O��^)Vm|}"���{�'�{��"���Td��X�����S��ք�ꦡ���"LB?:iPΗ����A�R,�yDyW*�$9��=2�����K5�!2t ����[ʶ���q�� �I�2�Ec��W=;̍�8��l$OO�#a ��# �.�E^/h�"����h���"Wg�4�5�dd��Bf��������AX� ��`ѵ�OU�B���c6)�?�8}��.D� ���K���M]p{^u�kr�Й�I]�����놺4�ry$Q��ԀF�@{����4K9�x�6~�3|#���uR&G���s���P�f�T����:��>�k`��Xp�̦y�qt4��� fzm�qӭ�7_r's�pxZ�� +(�I�d6�Lc��ԩ���l��Ф���ŋ'C?�#�=�g[��Ur"-��o�oӁ9=�t;X�TF���U�>z�&�^8#����!�� n�bu���T��7}��:��Y�Î�Q��2 h��Ch8A����;f��5��&'^i6���=�B� ة��"��J��N��?l7(e�|`�!� DL�'-F2�p���n;��(�I�D/��P������-40�-W��� 7��c�ب�q�!�g0� -)ʓ����*C�hr�R��M�}891�ȏDI1�`n��W������'D ��A�op�)n\��K��V�r�MrĀ�q_�1����L��E�ǣE�1$X��H��d� =zs��V`�.���>El&젔�ݖb����:GDw��jiz�c�cZ]~c���-��5[D�����gQ�95�! �R|.|�v#���h(��Χ�8�n ������P�/_�@��� ݈̈�h����.0=�u'پ!<>!F ׅs��5&�L����x��L\L����!i�;�����t��EB�ϙ�;b�����.��rj��)�pMi|L���7`��ŶsusFݸ�Y�q�J�i�c�.Ҫ����P��UH��a���FW����c� �I�����o�Vه^d���[����nG��3�(���b��ݭ�Xҟ���?��W>34�p�F��o���봻 m}��ӟ� w@��h�ե7J����m��E6��d�M����6���f�WB+�1=���3Jو��r��x6���3�1L�K��Yd@��kj����NU+{�1BQ������PO��Wv�m�f^8ķN;�f�����}1`7��w���[R�Nz�k�4�0�&gg��#�$@�^��T��~��&��<s��k� m6��\����֞�Ɖ�����w0 �`鲮I���T^��Y;�b�O��a ��][=��9 3[:Y���V���]��,��E�{i��&���us�#S�R����iY+\���c�� �$��;�;D!/���T-+F����Nt�;t��\���C�1�)2�;�y�a|~��G����&��:BW.CxX��c���b�QѪe#J(@t}d� �R�c*:��%��f��(Q��GO2���NRwy����t/AD�T6�-�M܀^�=�q���YQP�g�52���d��B`���n��wid�w��~��=�i�i�Q�Rd�)�OӞ7�eIv,�W۔�t)�]��������_�nyA���;�I����7�F�]�ּ����Lk�������1*k ݢ�Z�J���g��,��d����w77��Q��=��\?J��B}`��\�m �Ru�W�I��ڭ6c&��%�E���iz8����JY�?�Ř��c^G� AJ������l�����qۻ��}��i��;>�aN=k���D��rJ��K���S,��s��7\�-�F����.w#{I����8�\�<�bW_�N�J��'HS���%axF�h�̈�/�qe5�}~g�{������a��m��Z�A6;�%q5�*�n���z<�����/�B��� �k��g�0���7}�I0G5���EL�4r�k�;���Q�D���k�I?Eq�&s�g3�eM��yu�p0Kl�F�4�Ɵ�����hB����x���3�٪u}]��H�mG�4�GWgqv��s�ޅ������s�L��� � �h>��-�T��9�!O��z��:.�.�� e5_j�`�m�C��x��K���^� �Jȇ�U�D����O�O�B �����nl�����%�;�߅��R�$}Q��W�m�_N�C�p5|@Ԓ��ȹ&K�~b�6�ʢ/O�ÿ���6ڤ ӱVR���� �^ֿ��㊙(^��rE��5��,� �W���#W=��'|R>�����r��;ߍ[P8���=�9�5�Y�=Vb�/�1���Ꙧ��d�Ԇ�"P��Qvd�4��̣}��r�S�wUl]'Xu�E�H���`攻���&�bta��s6k���zZ�:�\"T����L�+�p�r|���V�:�*�� ��J���a� /!M�%���̏2$t̪�( �r�����In�Q������#�t����������Y�������ք�&�q��X������[76���1S4���B�#���O��k`��|ړ�uv{��#̧�~�I;�Oa���VTűq9�Wu���HIQ�g��t���q� ݼ�W#���G4����\uNSA�G_|�ʮ��hY' ��0B���L��;��̬p��+�>�{P���E>,3���1����]-G�7˳�T��l�sl�����SB��;9W���q�J�L$�R�Ep'�D���W|A]��̡\LT���/a/L�^.�nƂࣨ |X��@�� ����� ܮ-���'ɟ8��N��M�Y�{�i��1sGI\vJJ��|���+@`�g��y�o�� Ț{$�7�~ʖ+}{�?�3n���%���|���ا�tk��r9��G"H(ŕ3'��m</��ɟ6)m������ $ƇQ�P?iC�B�}ƈ��,�����i�bX$N�4��*��p��j�Q�u�dwr�8 ��?O������@|VLsT�U ^�H�SWK��*���)O�U�W��#Q���ټ+.��$���M+^��~f5�K�nï��s���`eӸ�KM6*�$����
Static task
static1
Behavioral task
behavioral1
Sample
927649723a7ea848f92a2a1fba250ebe8837fa1d61e33cb6c3e282dc4dc5afde.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
927649723a7ea848f92a2a1fba250ebe8837fa1d61e33cb6c3e282dc4dc5afde.exe
Resource
win10v2004-20231020-en
General
-
Target
927649723a7ea848f92a2a1fba250ebe8837fa1d61e33cb6c3e282dc4dc5afde
-
Size
469KB
-
MD5
af5170ff53f2a198cad8af06613b5268
-
SHA1
85d345cf795030b809e4f38f7f8246aec2dcbb8f
-
SHA256
927649723a7ea848f92a2a1fba250ebe8837fa1d61e33cb6c3e282dc4dc5afde
-
SHA512
672cbd223c8fc07a6fc578ef728eeb8f79329cf2d648d8492995cdb9277f81642c7ae5d8260873331dc5654b4f92cd4195b13e73a61bf9e5f6da4b35bd3f3708
-
SSDEEP
12288:ho5vdcoTYDZYHo4uPCqRI8CvwCYDWxrJ0Q3kUQj:hofYDZ9q2I8+wCYDwJ0Q3kUQj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 927649723a7ea848f92a2a1fba250ebe8837fa1d61e33cb6c3e282dc4dc5afde
Files
-
927649723a7ea848f92a2a1fba250ebe8837fa1d61e33cb6c3e282dc4dc5afde.exe windows:4 windows x86
b355ccc8fb757b09ff4302a0c4338017
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
kernel32
GetVersionExA
GetVersion
CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 280KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ