�t�������MÇS�R��\i�Fϟ���:'ҡV_2R��wz�N��+�$;����5ҫ��wf7��F�*�IqV7���Gz���I�؝>dh�"@Y=�����m��C��&)���e2�Bt��k���!n��Y2%���gb��p 5�H�����G�T��M�wG��������3(9/I=��?�?�Hdu"O=1̈aA�!��D6GM�����H!��갴jI����Z��km�&��w b�B^C�� P����8#.�+���t�`ĉ���ob3��w%��������M��xB�; ϕ(��v�K�W�qT|�Т���Z3��g��"=!z��#�A�� v7���-d�r*���_�3i@ �w���g���ja�4�b������?l�R�ӏ^.�A��3_1���P9(Jx�����Z��f �a��T���+Sd�K��d�m� ju��CKX��1��em� J�<�7�&�p��:��NO��MUǹ��)m����Տ;���-s2������9�;��������x�z!�a�'E��<]P=������%y#l�"%�B}ȹ��d�0W��>d�?�6\Т_�d�0�?ݥ������{b������|?�߀��{x���pQ�t�?�GT9%y�d �Q%�� v:Z]-��Vw@7���BO��5��&X��E�L�?-l*����U�L�$��ҖLC�r�v���P=]G�mk���NG�� &����nlY'vk�"3�*bY*��Ɨ��|��~zw��%�^�RD��JiPJ� ��4;��~�*�m}|K4�qIH����4q2$m2�W1!.�R��a�e�HO� �o�j"�8�<~o�]���)�`��~���wJ�=��0S|4حըl��g��i�Z,2h�[=��'~q�S����?ԑ��F{�gt�tO㳥^T�8�� \6�b�q�> ���vl ��E�Ԏ\�E���n�+;� ��Y�Km�ŏ=F�c �jH ^]�[��y�g�7�Ya �����c}�����> ��r��{�q"䍄�����i�Ij����!y�����m7�ε�*���Oq�^ 4ASx�ɴ<��o6�����������[��*E�����1 �m�F>��3}�5�R<�u,��~!� @`�3]9ٰ�S.l\�Qpz&R`/X.��åE>^�AM���uq��=���S�x���-C�7_���/%o=��P�<���-kG�%���Jy/D�7u�D=�ۑ1���IƮx#9OZ����'�e3ݝ�T���V�y\�A���|��R�*��H�0�V25��g�� ���*���,�4�t)ָT{�pC�?��K�T���8 �g[��`�'�+�J�g6�"�s��j"�2 �!�q��DN�_j�[U��v��T?�\��n��@�������A|臗}'�G��81F2��Ҡei��4���6�� �@�Z��7��eh������QͶ���$m������Nl�1��U�� ݻ���3�RʿX���D��&��:RH�7M'� ĩ�%õx�K9aPǓ��vuT�����~����Ś��s[/��Q�"[=���{���u� �����\�[�<����~�[���Dy���}!sk�qy�&�@���PR�F��y@E@ҥ�Nl��6S���!e�抺th2�%�%��-MVj��n ˼"���H3�#��>��/ =���z}m�ѻ��(o�B�b�%�O*��g������P��o���m`$��d�z1��1č2��a�5 lp6:��-�*���h�rˊ7NZ����_~Crj-��q�<����P��t��~Uh���ڿH�&��g���%]� )L��aSZ�j�t�i��DӢK�M������0rj�'C%ST���!�{�����aB ���ct�3��'"�Q�HmGh�����'`L.广ՁFƨ�B�����};�N�7�J��N6z�aFA��'.ң�Ԥ�9!_TjW��x��=���ޓ�&�Y�n0m�ZѲu/���ץ6I���\��(S�u�I���?������c�z��;Kv��Q��&��`�{���~u!��2F��Z��>� r�xy������?���n�HY �~��+@��?=-���r�9�2�}��H�&d���g?�}�=��Ⱦl� ��xbS{d�d�A�P�* xU���s��'�س��Yε�l�L����������'�w�ٻ�g5˲Q܍k��tA�U�w��F!����[K� ���ԁ�͞(�>J�:�?Y}s�_,2�l�R���=����u���}z��Z��`�Y�Z�nh�g�` `QTݲ$��$�o ��pڔ9�6��������:��l��?a�GW�{4�����L��I�n*�d��ߺr���@U^���L ���]{5��o(-�xI�j��Jij��q�K�s,#�!*�&��myH4N[F^���:���0�wro�ŪD�0���R�,�'�BA��N�4�&%�~@^o\���_B{��r�͞�u�&�X:�J�d�����V�%����3�G�|�*B���������q$��uG�}�w��M���Ӆ����E���^�'����;�vRd,�1W�LC��[1A[�v;�Rrʻ �@�9��ΐNB��bܙ�`F���=���=�`q<S$�KĿ��lE������A����`�������Rjٚ*7�I����R n<�\E��~n2�#�䊤��TD$��V-W�*��:�FEP�g���J�1sG?L��O���٘#.��,(�1)�xZ�� �&)m��l���E%I�J�(|�!��^�f?�[��?R��9��2�ܱ^ծ���>�Yl�A)�����ri9_x�P�Q�����@�|�5���������Xt^�ud����mW�V6��zJ��7+V�7��s�0���T4����u����sKXZ�6p���9$^*{�J&r`�;�q���o^�N�t�8��;[�5Oγ�m絪W�ImH�����?X�r�JȄyx�xIEo���J�x�'����[pY c��_&���-��[~ �����������5��+�3<��T
Static task
static1
Behavioral task
behavioral1
Sample
1612f94a2106780fa84ef56b042a4a9822a3a09f2571dcc620cbdb1998ec2f8d.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1612f94a2106780fa84ef56b042a4a9822a3a09f2571dcc620cbdb1998ec2f8d.exe
Resource
win10v2004-20231023-en
General
-
Target
1612f94a2106780fa84ef56b042a4a9822a3a09f2571dcc620cbdb1998ec2f8d.exe.zip
-
Size
14.5MB
-
MD5
d058460f733c5ffb734b7faa7c0ebd9d
-
SHA1
dcf7ec688d001d971b7ac1b7a5b47704386cf4c1
-
SHA256
6c032b63f668035211d8b9d91a5966f888e5d613009ecb73ea018ebbb012713b
-
SHA512
f5b18f9cf6c6b442b51ee72e1be80019f8058ff564295f0662d7170be6b4deaefedd2a735b36950118f7361e3d69641fa6a8f8bf7b4350b3b26e68adc22e04bf
-
SSDEEP
393216:ggTDzWk2ZOEkm9SWjTRhZI/H9zuCDUEFqg7/G0:ggT+xZ9kmkWjTLZI1uCDggL5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1612f94a2106780fa84ef56b042a4a9822a3a09f2571dcc620cbdb1998ec2f8d.exe
Files
-
1612f94a2106780fa84ef56b042a4a9822a3a09f2571dcc620cbdb1998ec2f8d.exe.zip.zip
Password: infected
-
1612f94a2106780fa84ef56b042a4a9822a3a09f2571dcc620cbdb1998ec2f8d.exe.exe windows:1 windows x86
cd3e5656373b47dfe7268fbd6cd29946
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetFileAttributesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
advapi32
RegCloseKey
oleaut32
SysStringLen
version
GetFileVersionInfoSizeA
gdi32
ExcludeClipRect
ole32
CoInitialize
olepro32
OleLoadPicture
comctl32
ImageList_BeginDrag
shell32
SHGetSpecialFolderLocation
comdlg32
GetSaveFileNameA
winmm
timeGetTime
wsock32
socket
crypt32
CertCloseStore
hid
HidD_GetAttributes
setupapi
SetupDiGetDeviceInterfaceDetailA
Exports
Exports
Sections
CODE Size: - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 8.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1.1MB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 41KB - Virtual size: 19.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ