�ȑ�Q_闈�y���.�����Lav#SӢ\'lnO�Q��V�h�Rf!�G[� �������+�-�J~�{B�pn?�M�CFR�:��"�MV���!��Kv��Y&�D����,����%�$g=��̞�O���,��GԦ3c��]�1x�\zIH�F{4� ���:�뢓#TTH��mO�+Z%g�S������K�q�����&����&���o�%њ�$ �"fZ�n8-;�j�Q�� #�k��P�9ѳ%B��3��������Z����,}%%�g\������xT�W��v�x�l[�v�e^vE�<m^��'"r���<�~�9���� ���~&������%���M�ц������6^Gv~bs�y��#+��*y\噠'h��E*$���Fr:Js*Y������jtlE��5b��+�v��q'�C�4��L���š_�-_�� "��x�_��ڳ�+w��ht��-l�7G��R���X����|��6f�M��2�v؟��|��c�,E����&�}���(�d_P>����m.\�<��T(�v��Խ2��?17����e��t44ϳ� ���%�s_w�� 3���L�Z�6Ӫ��-m��N%���D�$����"��[5�����+C|�ݜ`�AP��?J�4�`� ߋs+0�k�*Hy�������1H�FW��K����b��f���@̝d�栜���k�Q>5�~�ϐR|ؿ�����K�W���/?������A80C"d���㠾�� qy���H �SG�&����V"�����˔���:��@�Kh��p4��',�W�\�wWI�ZN��� �y��U'�oi/~P||zTN3b�d���i�9����G��Ly�C/.�������v�]c���{[`5;�;����b?>�� Ɲ��9ͺ7��3�dC�k9��u�'�NW|�s�N�d^��9_x���OW�t�9����3�0�L�ބU������� E� _����V'(���:�� r�d_�7����&5#�u�M^ȐMd���$,m5�ec�J �=��8Ԩ߹��|a4�����e��T0�b��>ڋ%���w��KH�oW=f�6�X�K�D"[�e�mf_�R�Lx�u9{��.o��,���6����Eßn5��~�Ȱ3g����֡�qL�FG�TKc��D���(w�l ��6Es���l�w�������t����e0,^��*@��S|��;��\�1Y}���9�6����HY��"9�T`�%F �F ����&콱�3�7d�N����YK��MC@����l��GUz؏(H���J��i5r���U;j{��-`�Vh�b' ����)۸&���� 0��Muہ�H��M���tEP�Y�{q�r�nv�]C���^�d����m�O�M��-�"�`�f��[��?ϝ�Q��"���� ĩ�%��4P�7U�r)1ً�q�q^�]Ŵ-e3͂ێ�R���D�+�!U�$����q7B2V�99~ܳ���Z���'G���h�Х�������JA�Bm�2 0��F��'�zT���Kr��J���X�mᨈ�8L������pW����)�6?0�3�J�S@ҋfhE�F��N �ܪX3*3��+��hwE!]'��Ĩ�|fQ(z�Ǎ=����wtR}��O��nP�*Q�@��D�A�C͈0Wx�-�ٯg|�*|�_�W���+��y6���41��� ^n���Y�q�z��/�9�ݱ@d��1�ه�*��Q$���Ѣ�b/��5���#r���K!LQ�� �q%bQ!��97��P�|����v�.��L~�xڢ��~s5����a��o�@�u�S�����<*�S�}��ʝ��u5D�@�Æ��?��%d~d"~ �o`{_q��J,S�%A��?�N?UP����Y�Q���d�/�'��hs��(?bs��¹��B���t�k?D�}������A�x����>�*L#�ظ�nz�3�SLi.�����,~�l��,�N8P ]�~��Z��/�0�+�� �祦��� �Ra�(q�F�YI�����d����&m�J��mq%��q�V}7/���z��0p��v��)/��jjm<%���A)ۇ؞R-�Q@n)��*㊚�\����h�'�o-d:��'��{��(D���g��S�v 1���Ƈ����3M�h�xF����4ۻ��&O��w����sܶ<j<ht�VH7M@��ą����Aӂ{$<g(\��?�,b|bÁ��7�������g �"�<��}j�a��e�)$��NH����%���֫J���)\�k).�fvB��,�%��Ŷ� }PAs���ָ�M���5~��wO���5�(��'�ixK?�� w��N[;t�o�]� ���>����/�Ė�70X�ʌ���D8���˿�\R�$(4��d�r�fk��F���TZ���f��vr���z��~�&z�� +Ru�o������]�j���e�)�A����<�_p҃���Ȣ��nI�I?�D��V���9�c��wm��"~e�i���`�ޢ�dk�����O�2 ]��'����@����А$�PVo'υ������~H�{���^w��!&F9�RI�/f�p��k�fc6�a�a�u b{�._�C��18Z3�2�Ue�*��h����}�+~RT ���G�ԡ#��z�� �����WGvR���|3�,g�E�Y\IP��$'^���:�xkMo��z��s����^��:o�n�z�X0p ��m-{C�E)��<��v6h[��Ċ!�f/U[[6wa���]���S���7i]Ju���3�K[�Z��q�F�m��C���b�ƅ����NV*��q.�z,�ې r�5��U'����ȺA(t������4!4 �8���I\�K5���d2�v��e�7�>[B|�K�n��^�A�?e��9O�e=:�CU�>������{���[z"��g}J�{�"��w�D��P컂k���������yy�HN�.����LNFI�$6�P�� ��5��띟״C����r��ccDG��W��U:�6y�M�6��Ƴ6�i9N %�f��
Static task
static1
Behavioral task
behavioral1
Sample
895145c38106bf2d6f8f02c192f94020c473f92ccf7bfe369e464bfb29695ad2.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
895145c38106bf2d6f8f02c192f94020c473f92ccf7bfe369e464bfb29695ad2.exe
Resource
win10v2004-20231023-en
General
-
Target
895145c38106bf2d6f8f02c192f94020c473f92ccf7bfe369e464bfb29695ad2
-
Size
6.0MB
-
MD5
1a2a7031d49caf3b3e8db134cf1a55eb
-
SHA1
c6e7d40ca0099ce340ec66bdb796798e87a253d6
-
SHA256
895145c38106bf2d6f8f02c192f94020c473f92ccf7bfe369e464bfb29695ad2
-
SHA512
c36d501fe574da8daa872d1ad58927ddc1e95d006e1496d04611d7be5bf61e02c81d79e1e1d1e3966a50ce2dce9f8e1cfcb77166a3b2bc69476a37ce52cb84ab
-
SSDEEP
196608:PFh1CGRYTmyVkBvGR2sldq6FqrpwUw2BikWah:PFnCbkMR7qhw2grah
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 895145c38106bf2d6f8f02c192f94020c473f92ccf7bfe369e464bfb29695ad2
Files
-
895145c38106bf2d6f8f02c192f94020c473f92ccf7bfe369e464bfb29695ad2.exe windows:5 windows x86
702698e655b644254715c491e4aaef18
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantClear
advapi32
CloseServiceHandle
user32
SetPropA
kernel32
GetExitCodeThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CombineRgn
version
GetFileVersionInfoSizeA
mpr
WNetGetConnectionA
ole32
CoInitialize
comctl32
ImageList_GetIconSize
urlmon
URLDownloadToFileA
shell32
SHGetSpecialFolderLocation
comdlg32
GetOpenFileNameA
wsock32
send
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ