��3[0B�W<�V���|=�����uEH�QI\�Pt=�o��I��Rje)+-��e'ʆ��tz�*V�r6n ռy�N���Vؿ��LQ�Q��ˆl�S�`㘠3z���ؤ��et~�x�Q����4Ɓio`~m�M���w��T�2�D��k?ln���a�H���j����U��O�Q�^�b�ee�Oڃ���ɴ�����K�$�Ok��Iv.�����,�Ѐ4��c�\{N�v��Mo�[ 6Tr&BZ^��`��(���ۭe���PD�e���6����.�%����MqeC���p��o�/��f5����&<7rD���/(���Sw]�u���6���=�?��Д\Q����� 4d���_Y1j�������2�;�������sOϖ*��_f\/Vf�Z��7@���]�Qh��T�*�]���,�����+�QJӻ�ݗI���$�4��_N`[�< �ۘc5ݣ�A�g ?�?`,�]$���.��d!2��'�r<q �Ą���Zӟx���B����ɝ3�$�q�_���3}��"��UP1�X��������ԱB5��bY�n�B8�"��J@��S�{}r4�]�H�ʸ����E���}�1�0 ��>�u��ِ�$�E�.���]�o@��^)��a� �&�����.�M���5c���q�ͤ ���" ��$g?�t_8���Q�n_�/�ӗ2�A��j"&ӵ�y~�1w�w�]N��9O܂�gJ��m��:�쁩�i�A�3�⣟qZ�G���xn}B�w)����&05ߙ����~�� �(�M���1_�:�z��F�a�\ OMJ�϶@�$�V���gub��f,��%II��?Y�(�x��헟��f���)B5|�<@�ő�*� �ne���0��!x�*��"&��+2����ex�F� uA��TV4�RH��}�� <�h\����!#*]�<��--�$��73�3����jsa#�]7 �48�7��W�H�`�xk�~�Xɝ���}���r����j=����!x�pRq���{�*|�]ؕ ��_����Q���<��BǺ��Ù����4oy}�roɟ���Z�����"��@���J��#���N�b,)�{��9�3�Da�(�V|njy����>A{�6*������0nT\�9���Y��.�o4�� ��u;���\~��� ��7v�/��{'h,���N�_�HR�B��h%��CUC<��f��|�o��aeA�3�c<RPd�}���3'@-���i��z�����~����PQ�5��5������t��~�Ck=��|�qLz��&Z�����1���*?{ ���,�ep?uI�'^C�9��0mˮ�$����o�YF� f�dr�}�0��,��[����i������"��ُ=�/d8�SE�K%��sr�wRW���MM#� ͔�Qi��R��-.{��q���8�a��a/݄�������eL������5o�p�:�0����n��o�`��*-�]m�C8� ���X�,b<�r�J��w7�7�֘5�"pv�d�Nf�Ϗ��E�z����E Uf�pc�������wV�Я��z��l¿)�#K��vn���͵�d37���.Z�K�ң��Ǐ\m���[��� �ə�l�F11.����2�@E�&��Z"� ���2�S#����F[���L^�ٲƪ�Z}�e0�\�MK�3 �/u[1��<�� ��� �Ȕۥ\rVdGqs[�%k&sTR�*�J!�5�� ����m�w'�8���"q�����ADC�!�[�l{�E�RP���]T�4������9�3wt�R��b��(���� 1�:��Q@0z� ����=�P&Rȳ����gf ���R�C��_]���F�7�e�2_v{O.<� DMr0l����m4:NO��2��l]�݇K��a��l�_�S yO�,�;c�òb涞Ri@�o�L�u��>�]<���|�)�r���ѡFY<,y��P�F�� �/�ͪ���%�ƕ}��T��Ե�Ui��/�!DP�֪Pd(�9�:^|�G��x/o�M����-��q��6� �Y�w�ږ�� �3�;�TVff���f��e��b�v��4����Dy�d���,dn�G�dt��[F�I�P�y�*>!f�r]g,� �z&�bˍ�{5�M��2�{���`&�F&��;�3ZN�˘Uk�!ě��8H%#nw���H���EAk�G^6����Q�� ������i�V�Hp<_3�������@�! ��ѩZ�����o�.5�9I��p�,j@1�X��<3w#���XN����p{��Z;�B��� &T��!�,�N@Y]EK��``x;�gy���t�뚥H�Ij8:ǟ+�h���w0п���.W��K9ᖥ�c��Ѕ��Vt �G=�-|ޓ�����w�kxT�`.�������S�PREs�x&ʰ�� ���;����Z�C+E����g2t|Z?�X-�����X��=�� N�7E5����#��vw'C�.#��!g�4���w%�c���a�1��{�&6��W����<ö�^d2��a{ʂ��yB"� ��-`�s�,�AOD�3��֯+x+#"W�a�V<!����֫Ͻ�%u��Lz�H����2�t��T�pN=/��>2%߲�']g����ख़^�w��8ӱ}�Y��V�G��7���&��0D����J��hB�,���=��!�qP�}�q@���`_"S]j[ʹ�9�c�n��ю� �������@h�M/�MNE������s�����(�J�RD�.3'�?$O�G5�������×y��<#�b��t�a��$~� ����^>t���^W/�6���m ��K������{SjE� �L0j;��8Ä�dS�yR��]L� � �N;����0�o�f���$�6b)BW��}pČQ-W$@[Q�$��w�'fb�"Î�e���� ���X,Pc^_�x����Ĕk��U��T�⢒��_�S�g����܅^�Ef�<A�X�գ�cp@AN�sR[�7)4�h�����
Static task
static1
Behavioral task
behavioral1
Sample
ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137.exe
Resource
win10v2004-20231025-en
General
-
Target
ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137
-
Size
14.6MB
-
MD5
c90e6d8aaa8c4f7deae7f09ca2fbf3e0
-
SHA1
bf6955618bcc5bbddd732b5fb0b4d7be689f2c80
-
SHA256
ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137
-
SHA512
df8baf02eb192edc654b1f7a8086ccef25292a804d212d00d0abbeff69dbbb4330d58cc63c8331119ec441c9ea0cc856888509ae697ce9624c2efee663d15705
-
SSDEEP
393216:C9I8YV9Q+nB3nj5uAOHXMBlwWmj8RsfxU6dn:0I8YV2iFuAO3MBlwWmI+pJn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137
Files
-
ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137.exe windows:5 windows x86
c721071d791863ff1fe04b88d7ac5e84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
GetErrorInfo
SafeArrayPtrOfIndex
advapi32
RegQueryValueExW
SetSecurityDescriptorDacl
QueryServiceConfigW
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
user32
MessageBoxA
SetClassLongW
EnumDisplayMonitors
MessageBoxTimeoutW
CharUpperBuffW
kernel32
GetVersion
GetProcAddress
GetVersionExA
GetVersionExW
GetVersion
Sleep
MulDiv
GetVersionExW
IsDebuggerPresent
SetThreadExecutionState
GetLastError
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msimg32
TransparentBlt
gdi32
WidenPath
GetRandomRgn
version
VerQueryValueA
olepro32
OleCreatePropertyFrame
ole32
CreateStreamOnHGlobal
CoCreateGuid
imagehlp
ImageDirectoryEntryToData
comctl32
InitializeFlatSB
msvcrt
isxdigit
shell32
ShellExecuteW
comdlg32
ChooseFontW
winspool.drv
OpenPrinterW
GetDefaultPrinterW
wsock32
__WSAFDIsSet
winmm
timeGetTime
netapi32
Netbios
NetWkstaGetInfo
opengl32
glDeleteTextures
setupapi
SetupDiSetClassInstallParamsA
oleacc
LresultFromObject
usp10
ScriptShape
oledlg
OleUIObjectPropertiesW
quartz
AMGetErrorTextW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 20.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 327KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 850KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 264B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pmd0 Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pmd1 Size: 14.6MB - Virtual size: 14.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ