�KL��ܵ����?�C�1a�:���{]@��A_�L���ګ�,���N!Y�9,)�s6�G��+��{�&/3� )汯qO �O���ggz����J�C/EI3ɨ�bR����>�S���8� Y4`�2��mi��/�bi�() ��퇚T�G���E}q{�G��M6�W��v��ZOҰ�*���6�����Y`��oqF�,qy�c�Z�p���7{T��L�B c*�D|X�mU>6�jA\�=�P'�?(*Zl���z� ��lqE*����o93>����X'���f�d�A��9 ��v�3�R�?�� ����l�P��JP�3l�W�nP�ߊ2L��uO������ֶ�'���3,\bF�{���ح�y ?i��h&��E�qv�S��&P7EE���S��(w��$Vҙ49���t)<@r�0^-0}P�� �W���1Z���;���F�� bn�����v��33y�j��D¢9}�3� ���z�wnU�@�ȻG��E�ku�Sz�)QSj��X�h����<�#�Ka��k����&��O��hB���B(<�[�m�#�|����9:m4o7m�s�Q���d��b���8��h��Ʈa�v���{lGю0>1J#�=�s���1�!���Ņ�Q��<��K �y>@j�z����fE2ሟ��N m:m��*.��*�o��m����lt�j*�9������~�����z�-tH�$�PH)"�+ܧ��[+D���.����t�`�AR�\�����;��uq?!�� �s ����i{t��^�DG���q�aa�L���G�? ����zP�w��!���Y�h�?���,��{K1(���qN/_}�%�"k��|��zأ��Ḽ�̠�����F��RoD���*n|axqJʨ汭���0���/��rX���* ����!,ُC��F��N�9ZL)I�~)� 7�� ��ks���1(��ɱްȒd��ۃ}s��s s�qmnv��`�0 QY�����2k��#�x5�q��Mu3�]N�^��~���݇n݆ M�V�ڀ���G� QD�g��A4s���c@W�~:M�$1��}ٽ��������L�Xκ�)��-�ݭ�|�{��g�����.:�.�je[��Ί�$MRdm5N�q��j���XQ����>C� �Q�$���B�ɜ"f.���{L��Ӿ�sc�*�T���4���?B���m{��T͢�Ae���t^`���H�E��� :�3)G��� ./G� �y��H�5ȝ5ۢ�@� � ͏r�b�co�5�#C6�����G�Y� ��H�'�lP�h���p��?��I]CL� >�F����3��U�%[������+� �{����� &���#�6�����a��Z3i�.�� UI��dwTK|���r�YX)��kG~����8G�xBr�}��Q��llV����H�K��v����ô���f: ��(�KCq(gB+�=駘��i��p�:��(r���w�}p�;u.3n��rx���%.����{��1+m��x�%��g�Ŏ�0��&L��T�4�W��������D3!i�Uӫ�.�ѿ�nTUM+���)������g�I|���:pg4�nX��S(�������V�N`�z��ɟ!��&d^O�8�B�ȄF8�'�����_@[�w�щ��3��%G�z��J֩B��G��{�1��[�&�߂��=�FD����lB�w [ ��YU�z�ӈo��qٓ��V�#%]��~%Q��X#�=@:���X:���R����>���5 8��&O8fk�u���*�v�lT��u_���wd����Y�����bTB$8�o���x]r��Ь��pNM�U�K"���G�2�tl�QQ��q��ab?QT���##�I8'&10t�+�[m�9u�1S���Kj�^^������ޑ�vs3�nSE<�}������_���U�`�����{�m��n@{E��M�er̦ n�\H���Γ^�;&m��>G�<���2�8Ϸ����`%��*m8�֫���1!Ŗ�V�Q���A��Z����i��Gҏ2�`�y$M?�j(Y��Ŋ��W�E����@Z�ZpO�[��>e!��)Ӵޛߖ���Q��&�:�''?K!+�+)�!��I�|T�1�o�#kp��65>߅R�E������p��iʺ�_Qz,p�4�_������h��B }��3ס�XxA�d��'o&sn:4� A�Y��j��p���}�0��%L�@Љ���F~�t��`���&8�^�ݭ��]Ǖ���k�e�4��1�B���L�O��v�H�1��#2���~Ǧ������������WU�Lg�i�-��r��`+������G�xF��0��@����xd�ʢ"�[r&��������Ą��}�'Q�&ԌJ��}�<��uXs6��O���:>�(ÞE��ϥ���F��櫼��h�����?Ḛ�RI� ��&�aA%A�6 � 7v����G������:W�W�p`�����1�~�L����N��k G��hI�BmnIO�1ʢF�o}D�+**J���WU���iV%d��C�gS��@p}�O�q9���|��l��UJ��u���k����O��N�m,m�"9��gN���~�"�'\�p 8w�~��96�B+�� I/�5Rt���*�t's5�((�3�<| ��(]��b����Ǚ�"�c�# s���O����:��,��� ]j�Ÿ�$�Fe*�gJ�[+X���ΰ�������*���<"n��շ��W��2|��0�`wH�������n�����~qo��C3 Ϧ�Yz��" 9�s��o?�Wئ��5����+��fq��1(41�Q�����3�=���� �es�~��;S�t�k�����7�op�ڲ���3�ի� �ut��6���x���9�@�h��;)�fTc��z)� �ؚ9}�gd���xz�����3���?��ʰ�-Ӥ7yv����<��W�u�������5OC�8>6d��G�3#~j���:���w#~�7!M�x̆�$��%�@L���ŶL��4s庉^��!�}`�M�][x�
Static task
static1
Behavioral task
behavioral1
Sample
0ba768cf360212d7f6339a54a2e3aa1790f21b0586d427938d1dd20de3808dbb.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
0ba768cf360212d7f6339a54a2e3aa1790f21b0586d427938d1dd20de3808dbb.exe
Resource
win10v2004-20231023-en
General
-
Target
0ba768cf360212d7f6339a54a2e3aa1790f21b0586d427938d1dd20de3808dbb
-
Size
6.3MB
-
MD5
df835374b8d71544e0d12440d993f472
-
SHA1
7092ad8b7614f2ea6b5c2f1af51f2cd289187b7c
-
SHA256
0ba768cf360212d7f6339a54a2e3aa1790f21b0586d427938d1dd20de3808dbb
-
SHA512
4935dcc7c98c85ef5519f771a700e67091b96cf3d1584cd91691893f2adf859feadc5270687cd1f62417d28be49b564ca3aa1f2d1713dc47104f722590562f6a
-
SSDEEP
98304:Yr77JqudoLteYpx/9AHhIXm8A9FJvN7qx7wf9ARaReyEFS172Zbq/tByFSCzUg1x:y5oIY//eIk9FhNWx7w1AgZEFS1qqyZ1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ba768cf360212d7f6339a54a2e3aa1790f21b0586d427938d1dd20de3808dbb
Files
-
0ba768cf360212d7f6339a54a2e3aa1790f21b0586d427938d1dd20de3808dbb.exe windows:5 windows x86
5a59892663736d28c4f03b77d0ddf338
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
LookupPrivilegeValueA
user32
FindWindowExA
kernel32
FindClose
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateDIBitmap
version
GetFileVersionInfoA
mpr
WNetGetConnectionA
ole32
IsAccelerator
comctl32
ImageList_SetImageCount
urlmon
URLDownloadToFileA
shell32
SHGetMalloc
comdlg32
GetOpenFileNameA
wsock32
WSAAsyncGetServByName
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ