA256
6b7c643c86b736c957b5966ce4b578c3a62bda605af2b0e571cc2a266e323ad4
-
SHA512
b6ee9d14204d9b6ec42250953338869f1ecac919fd198682896810800f93ba6ae46808596dcccdc0ecf72946456b5f0dbbe78ddb3b869da862fc89e523c37882
-
SSDEEP
393216:ZMXSoPIY69TZ/Vtqqbfi3sXBobq0pGyuPQPWfz:ZOIV9TRRicBoWqpuPQPWr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b7c643c86b736c957b5966ce4b578c3a62bda605af2b0e571cc2a266e323ad4
Files
-
6b7c643c86b736c957b5966ce4b578c3a62bda605af2b0e571cc2a266e323ad4.exe windows:5 windows x86
2df154c86873371d4376e2295620e0db
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyAcceleratorTable
CharUpperBuffW
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 858KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.DNv Size: - Virtual size: 11.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.FvW Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.-,Q Size: 15.2MB - Virtual size: 15.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ