A��;���2{6��"�,���k���� �����2�md�D~�����B�)3��7]���O9���J�6���aMzN��DЀ��<~��� ��d����w�U���r���q�W�i�-9�ؘ4��$o���ǂ,6p"v�U�F@< s�L�;��U��:�g��=��[�蝒�˺QJc䬍+ �y�B�J�����k�� �}��x���S?o5��q������S���&5P�z�S� W��i [u�I����U1Gc)$" .��Xz�5�#�``�8��z3:��xR���� ��b�|v��H��`ѡB�ȕ�X9L��-_�x�;��+`��Iғ������l�����A3�\s'�7�ii�\�Ch �ڊ�n�&�v���4kY�2~�=�{�������l�n2�f�Gy*��Y�xmQ-T��J����ک�k���y �A�|f���ֽ`��a"�� ^���-U��ݻxa��sG�q��)��<�h5)�F����;�A�K]}��w�z���M���Z�������pz�V�����+<L1voyD���qnD��1�%MhH f'���v�H2��1I�����*�Fi�n�&NDdI��@t�����P�2u ��a��#��d{`�Xǁ���0`Pz��9��4���t��u�X'��h-����"%�㤁�I��ﹺ��<Ǟi<�4��F"��)`������}%F��5 V����0[o�p�q�����Σ�d�?�ivk�7�Y»h#��{^u�n-��e�s�.)b�'�}�7��,`�>6Ӌ����D�磵 �9������*��Ϫ�h~�~�{%N�j�G&��rʴ�i��1�?A��[L����~g?�F�Z�\��e��!��F$_頔Y7��ό��c~-&_�K;�*���:U��Pl�_��^������UK���L��~H��� ��e� 0c�����"v�h�������lT�3HJ����-�N&��-�O����u��[�]��jw�}���y����?�Tn,���k��5�k�%a���;K����K��TdpB/F�ɦA��=/����B6R8�o��d�/8���Ho��b�E9uH���?����81P��b�/Nv|ל�o"Q�����Cze��[,�#��J)/h�WL?M/f�Y�]����먵e@�N{�����z��C�! ;�O1��\��c�v��G���ӛ<Z���Q��oli!������,��l���1!�� c9�7���kʇ�)V��q�ӁI1粂QRad����,<RhN�~iΊ��r�@s���W�䃕:�{�F���˽�RTΩ��R��̎(�^ l��Ær�73�Ma �� ������"C��4��|��5��Ā�г�y&�o�4 ���P���o��9Lv���%|��RR�Y\9ϰ�����>�У��� � R�8�W��+OF���cWo�)s���_�&ͷ�LY9@^S4]2�,;z\�)3�4��F��aeβ�ڬo����C��]���0�]��������צ��݊��QlX�F��E��=�ρ����w�fԋ]M�.��e�:�;l��pv� +F�zq&f�5�%�~� �l{�t�α��yCz�����ԛ4M$�$8n'*�o���pO���{K�������/�����.��.����#��ȡ�ɧ�r�o����m�)�c�qld�@y��h�/ˣ��mj ҋX2+ڤRވ1�Y(��Ƨ/A��J��|�b���-�-?o,F�|y�.���L���M6�bΗ�d�l�����F>�)�e�~.��-_��6�� ABr]�3��7�u�q@��j�d��G�-V�t��I@@�w��" �bȫ���F1�[y���ef�����03���m0��lf:�A�<������z�~m�Z���TM����),bJW�r����-%�4ھ�\��R��5U�mM� ��A���� hM� �2Ҵ�&X��JK{4�XN�X��������4����+}\�ϣ�ޱT ~�Q��(��k�r�%���'�[�7�N}�Ӑ���;Rh$g~�(�3M�= ]�F]���pL߃U�34}e���u�I��8�:ɻ��`]i�q�Mo�#`�f��\�ws��E�H#�XYj�{S���D�f��$Q�d�i�b(*�^.kx` O�MOZ�>ƪ:wr���Ȑ44��g��9C���_������vl��#����P�Q��g����P1m>xY�^BHG�G p�%�@Y��.O)}�ټ��ho��&��ل����m�� �{�p3\��6� �f��T���!N��HS�:Yb��y'=���ߦw�+a�,NA@��<�ry��a�3cŒ0��T.VU��+̧��ijRd�����Z[�À���zd�̃~����� '{*�ו�m����Z�RcL���0�49O�j�i�϶1��I��Y^>�(�Up,�5 �������O�T�5�(UȮvB��e�b�Ndx�������,��~.y��7O�l�-��])�ݘ$2��ϹH�l�]\zE������%5���w� F�Cd�b) �A5����1�e�.�jG�J "Ԅ�@���?[ ֈ����aa��uC2�V8�e�$��jjՁ��P��':���Vg����!�e�����%���g�����&��*q�} E|��=�#�Q¤�<��O�#8n�����ƍ] fM���o� ǒ;,�O�УƟ�� ,K5��j����*'���s��E� �#[Um����/��Ѩ�sˋ�I���O��kU�l�nW+ؗ�����cs�T�7�z�±_��ŭ]� �\w��M�4µb�_��V���C$��?�D6泦� s�J ʫr���^��=S��8��=�`J�����������M���)����?I���b�- kz�"��R(J�t�D���٪R��Wj��ĝ����y\�$�����f����a������g� <`���Q�8��u��߸B#�0A��G��Q�B� ��g���ͬ �|���52��AH��$�&�B2M���_AZSh��Sb@P�w, ����]�3�Z�d!#f;��[����
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231023-en
General
-
Target
tmp
-
Size
2.8MB
-
MD5
ebbb6b44fb8c49c07118e3f166990ef3
-
SHA1
962ac99ed69e677cdfd86c6a2b4a838d1f63a155
-
SHA256
c4217be671746e2b5ddc35fa2e0f93e2f04724b3260c12fe5a3cf4b1f858aa60
-
SHA512
a56f564f519a5d3444f33a059538305d498c5bc12afc239b389aa15666d5defb6f5d71225915e8466e1e84a1b1c0d1a16eaee6d3e20d69c6652cddd70496f567
-
SSDEEP
49152:Xc1mOWn5MWhchQrObKh5mLm7e4YqOBT8JLi3678A0LuuQe45MHiC0qf7t5sX:Mt05MovrbhLehQJL7zJiHl75s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows:5 windows x86
d64114ab5be153f58ca4d290eb13f34c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMenuItemID
CharUpperBuffW
gdi32
CreatePalette
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantClear
comctl32
ImageList_Destroy
ws2_32
socket
comdlg32
GetFileTitleA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 661KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hd0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.hd1 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 785B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ