��-��iRp�#̖�Ļ~ڛ69�F�b�v�7}�e�b�r�)n$ 9�ȶSY�R+��u��u���IO:��f�=�]D%��u��1cP�X�J�MV}Z^�ĩ9W�����N��W큍 Y��6i7.2�!c�'� *��� �������2��xTyt�W{9��,�c �3�-C���.�.R�&L]�A�� �u���@�(r�؉ԯ�w��\���q�t���eNc�못� ]n��Qg���_�.˴V�����m�8#[������xĄ#p�%��,V�n)h�ᡀ*����]k� /'?9���z͂�t��t�XI�ޕӄ�8ȍ�|A�M��ȳ�(���P�JH��P�<+v���4W(Qϟ�ݖ�ˬ���F��\�D�w��$\ǵլ��}hk��m�df"P��X����;p�����r+\��{+C�U�l��Y;�LsA~�N2 ����}uݔD3��������v3�$ ê�����ȉ�*��J�gx �&5��,�;���ʶ��}4q���q��sʕ,зx�/0��ϊ<}��XP�"b���l�U4����S~��>B��G��;.��������($���Tx�k%��{�zÈE0y�%�o��LZP�����!Y@�+0dKW�[f���]�%�IX�!\b�"��9��>�F��Њ�Bxp*�������#�W]o���kd��� Q��3���A����n�жC����3���Ԓ��Vl�6�~K8���a/�/��{�AG�m�GJ�_7\��X��h�\���<X��A��Лk�^\o���a�߽��N��X�������3��h��(��r�e�ϡ���bx}����̈́�کO�-Gw]@��� �����:d翛ڟ�d0J4,a�i��ӎN��'���+�+H=U�i��uy������O����P���kh��U�&�(�3��ߥp-z}љ������kwDF�v���"�b$�����5,,2\H Nu'-5z����ɏY'��J���\X�����$H���Lw�Ս�&I���;�O���gh��A����, �R�,{)�Ā����,{��#\gW�����5�P�5� }�K;=�$��u�O� y�� ;Z�ǍT`�}����c9�����kjRi3�~T�w�B���[�bַt��& 4:�;(��ķ�t{+"�2l�>v��|�,)�&; #�z �1�4Ѧ�L�nぺ șJ���O�}�4��E ���rY���HU8�Mc̳��{_,�U���ݿ=�ZH�3��T�����'����3�� 9b�y����]�)�8�Y�k�Dm�0,t�qH{�b,�=�oU+tlm�o�:(L���w��n�]*5��"�ҒN�T�F�٪�z�-�֕;�\o�ާ3��c�$2�[K�b��NU/DkG8GW�R[��g ���T�CV]]�����N��t[��(�i��(z�י�#��ᴉ��RWP�o8����Bn�K�w�F�|Y[��D �CDZg�H���'L^BV �;z�$k[�i0F���T���������bG�꠴�*��BK5�ʟ�X��P@0�G�<��`� �e��]0��+?T��"�x?�>��nP��t�:+ �p2W]��Nj�Z��B��m�d�[�vRATi0�@?q�ą�zL�r}�|�:�Q��[��%�v�\ ,�aP�)��4�_?�" �� �3n\kފ�~��Z���c���@G��i/��q��[U@�7�����xMz����ګ�2 ���W*i�3x?ͷz-W���ވI�����<N�Tc<.�hʦΊ���kB压Z�|�( �����\���A��œz�0�m�4ĭ��r};n�A�K�p��?��Ó�֩)[�����Fbn������@mg��֫0-&1��Em* [����5fs�m��Ģ�E�?����o"�N�+���;�J*�z�8�IA?)\-��@쒬$?�ҁ&���-XC9#�x;{�g.N+�<�X��w�"z�-�Qv����<�b��Mg��fLZ�2�N�����Y����XѨQu5����+M��&��]rͯ���u��o"T�Z���#>�E��7ߎ����z��'���Sb߷}���$��]��߉�[q� ����w��������a�:~q'�=`� � �*�'P��p+<m j���biZ���0l������7��d����D� !���+?�!oZ�C$&��R/ ϳ$��8� &EN ��[�Țw �LD��I6�����гX�줙y}�X/���/��dS9;���X���G����k����� ��|+s�I`����*�颦Z�Od������&�t�s%U�"��UGT� ��Zp�P�'�]�ܐ���v��p��+p�md�u�XuRB)����6�[T�e���%���\?���6@:�Q��? ����ؘ+�}�%@�:�f�*3]0ھ���R���<�@��[��7ʞ���d���'�8l���= A�I (N�G �Ϧh��8KӁ���D[�/B���zj��d�;��}�>��n0}ͺ�`� �:� '�w��N+1F����?�qLU�� LuU?m[�f��B}�V�]/����� ��."3�8��mj0�ڱ�������I���?�;*u�L��5���D�=ba����+u�I�L1���C��gm��hͻ�.���j'͌e�[2�����f�����Wr�O&���� @�x��j�eK3�<�>L(r��W>e�-�uHo���lU�z�wh|�~n���N��z5��k`�?�o���X�B���� �>O.�S�4[_}_���DŽ�5X�����-�<���Q���McN�CC���Z��>�A�ew�1Q3b��/Z>��Ż-��P �d��\�oLv��E��J�l,�j�; �ֵ����k�3᮸$:) �1Q�� k�tm���n��Z���3ɰ��-���S&2��U��F����Z��B�B��u��ͳ�&�����՟������s%qK�?��xLf�֚>{��IњD�O�m$O�����ђ�����Fz�A��U��3���m���.
Static task
static1
Behavioral task
behavioral1
Sample
5eb3333e5a7bcc4b29f334c1ba500dea8afcfcf3633423a996519163b1f06fd5.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
5eb3333e5a7bcc4b29f334c1ba500dea8afcfcf3633423a996519163b1f06fd5.exe
Resource
win10v2004-20231023-en
General
-
Target
5eb3333e5a7bcc4b29f334c1ba500dea8afcfcf3633423a996519163b1f06fd5
-
Size
6.9MB
-
MD5
bc8dee936cd30246e8bff474fd5bad85
-
SHA1
1b347c8ef760bf9fa8aa7ffceeb8ab19b8a3e0d7
-
SHA256
5eb3333e5a7bcc4b29f334c1ba500dea8afcfcf3633423a996519163b1f06fd5
-
SHA512
2d54eff01095af656f4b61dd477b7e95746592b840d4a31c815464cbaec62f0638b9147c9289d05ed185862dadb76acf01b09d7a439e32b1a15ca3c6b5dc12bd
-
SSDEEP
196608:uIay2t/u6LBfgVE0B13ke3JfHydrP1P5ucz/zjJx4gYHStm1:BaRpLBfAvrZaxP1Pscz/zjJx8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5eb3333e5a7bcc4b29f334c1ba500dea8afcfcf3633423a996519163b1f06fd5
Files
-
5eb3333e5a7bcc4b29f334c1ba500dea8afcfcf3633423a996519163b1f06fd5.exe windows:5 windows x86
62ee9851466a7b949e66ccf8b4913cd5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegSetValueExA
user32
DefWindowProcA
kernel32
FindFirstFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateSolidBrush
version
GetFileVersionInfoA
mpr
WNetGetConnectionA
ole32
OleDraw
comctl32
ImageList_ReplaceIcon
urlmon
URLDownloadToFileA
shell32
SHGetDesktopFolder
comdlg32
GetOpenFileNameA
wsock32
WSAGetLastError
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ