%T�=�/]p��ҁ����ש��6�6a�HBb�Y6r�x� 5��F�<w%5��1~d0����߁�����!�f2{V5@�FC��Ǔ~��P ,l�\�������|D�T�=��x�:ú��K�����/��\�e?�6��v� �z R���0��N�rQ�6Bu+[��0��S�5-D�����LuxR��U�>��^���JH���+�Pl�%-�3�})�6ӽ���`����<*{d?,� �Ur��Q6 EO%�}V *`[��@���(zV�D�^�es�;�>z��ހ�\� k^��%�������e�'��^;�[���~9��C �R����nmW=���A����Ϡ�|�aU���ÀF�$���Iڶ�cF��p����������Z�T��b@dTᛛZ�U���U��J��/�|jRS�l��W-�C�֑�CF7�w�]P��̯2� \ftS��j��4�0��hd%�A�X ��=�%h�$%�oX%�WDo�c�� �:�� �D��Aˋ�Q��b�Q�p�N*|�kg����dB�HV��Bu�����e�4=U�Qx�S�B7�omX��`}��l"� P�C����Zi]�2 ;� =U����%�8!���+���E��_L!��� �-����d�>(�b����؆����t����A��jUP�,Y��2=�<��2���i��;�6��n��\G�V��3�f�s5�kl�x��:�J���w]�-ɑ�c�p*{�(�C��8�wG���ns���䥕�h�J/ Z�9��3�b��� j� \�Rf�&rͪjw�[<<��� LC��=0tZ/��/���X��t��N�����!�q��mi)"�W�ܔU��|�l�UEu�D�K��� 6�K/GXa�l�1�kX$Y7�b�ٯH*U��bV��^�b$�Ǜ#X�_G� �G$�?h吺K�R;�Z �a�:�+�&�coZ���-ƕY/��B l�)�ߖ.��E����3��H��� ��WZ a����\�6iU�%�|�.� y���H��KoXS�����=:�I9h�/���l Wav�Y�����O������X��tH��$��l�כ���̒�T���,����� �����湗x9 >����`���k���K�/��KMB��^?��iŽhF5��l`L~eR���+��h��.��@�~�[�V�Ip2$Ԇ�Ur_���kV1U�Q��H�-c�CRoDlǡe� ����f���� T�������>�腾)&I��h?���Sf��fg�4�w��Y�}�u�(����?���/�2�|B�9.���ѱ�Ry��˘��& �+�����K� 4�<��̡H�,�Q��a��Heg~�zCNu�n�U�%�E���[�C�}I��U>0�r������Łn��KP�kH��U6�f��~푁������("����5�鉡�Vv�����z�вc_آ�j���e!�v�J�� ����<��u2�Ql����J~�,�T��T�#=Z�h�)� a�Bm�DRf43/� �xe�W���;��mν���;<u�ÿU�����{��۵F95���x����?�0ߎḲ���\�<��Yŧ�t�{ ��K� *T�X�գ`</ҍOW;�4V��H��k�)ghBA�!���U��]�݃lz��Q_��)8 l�m���>��ך(F �JL�֗s���F��TQ�q~G#g��j�v��Mj����47�#�En�/u�4A�D������A��_.<�[�?cE=�j���I!��㭷�7�*���8I�x\��5̣7����,�[!ڭ %A���̹��SqcTS"X2�H�h`���18��1k�s��Ġ�����%��H���_9�˦@kjy;�h����]JV�ѓ[����Gk��YA�4����e!������fߣ�a��q�(�����(e�q��� ��gvϔ� 5���H��� �0*���rd*�}��:g� �{�~�`4��μ�{��O�ι�P��o�O�v�d�؊SU���T�3m�DP���jn�R��g�k���Bt�h��/�?��@B(G�*�?��1B��3C5)��[AuW�����Hӳq4{ �T�q�2y��u��Li����q�MV����f�I%70���IA` a�O���/-n�Reڟ A�5��X� q��13��w4c�c�vU<Y8A+/"��Ր�� ��2X�u�Ӎ|堊���J��p鲬��y��$*w?�!rv��Ǚ�4��^���)Q�zӕ~�5��SW�&��c;��Ң0�����t`@ ,Z����'�8��Ag*���"���qf�qE}e���I��JϫA�� ��/�~(���D�X2���2�s�!]7���M��v}M�v�Z5�SS����������Jy!�֛�_;�����Ѫ~75���}?��MWߚA;#�%B&�/�i��?ƥS�3���o5(��˒���n���MI��?����PEƦe��S�xq�z�#gq����"|���C� ��6G����ٛ�MȤ�M~:�6��(7�>���b�I��v�RtN����y��0;����w�ԕ���U�v4��Нw��n��|LY��CA������Q k���[�j;����I5n��U�Tg�a��P��/>�"���'� ����(F��i V�pw:������и>���=�q��{�ZQ�J4���64��x�?<��@Y�7��W�,/Y:K�M�!���t��L���4|�+U/Y���*�2`��(3��e�u}2��*����H��������́��!ΈyO�5,F �2Ikw:;)��N��Y�p�j�T=E5�%��Ͳ����|<�Z$�߰G�� ~��o(��V�?��{�@���Қ&��k6 d8�4 �ym>�?^�o�}zἢW���� ��Z'�%M_Y-�8�|�G'�������������a ���!�)0H�K;��^�5y��f�� ���L��kݼ�/�y�EkQ:�1�'�B�`b�SG��<��4�K�n�@3>�>�KO~�ȼ��$ {S��v����o�KoA
Static task
static1
Behavioral task
behavioral1
Sample
c25264d1b535899d2467fdc7acc3ce1a2d44fb4b859280245fe83ebab900061a.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
c25264d1b535899d2467fdc7acc3ce1a2d44fb4b859280245fe83ebab900061a.exe
Resource
win10v2004-20231023-en
General
-
Target
c25264d1b535899d2467fdc7acc3ce1a2d44fb4b859280245fe83ebab900061a
-
Size
8.5MB
-
MD5
499307b55491e601d000d243abceb010
-
SHA1
045fb442b4ddef51a7403ceb20c4fee067b45cd2
-
SHA256
c25264d1b535899d2467fdc7acc3ce1a2d44fb4b859280245fe83ebab900061a
-
SHA512
94afaa6989e1838974a03e9c6ee10db590278524db3d8bcdde239bf98ba13d39e217b19209ef2ef863d65cc2424b0634b2eaf89f209d0b7e3c8c32b7991211e5
-
SSDEEP
196608:2HOo4YvW8+9STyDqYZhUCC5W5Jb4meP5VutsoX:g4YbeSrCvaW5l4m4q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c25264d1b535899d2467fdc7acc3ce1a2d44fb4b859280245fe83ebab900061a
Files
-
c25264d1b535899d2467fdc7acc3ce1a2d44fb4b859280245fe83ebab900061a.exe windows:5 windows x86
46fe35e4ac72ab5e79efdf5e89d7f4e5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
CharUpperBuffW
gdi32
SetTextColor
winmm
midiStreamClose
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
ReleaseStgMedium
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
WSACleanup
wldap32
ord29
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 759KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.YDun0 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.YDun1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.YDun2 Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ