R�|��}�KP�� D��+c�+�d%�����-�hm�s�����1;��6EU�N��%C�ٿ��/2!�˝{L�r��� �A�7YrB���ϝ�ߺ�c�t�sI�'@o�ߐ���f/s�ťR}eI �; L-ſfV�n*ˆXs�a�6��8��X9fX��̬8B� -�\bj���\ot-q;,�nEp�q5��1DG�����W4�hh�4qK��F<�0�����Sh�5�����s~�t�����wac��Ϭax����QƑ��Ү���_��*� E���,`�{&���x���݈��hi�?p�<B/lܠc˻v�Z��9����c�� g�lr�I��L�`�C��yE,������Wa����+��/���w��+��m^�G���O�"� ����g��b�0_u��2�-:yŜD���U.����1�����x�\k�����4ApW.�$�p�?МקTY�it%Ȅ�".gd�� ]H���:0��^���@($��đ(�F鬓k: t�@�ݱ��槜-t�f��Y�w�|�=ܣ��}Tc��-:�x�6�W���Y<:2`Xs��+���2��2�ߡNZ���Emj�*�}BRC���Ny��.�J��������b��e��_�u:��b ��f� �gLsz>�R7�I(0�PF|�����qp��)�e#���T.$� "L� ir{�lo�N��(bM�֥1'���R��O�BuJ�� �j;��7E-�e��Ed#��Θ5�C����{Gr�Ġ� ��oU(i�V��~{�!��v0_�pni�AE�����ۦ4�^��==�.��X��9����@��<��z�|�7쎖d�*_�x��D��1��Hj��N�t�p*�O��_��g���fT�����P��}c/��Y������q�k�S_�Y�,��u����x�pb�� D�����H�$�����|���wQ����B�ѽ���9��o/��7�λ�"�����G�{U�v]���"�)DW�$��H�j��w��^�?O�E���i����`uX^�S�V߃�y���������?Egwb �J�,uwб��4ֹ��\�J�sπ`܋�V��po�q��B�|�&�^8v6��?w���c�Y1颧��Z�e� 0��䰁y���eo��t moL���#��fUGus�P�a�v��p�W�:Z�2���gmg.��D���:ǃ.�P���L�/Z�}̂H�P�>qW��O@Ν(*p����:)ϩ�J"Z'�Ct��ALj.����ȹ�-{�%�p8��>�������~�(�l%7_]��J7�� �����_��07����6������3�b�����"L�!� ��ZC�M�ʜ�%ၣ��0�r���g�pb����g�"U��iKY��Ŧ����L�����!Y;�Ur�n|ꃵkf]Y<ٜ����o�)��jWiU�C��O����C��E������$�2_���w;"2uG�F�$3���(��h���,#�@U?��g�'bH��s$ �ʲ��ge��麓��te�K�E��� ���r#f+;�@S%Q�����~�@�0+�B���y�v\��įײ�(V�;�>�۽�<6�6_7��\{�������e$H�RE�g���[��qW��ZP�~V��+]lM>:� � �Uf�Z$�Iͅp� w�QVs r&="���J�a-:� _q҅\~�/����օ���b�l�����(Wm����d<�;�m���㔄acq�õǚ��%f�y�]=��6���1I�Fl�aSe�/��<*���S�D���J��Tч��x�k���p;<EA�����wbn�!L��1puqt�͊�l�R�����2��%�ny���{<rwlF ���M�*b_cf���]�70�}��.��n쇫}�[w�I�#nr������9I�sDˀ�G���Ѡ�=����^�پ4wU�� w[ǂC�O��Y�iHhQw���������'b��^�e�����KN��}3���%�8�oI�K#�P�vd6��G��R8���������d79�2����`l���o����´b����c=�B�P8�,��:]χ�������̛/%Qt\��W:���=9Ir#�^`k8���|���ё���ٜ��|����?Ū�#KY�[�(�/���R�� �q)oRֶ>�/Q�l8��i�Vv"�Y�jsnT��}�d�x]��}�!N瞃H.��^0RejsV���Z+z �V@�]q�4 �H�i���z�+�=��50��)����2��RF�^�_#3��.@o�B�Scɧ� P<�5�[����<;�6_���3���ێ�-Ϟ7%(�\�k8� ��g�݃��H6wA��;�;���Iv�ID���4���Vf1'����X��J.R�<���E��v6d��;K����7���ߖ� ~��u`h4�v�����̃J,���V?���~H? � 3�kv�StR�~�S�V#a�W]�<9�$�@�ϺU_���Ֆ)�v�'��҇;���8n����s�R�{5 Hs�(0�u�ĮY",ue� vu�������+�a+编N�Q��ޞx�~"��@��B��\G�>�wR�BS5%�%��R�ē 2��[g��a�t cO�p�?�>��m^��պ���穿#�Y�][��E_y���x��m0K��`a�~`��n�G��� ߓ�vy����58���r8 ���������kF��fbЩ��� ����G��K�.����n����3DDzE1���U��yM�]�[����_P-e��_o{��p�Jl����_��q��Etq-/ڛV��Maؽ��5�,.]���:��6=T��5���@3��:y��ghR�����>$0�K���MK�J�y�s��i�ϐ�sf.²B�S�e{��HvY}7�4�EY�~��P ���tp�u(#�n�>�ۂ� ơH�R�`�)uN<B^٣��=T^Ή^�b��w�`����&^d6���s��8~�C���4�5���W{�>��`A$D.]��c�9��}��oN�k_��qU#hH����/w����U�]��@h�
Static task
static1
Behavioral task
behavioral1
Sample
485d7943740e1220fceec627d779fd3a5110a504c5b14c984a18e1123c44e196.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
485d7943740e1220fceec627d779fd3a5110a504c5b14c984a18e1123c44e196.exe
Resource
win10v2004-20231020-en
General
-
Target
485d7943740e1220fceec627d779fd3a5110a504c5b14c984a18e1123c44e196
-
Size
12.1MB
-
MD5
cf049a2edeb0bbb4e44752cd37ed27fc
-
SHA1
8d905d08a80dc98d3c708bb437de5678ae48e586
-
SHA256
485d7943740e1220fceec627d779fd3a5110a504c5b14c984a18e1123c44e196
-
SHA512
91f7e6207478eadc424fd63de745d2f64b732223fa19cd2100f905ca72ed9e37b2de65735d4b3c0271fcbc74a85be3526ed26c2d05547edc3a12ad03196cdd41
-
SSDEEP
196608:NXzXXgR9bKa6o6OEswuJxe8bjI5lE6N/W5jmmPs+X4KAaZnUGFibxf616x8IAT/3:NgVSLsVfXg+VDZolnx8IAofN+pyZkXv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 485d7943740e1220fceec627d779fd3a5110a504c5b14c984a18e1123c44e196
Files
-
485d7943740e1220fceec627d779fd3a5110a504c5b14c984a18e1123c44e196.exe windows:6 windows x64
cec5c3c2bf209712a73dc9f2949ade86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
CreateDCW
msimg32
TransparentBlt
winspool.drv
DocumentPropertiesW
advapi32
RegDeleteKeyW
shell32
SHGetMalloc
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsW
uxtheme
GetThemeSysColor
ole32
CoDisconnectObject
oleaut32
LoadTypeLi
oledlg
OleUIBusyW
gdiplus
GdipDrawImageRectI
libusb-1.0
libusb_bulk_transfer
imm32
ImmReleaseContext
ws2_32
inet_ntoa
oleacc
AccessibleObjectFromWindow
winmm
PlaySoundW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 565KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.,&U Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.>;F Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.)lP Size: 12.0MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ