�����E�?*��% 17���_�y���P�Y5�qu�I���<�q����N��*�*zX����Vۜ��n@]��P�*V����|� �L�T�����G��|3Dm�x4���+���ZB��\;6J6�ۘ��G+~�R�O�7S��Z^�T9.[��Pw3,�v���Q9�����<��R�wۼ������9����%�=e��Rʱ�TDN�!�4;ߢO �#��H���_�`���V`���cX����&���BrU�f�`%�����[�|�f����]�H��� �eR�ܱGd'm�M,!�;/":�B�J"C��;*�$��I����W��c���|��)1���͙ S���'��{ןQ����퓃��1����S���)}���C(�i��g|]3i��9(W�nL��� ���PŴ�����UK�������5kD��嬟�c'�2�<����&��@��R����[ѡ$;����|�L�gt�o�_�h �[=������>�)�ѱ5�r���6g���3����� ��Y���L�[��"9;��BX���e4��LK���f0���� YK2�� ��}�5dL�6\u6-����%���)�,tL�al��a�{=�Q�Ġ�/ʼn� ]�R lW��#�-�S�g��gr�$F�q�6��àtGt6����i���X��&�#�4�'Y���Y!�.m2� ��������c\���rD=��,���������d�NC�#�"p�TTV��?A'���<0����a�����*�VU��>�w���7)�M_0�'nn�"?y��=�/�O�h��a������RU�8^U��� �E�0#n�87[Hx����e���4�o�\���/�K" �.��RS��Ko��h�̘��|�s�����G\�������\}H+�����.7���v����F����P�g�J,�G�U��ö����,=��(}���s<�O�����_�+��>�kX��ef��x�Џ>�l�9�+w�-4w�K��F��J���ѢX�W�TL/J.�f_)�o&����� �lT)�ӄ|g{��։�M<Ah�k�/���sf <��O�9���� z)�\>k�����p ��!^���X�Bfc�_%rr]���Q���R�<��u����#���߸K�dP�@�4]���m<�H��W��)I����}��� �k�gp6����J��\���1�Im�Kv灪�����r���D �-�r�066�*��-2f�zY�J���������k]0^b�w�j8��V510F@3$�t����\O��PN�����)kk|YЊz�f�/b�E���4/'O�3�� �:U[�>bw�y���~�ߙ�u�\J�#����5�b���N��7��α�;���a��b!k��0��������7�I>�X#Y�Q���X��.����y��G�WP ����DO<k��]�xˍߪ"8�zs}̇>!Y�����`"��P�=�p�x���-�co!x�.[!���J�D��X���ÙU�C�O��v�x�` �\D���� ��x,ݔC�;t[�t9 �`��7�L<� r�{�Z(HW��l�r�#.{<�V�$��x��xK/�]��G�T6=�+W,T���W�Nh��|L��G������BS��Z&�O��k\T�Db�L�G������C�cT��L�,M����w��e�}ң�䓯xy���R5�:A`kh��:��i��anj�����eT�s�����h-�.�몲9�Eh=])�npW8��^�R@ò��bP̅� ��0U�qT S�����г�5_���k�c��m�|�);���E� $��+w$u���Y��4�0�Wz�;�8k���D�?�sUU���!i�ca�\�4cE8- ���g�94���s�IF�QO�h?�U�����n>n��7����г'�5Z���Q�;�-�-���f&i�5�,Wc�d��O����01I�%��n?8ԛ���kI~3(H�3 r�ťo�Cx|$��+~�/��Kv�hSI'�2x���ő��Y�:X���pH�\ �:����jn!���F��9��j����W̶��Օ��K��]H�KԢSU�(�� �6�[���9%g�I��b����d����v�b]F�-�y�3&P}�9:���JN7���#�.���&��OG���D���� �u�����{�ӱ�"��ڐ�ΰf�+��"z�Z�+��I�t/���8wyUB���3����v������8���駵H�#|.Tѕ�[w!,,/���v�+�v�o8{��A&��aMqP���܊~ЛTA��%gVUE�8r��z$�3���N��7?���}-�(�MV�V�bqȐ��u;xq$�d���o��"�A���{?.I03��"ܞ���|V:�`D��E7#�r1H{a�a�-4�v�ڿ��Y����U�(7��g~(_�CIW{�D%S��0�wWI�.�l\���� Y3��2�-��ZF�a��;SǺ���{�(.�5c�W�|�S<x�9��ɔ�zf'�7����:b������bk'��n��E�֯\�W�Ý� ߆ĢGM� ��|#�.���������7c�I��z�?B4��j5�i��g/tAK`QPc}V���#��}N�q@��$@�.�{y��$0��'x��R��W������X\�ph]���K�2F�O z��p�h��Tٟ���.��?=�;FW*7�r���d(W�c�w�AoW�s�O�J��r�X��NJ<#���x��g�� o�Mg��i1�T�?��j)�s�<��g^;?�\(��^1�N�s�7$�/le��������U�� ��L����U(f19\%�z11�O�������dž"30�p����n�(��p*�͈�R~�"'�8Ro]d�,7�@�f�C��[���0�$Dl�j�c��h�nx�0Җ(<I�tn+�Oj�J�s�BR��O ^�������9��c̸C��{f�kKn�U;b2��=0�!t��mF�[,�9R�w��u�W��2%�������TMڋۅ?Ǭ��ht*h���z�v���X��]���"&�u�����>��NV$?f�
Static task
static1
Behavioral task
behavioral1
Sample
12128fc81d85538d1ba64a0a21f8652c7115b10202d11655bc9ce52741128935.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
12128fc81d85538d1ba64a0a21f8652c7115b10202d11655bc9ce52741128935.exe
Resource
win10v2004-20231023-en
General
-
Target
12128fc81d85538d1ba64a0a21f8652c7115b10202d11655bc9ce52741128935
-
Size
5.9MB
-
MD5
6e69739cf8779e3519f2f1367bb7a94f
-
SHA1
e74387966654aee7b3051f024c54d4b07deedca9
-
SHA256
12128fc81d85538d1ba64a0a21f8652c7115b10202d11655bc9ce52741128935
-
SHA512
c29dc914de02737f7cff6df37a940f9d4be3ed3a42b562ee20824625dfab862f66ec1b96f723e2d05d730289addcfb1ae57d620d9d6f7a9b4d46c090bb0e01d1
-
SSDEEP
98304:o3Ei+mFKv4snFlScO/9H1mI6pqFtqS0qsdnj57qSaw4JbmRRgIT/svVO8qw5RMzN:FaKv4sn2cmbBqSMd57qI4JyRgySVOBmi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 12128fc81d85538d1ba64a0a21f8652c7115b10202d11655bc9ce52741128935
Files
-
12128fc81d85538d1ba64a0a21f8652c7115b10202d11655bc9ce52741128935.exe windows:5 windows x86
c33397268540f878eddd2188a2b2ea18
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetActiveObject
advapi32
DeleteService
user32
GetIconInfo
kernel32
FindFirstChangeNotificationA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateCompatibleBitmap
version
VerQueryValueA
mpr
WNetGetConnectionA
ole32
CoInitializeEx
comctl32
ImageList_SetImageCount
urlmon
URLDownloadToFileA
shell32
SHGetFileInfoA
comdlg32
GetOpenFileNameA
wsock32
WSAAsyncGetServByName
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ