�SQRG#��.�� ���\o���]V�q�w �;D@MD,�{��,f����J��F���� ��\�֧�;/�|� �I/���ڌg���T�<aOK�Ђ��S�}��G1�#a�a�>��� 6�9;$�w�(c�>i�O�p�I�̃��[�"� 0�����%5l�g=)�m�Fǡp�'$��|�-���-���?�Z[��c��%��?h���xh� �i��#��4�iq���4�7�|L��Y]��Z����]d1 �T�p�9����Hk���,�h�r5�)��b'y�V�Vw��11�>�Vq-�{���%�ɔ�� �B��i��;��w: ��x���2�I�m�4�y��!�S�3 g��&�}ހ�ځߺ9�C�Ql�����b������W�o.[ۓ��V�� òu�e�q����b�J���W���$9,Qf㒪p`\��7�An�>��ND�wY���0��ju�.rbD"�Zj�����f����A$���O�I��a�����_����]"��oN;��^�������o��sO1,�t�嫁V�W�'{:T����z@�$ �DObaO������ۥ#��y'FK �P1���lB���cK�s�F&���ҹ�i���F���;�O\�h�����B��PW"ڕ�,o��n�0��Zg��yڊ���l��Pӗ�S��Q�x�M�:������9�]�� ��j«eЯB�H4��$��p�r�ӯ�����,���i���4N�ݢ�4��h��bՀ�y �������@��Ou�&�56O$��.�(Ղ��j � ��-:�SQ"n�WD#����|��f}��F�H��*�>.zW}�y�NQ�� ��ư��B�Y ��*-�����?`A�:���I�Xo�u��4t= ��%��� ���'�L)/�x2�J���\i��e4k��V��/d��M�5���C���~TO���z^�C#O�S�J[y �~���6��{�Y�(����s��A ��W����L/��m�y\schA�x�o$p��`�6!q4��;J�oE�|N�& J�o�|�ౌ���#\�o�k�/������d]rԛ2MLkH�eN�C�]����vl�͟>��yq{�Ģ�x(�d#�H��8����;(��:���r�Ȁ�FؘSE+/}M�v\.��i�A4�����_�>EA ��� vnMz�����dv[1��_/�v���?VW��0LO�va����^��������P�>�j��U�)L�=D��ꎢ'fP�%���� � V=](��۩vͻ�*.�Oi���7b�G�=ʫ�hz(��:ҽ3���g�V����:������ �|>yOS�����\�<�L��f��G��G7�H���r�̭cʔ��TZ����}DC�V��̾�����M�)�C#7�A[�VI߲�ڛʫ��Sq:H�[K��Z�� ���}��J��8������7�"=A&f�T ��|P�*�U���C0�q�%������X�I�`�ڵ�*�}�M-�u/JtM(��q��8+l�C�s����~�xXb���F�Bg� �ꃍ'I���9�Z��Ux�.����nT(�L @"�'9ñ WC�ב�E�/�Y�〕�) ��$7�v�]�V�W�Պ"A�l�0�(^�n�����qH���rq�Z��������a:���T �j�n�,��.>ނP�Y�F��k�|_�E�"�i���x�gQ�#+�B��L��f�P�Ϩ��*k>Mm������z)�Nz�2-n��L��C-jZ����Ճ0�x�%T�Yo�n|)Dd�A� "�g��S�� ;|<�~���Y�9f~�d�.���0__�qQ�4���W||���� ʾig�p���K��ʘU�?+�x�[&;�5-m�[�r�'{��6�Y���x��R�%��2 ��0���+�Α:ɵ������"^�ׁ�Q�F�E7�U��xs�yƕ�V��#���������D�R�)��������oP8EX�'���(��q�(#|9�&��S|��ƠkᖑlhF��&���?>�W&a�}.�>�b��8�M���lþuU��_���xA�h�Z�]v�ΝW���ꋆPy�(q��)r~��Z%�eVס6�ߦWv���؟#tzh��}Pt�9�J����B��6P�@�w�q�������v�&��(����J�d����I�lM�!|���7�'Ӯm!ڀU�bɘ=��p(�T�=s0�$9fc�~���!��Yo��R�öxMW���vY(�J���˞v���n�ͷ�2@�d �H�w��� I�N. ��R��;�%�w��nl!>��Z�l�Ҧ�Q������zV�.���Xc�U2�z��۔��y[�%>,����J:(9r:�7Z�^�A](�;p��̳��cv���[����n4H�P)����"����{��P�H�SWL� P���Jn��~cL�;�.F���n�U�H4�K۟�ˠ4(^wZ�����&�� [*�J���h�~#T{��d���3�y�-9&f���0����?�%g���l��hb�8�����b�ȴ�_3�����Q��mą�x�@Q����[�k.hizU��+FP�m7���aw3�:�.����҆�M��j�%��3���� ����e�y�uĸ�S ��{�&xٚ�����;F�Hv��+8�6�ćcG����V��c)�l��B�3����UbY+�� �C�#�!~�)Ғ>ӆz��W5V���ڤb��_k�F�H�Z;�E����ü�T϶�Q7�M���5�7��`�MF� �o��>\�3�kq���c4�M�8�����{YP =v��`����0�l4��[Ž������H���sĖ�4$�5���;��@z3���66rء�&�8�ŁA<=$���gn����H��Z��� ��đ�,�܄6��lL��%K�N� �� ^xm�#��y|υ�2ѱ��`��#ڣ��iW�O>�+0��Y$�i(VT)X��)E��L���j�?�S7Ɋ��NK�a�:�_��L+?;0#w7�� �=�1LS��G&bԧGA�I�H������h���W�3� ��gE�һZ��
Static task
static1
Behavioral task
behavioral1
Sample
72970cee53ad268db155557811ef07752ef4263933be4f196d6379027249d16d.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
72970cee53ad268db155557811ef07752ef4263933be4f196d6379027249d16d.exe
Resource
win10v2004-20231020-en
General
-
Target
72970cee53ad268db155557811ef07752ef4263933be4f196d6379027249d16d
-
Size
9.4MB
-
MD5
563c9900a860257b89f7bfd4d2abf01e
-
SHA1
c0634b2673f4add264d3a52bb45f5a29e58c342c
-
SHA256
72970cee53ad268db155557811ef07752ef4263933be4f196d6379027249d16d
-
SHA512
1cb4d047ddc439111c4112fa350a25ff6b27c2735fc48451f63c3eaaebc509338b5b08b4675407b8994d3123dd1e185efb50f1af1ba901d502b4a618ad2de07f
-
SSDEEP
196608:5U1K22AdizkGwKx0xt84T/yop2NuBuKaD+Qdp:64AWkGwKxeGe6oQNuBXaxd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72970cee53ad268db155557811ef07752ef4263933be4f196d6379027249d16d
Files
-
72970cee53ad268db155557811ef07752ef4263933be4f196d6379027249d16d.exe windows:5 windows x64
8b38883f00caa9c68a5db562e94f9643
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
comctl32
InitCommonControls
kernel32
DeleteCriticalSection
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
shell32
CommandLineToArgvW
user32
MessageBoxW
CharUpperBuffW
version
GetFileVersionInfoA
Exports
Exports
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vapu0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vapu1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vapu2 Size: 9.4MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE