�/<_q��+2%e�<_9˵���'6u���=�����zY��b%\���r#�ͭ�Ǘt+�ͮts���[�.LΆa�P�'y�U���wu�cm/�r�������bE�Ŵ�Ɯ��#hU�e���_�����-��{�*מ�ۗԆ)�[@|���P��y��\�y�A>���@ :Y������|��q=0�G^s3u2x���m-K�����EвȚpv� ���hXC'���vt)�'�;'+z�es�M�f( J�@m����v�T-� ~��X3m�)|"���NJϔV�d�����`_"��[��9VYQ��4je8_�ȺQ����e�w��9�$�<��S���:�ǒ�$�B�f�:$6ƻ���#�<�&p i�rT�y�� cH�B��Izt$��Pp��WՄa@���d���o��Ɣ�M�������nªJ�\��bu�k�^A�K P��*Rh��|�Qi�2�6sP@�R1��z=����xs�Ԟ9�"d!���Gy��)}{�t�F���S��e���w��e|�Y�ζ)���1�bq|Qh�m]�ru��2�މw�{�~Ԣ0l�y��賈�?�(H�Ӷn�X���� ͏(�j�lFa�o>�3���ç35�}G��<!�����NE] +>�Wˠ~x?�]� L��(����4&.nD$(�W:+�2�癑���'��g[X&�{:Z��zŜAZC�Yc=�ZX�H����7ʢ;c� ]P3� 2ׯ��sꊜ��=9]�C�3i����qe��09�BN#�)d+�D�S���B$(�����1�2uv{�*�� C3#��.d�湢h�Fن��2'b��P�-�ߗ,2�T�z��?�q�忮�%Ը���$(=SaP��R�\�O���L��`�4�s�P��MP��vs��������Z�� }Sbޅ���e,�Z����"���E���}�:����Y�l��2Oi�G==��I�L���7e{�(��-�%Y=��g��eQ���� ���wr�mV����L,�i�*.����3���˽��6�|Y� 根���xT�|GR����[�M��8�4S��fW�u�]�&�}S�<]*�8b*�s/y�H�'W��"a���l/�.����/y�#��n�O_AI@�X6����_x��r-��Ӌ�pE.]>9��5p:#�����E������اw�1}Z�P�2J� �w����Z�f�$8��@�a,8����b���o����9L��X>�9�L�Z��r~���ΌN��E$.� �Q�X��H#���&C�x��{�P�k�����t�����������5)p�캆�����8���x�-R������~SKԅ�7��\��=���2~B0Pz�vR��l\� ��:��#�8��*���U�́uI�t<d�J/^g/�D��BCN"��Z�����9m�v�c:�<t�Mo�YS6'�u ��z�E���S<�+��zB�<����:� oz_��7w�a������u+�"���+��T�C�Z>��Em�X�lدhA�%}���t���)�<���t����=���36̗'0����j���@�lk�°�!�%"��G�X��Ѕ�+h���]���BǛ� ��F���!bu�D����5G�4����� I.��T������f�{t��!��>D)��+x��P��S��fV��5s����7�{؝�t�ghT��`�UANM�n�F�>2*� =�(��m����7y[��ފ���*�8 ?���{q���,+R�T�=qۛo�ůx���Ú��fM"^�r��i�Z_���UvSZPrg:�1'���GD�!�9:9�i��#K��o��M������_Y>D'J)�im�P�<�#Hm����pI� �4Jz9>^j`�U����;H{)��7*�NO8��*f��Ǖ���V�pe�#'�ЇW� ��ʾ�gU����DM(�m��Lk�<�wn+gd&��ܡ�v�EG<�����x�%ߧ��\��$�Sԫ��hi�����������hn�fHM��4g|��I���B42� �K�}7%Ol�x�>8��Ɯ����9�Σ���SeW(T��>���.������E�!v���Y��5 lG�9L�|!�&xސ��M)����q�B�:g��l�{����Cj&�x�n����7�9|;�)�;ybjcl�1�l�gskĭƄ:�����$��ڃO��BYQx��oF�{�S��moc��"��E�AB���9����Xam�p�y���~ѕ"Q}ZyI����^����g�T�e�mKF�;���*A1V����/�Aϐ�Vr��T�T��i�)�dţ]��j��&���afXˍt��2S�g�P��I�1+�-5l�s��d`^�`0^�Vax��&���G��^'L������i`Q��|�*�7��+8�^���p١R� �{<��%���Xb��!`�"H~g���w��u� �����%��M:*p�\D�@�-��FTȘ=��B��wB��jw�Q)�`�(�kO:����.�2�� %aJh�'7��rk>�ޛtS$�H�`ډT$jڀ�j~�lif����]Led�����&�)�tQ�GP�������敉*}͋81[��,��|�����-3��1��u��n���!��S�I��]%�^�nY �Lr��T���*�����i�6]k�{�f�"��j)�;}.�C��@�� @��PC����Q���R��1<��1��XT��R�j_l���3'�U��ԣ�>�� �Gu)��06D%s����hbg ���+�KД�C��`l�XF5��l�(*F1:�����5�D�9=�[6��a�ջ�P���M0���e�R�������l��;A�C�Y rl�*!;:��q�_fL���n�dl�M��Ûu��V2��?�*9O߾Z�P�˞���0:^�g&������~�!zv��m���7�!��R�E�NӲ�������e&����cΤrȱ� us���&��ǁۙ�������4We��(Y<*���wVꚞ�HF��t�����j /���ޔ��ڵvd�5���-�]`��ͫ� �c$�2K�1�@X9��NA
Static task
static1
Behavioral task
behavioral1
Sample
e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a.exe
Resource
win10v2004-20231023-en
General
-
Target
e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a
-
Size
5.8MB
-
MD5
f703d0c1bba5031a46b5b6e3255adcf1
-
SHA1
7a8bcbb259eae6be1853dd415a7f398237199197
-
SHA256
e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a
-
SHA512
141283a2a97bca1cf37fa9a48afe9d0591c72c3c02e41fffb810293d46ebc401f7a46267353ec9c08089f32704b1bb1fbf4faac19b5e371644962021d3c01c40
-
SSDEEP
98304:u4ozkICynsGJO3yOiQWgCmXt0yQrwUYmR8mpVMAHxESdxLH6TwFQtBy9IMN:6wXyfOiO2wteLYmR1pVMARENTwFfWMN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a
Files
-
e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a.exe windows:5 windows x86
253916c5ab8f11eaaba74e3e8755ea17
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetUBound
advapi32
RegSetValueExA
user32
CreatePopupMenu
kernel32
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GdiFlush
version
GetFileVersionInfoA
mpr
WNetGetConnectionA
ole32
ProgIDFromCLSID
comctl32
ImageList_SetIconSize
urlmon
URLDownloadToFileA
shell32
SHBrowseForFolderA
comdlg32
GetOpenFileNameA
wsock32
htons
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ