�PJձ��G}G\�%f~��V�/�o!��M �Df���i4�$"����ɵ�6��J-�R��C���߮l~�AI4w�h��q�H1�3�J�����A������#��%���5�CǼ��1��+csY�T�$�'�\d��vEr�z ���'���g`~��h8���O�N��ߒ����o{Q��(���S IOP�����٭$kȊ*5"~��"���4�s ���Z�2�'A[*8�����Է7[h,�P�o�/�2 D� p��Ъ��C�$J1A���@��z/�τ:�5�#�2�Iv#M!�SXV5u�=g��aLs��N|�".�0n��j=`�Ł ��;�խ���<�Q�U.B,��#V&�7��z����>'��iN"�(�Y����*�gm<A��67�ԏ�;5AO�y���s=���T�P�@ (�l�9mN�1��L<��E�����h����]�<��4�4�_{�+�?5��f��v�>C�(>�ұt��7���3M�� z���6?�Abv`�O��P��ʯ,�<�����p[�t����4�!?��� Jףׂ4����İ��)�$/�)������T�Q����K[b>?C3z/V��g�HH�ʛ�MG�� @xBt���&b����f�x)L�-n�U��q p����:_�ź�e�mg&*��BR�qK1�M3a�~��d�/��7���ǣ�2x`Pv�q%���u~�J�*�+�$��e ����u0�k�콃3�~ul �`U�P�\Έܙ�d.}ԛiQܹw>� o�<M�-� e�0��$jp� v��#ei����B��i����&�.��fKJ>��'�Ӂ�ׁɤ��2T4|B�b���ߖȐ����fst/t������П���3K��h��q��B���8�qQz1q:��j0��5��yF�LpG���>Z:-Z�;G� %n&6?P��l�Anϟ��е^�O3�w6���W_a�ͷ�&Һ�FeK��X9�l�v|�]?4���b��ʼ�p}(�hPY�>�j}��\0;߾8������r�9�˦˻k2�F�J58T�i�/�Q�t*��m���ZT�.�!���J��|��U��@���5�b�����h�����'*�m�/���u#px��T��}��PuO��&@J�l�eD������Ȳq��:"��������� Sa��qAZ[-��ɾ��6�P�3���/��=$��X��G�cq�u��,3w֎�h��迴i_�����X�]}� ��E��������3�y!���>�]��sG�4��w�њ#��V3�# �/NJ�Q��6\�¾AF$YK���iO�:x��[����c!��FN�����������B.�^�{�A أ8"������7���UjE�����l'╃��;;�,x�=+�õ��VҹT4 P)���g���/�>MhX��� B������-�p\��(�C��-|�6�9�W-͒�X'�Ӊ�am8Y?|H�����P�pBm���<�R�����"��d�W������u�r�����O���h��y�����2�w�"����QȒ�6�&�������QXpe(�OiD�^Ԭ�^6�����U���*������#���e]aI�yh���W����A����OeF��PBݿ��u�!R|��'�f����GR����t���_��e��-���^�YĈd�լu����R��k��+�3����bB�w$��5��s{W�l/}��P��,�_��iX���y��x������-=�*�6���Z����A��o�0c�߉(�B�-��kֻ;�Iݭ��UR��($�"�n"��+ m<���������;���_'a/˕�6���$�*����"O�g���:ĝ�K�)d��+a��֓�U)'�kE|�����d�'�?<�zֺ�'��bVO��E�zɎ����L �e�0 2��ҿ)x��(�1E[����H��ɡ���Ԓ3w��z�O�I�ۤ�m'˲T�)n�D��tK��"�-j_ lG}IR6�S�:ә;����sX)W�$N�� F���[�N � ^4aU�p�^�� �gxM�K^P�����PUlߟ��52}�2�`MY�P��8 �l����4����l���^Ġ�i�@�N�~5��-x[ȟ�u&$���i�W�f������<�+�Y٬��0��olAC�,6�҇k�m�����9��<��s�W]f�t�?����h�F���@`ȇ���~RqQ9��$y��2�g{/�&j�g���� az�O���ӳ�Z��ڌ���#�栍:��M�z$<j�� rҾ[kw���%���H�4�����q�nÊ1�U�5���y�{d&�髹o������I^^�3��7$ez����_�:�҄�2T.�0+�A�"����㸎�35�ZVu����'><��{R�ng��P�3�H�(�5��xZ��߳oI��U�,��/bH<�b�B��.�k!�qN�yD�R��� ��e>gl��>�k����3+Ҳ����ۋW��6Sשׂ�����]�#E�����v5;|����'�����(l�΅$S���3��T����c+a1��{S�������>����C�Ixj ��S��.?l!�ڝH'��Mj�I�Q��p�Xk��`���H[�v4�g��wj�� �� Ӷ3������&?��j�e�9 Hjt� ��˿�O�^����!WPӲ���R�ʪ�&Z�^-��T�%�숸�Fi�ه]HnYCvE��_4�g��`8��]:���V/߲�XJ迈����y�`���#�K�n�v#�9̗�W�b�����|�-? OL��`� �f�K�� b��E����o~C>�6A��Ď'� �ZR*-{�����;�4��8G�i�� Mf��n�齉ml��A*v��g|IM�ڈ���6�S��<�=��%�&�AC�V��V9�v9�B�g���ߺ�r�@�۞��Ɲ$���_{�f�2Ǚ���a�,�"�bJ���+�b!/��Z�z���5\��Z�Pal�����R&�((\W��&�������X=��4n,�Lړ6KQ
Static task
static1
Behavioral task
behavioral1
Sample
047b0a4ff53beffa323e04cf87f469031fe23ae754cf4eba8a4d3311f6c46443.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
047b0a4ff53beffa323e04cf87f469031fe23ae754cf4eba8a4d3311f6c46443.exe
Resource
win10v2004-20231023-en
General
-
Target
047b0a4ff53beffa323e04cf87f469031fe23ae754cf4eba8a4d3311f6c46443
-
Size
680KB
-
MD5
813bef3b3600a3409ced9a8687411d92
-
SHA1
b146935d4c458b7ce27a4e274c1363a292551aad
-
SHA256
047b0a4ff53beffa323e04cf87f469031fe23ae754cf4eba8a4d3311f6c46443
-
SHA512
107a98aedfc934aee23e960046a638717cba4bc5f2649c10e87dce9fa52aefadb65c6b151bfe904da4eccc0352b441cc0f80b76a09873816241abbbf8c2f2f9c
-
SSDEEP
12288:zqfIbMPqoHD0yTgESRtlsapyGAfGfFiyJIMnDS9T40/hcYJHkDnrk:zqfIGD4yTg/taapyGAetiqI/980/hq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 047b0a4ff53beffa323e04cf87f469031fe23ae754cf4eba8a4d3311f6c46443
Files
-
047b0a4ff53beffa323e04cf87f469031fe23ae754cf4eba8a4d3311f6c46443.exe windows:5 windows x86
d37cf12d105e45e747a78e85d921979b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord100
kernel32
FindResourceExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 607KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 668KB - Virtual size: 664KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ