dPǴ:)_Ԫ��bWZV�VK�S���4�qˎ�e9�9>l���'?$�ƛ�Z*p�ƀp"����{��$�d ��'UIϕ�T�yk�Ws�/��d�EeԑN������D��z��f��Q=�$<�GB/���1LDѨY �p�������U?��V0�E6�� ���%��E�r9��Z���'g���t�4����A��_3r$���z��m˧^������"z/ٻ@Q��n���"��ʏ���]\�i��/�\�7;��6o��{�)�4��L!�*{�#���=���t�3��$�J�,˨�X�M�N�G��p�<���)��L#+�A��{4�SXS5���0���0���4ju�^�lS��Ja8��1��Xr�[U����dWlY&� as��d�Z�?��3"��T�7.Ӫ�@��#fM��]s紧�{������� �6X��<W�7��0=��YQ���Y�L8�u����^��$T��`$�n�Tmئ�����7l�߄۱+�_�������ӹ]� �;{4�������y�;'?I6�INۻ�I�< qwa�yl+O��)R��ǘ&v�ZdoG�S�[6�����j��M$�!p37Ʌ�}����}���V@���yg��o)���HX�M��_I��o�6ed���ȝl�W�8��!�ka��&f��i��t�����4ׄ ��.5-ޘ�@-W@2^ n�? ��O��ad7�_10-�$� 4.��o���ri��"�� 7xD���j/R��V.i �� ��-�����,;P�!?�f�ٯ���i��&�X2����/����08H"�a��t���E&�����E���G��͖���Њ��lQ��/~�D2TV��,"4��v��A)�"dZ��5u���닓���\�v����H����DZ�� � $=���nx�v�qP��G0�o�E�A�,xX%��I y��o���z�D����8C^L��-�#�~�<ߤF�9���~����5�o{콡����J�����W��Y��-B��Yv"%'�3�v:4�8�g6�T(S�?>��MlS�?���l��k�託����QAF��S���G�J�g+M`m�M:���:�{�~s�� �!V�)]�.�^v �A��Cb�n�D�8���vm&�hp��j\!�e�I���m��+�Kl�wЅa&�&!�76��_�7'av�H4�M��`Za�����骈����gbRy�%��L��2���=�����d�>9��'�q��.�0�6�7��^����u���e�u�AY�]ܷo�3$%urxo#�S����������)�����^��=�Aƭ2˘��2 L��t�6�X��(%�Η����ɉ�+h*��Yk@Q}�1PO�ί�~�nE�� �D�x�JSn���p����f�2EksT��:��=�K�:7Һ�B�pܓC��(�Y����$1ͮ�A�5����4��jT�Y�'��3@�u'_�D\_4# � �a��������n�n���k���3���S�oDY6�z4@x����D��A'�i�J���ո%���)���1��fH`5c��ڷQ�B������ B�> L[��ip�W߬#��qI����<5bc%*Υ����n=�$_#ih���W�Q��|]������c�I�$l�K��tG!�_U�g(t-A�[�0�C�'�B�?�ȍ�?F�Jz�"�;+������C���h�/JI���G�a@r��Sw������bCJ�G^�4��S̐n�C�d1�<��7�=��A�2vi_�[/Jh�X?��-��D�G�(�;.���?�td��͏F`u��J"����&��3�v���M;_��4�p�N��1<1U��am��c�41jR�n۪�ޞ����@"·1֙duV��=�QT�����2���'� �EWV�U���Շ��u�p�F��`�o�Zj����b��S�D���>�N2]n'���;��T��;����i�꽁g ��o�,���"�������M(�$I�]��ܒ�Y)��a9��:��'[Z���ޞ�dph�������^���I1��U��Lo�;9LNe/��~�*�a���S��ݺ?�z%2k=Z���t �X�f�N<g<��=o�R� J��)U@NîQmz�� =��E.8TM�6����^G�J�^�E�����o�!*#��E8eNC�B�����>��Y�K�A�����J�S0�S�;�i��ÁU������y���`H����H�؉��;^'��*����l�1�Ѧs�M_B����x�8�p4����r^x-������� �uuL���ϰ��������b4�y�=��%����[��lB���E�J�n@y1)|��=ܥCoR���b 8����Y\�Do�Q����vx�&&� d-nϩ�t�����Ԉ�˾�X$R�8�Iw��p6�À����?�0�wg����� %���zw��Jl���ET���%�d�s�դBG[O���`O��M���U^R�3u�xlX�G*e��σTU�B#���z�H�f�# .v�U_�u�s�@����$%��ت���@�Ei�\���JF#.���@@B�3�b�����Mp� ���03�Y ���H�q�o�2:Q�4�Ö �s(�Ɯb�fH$�|y|sV0l��͌���Lu%x֏�#�ЕbK���ދ�f䆳�����V[��ě)v�Bt��.[̀�����/c���������A��Ӝ�u��%�$�+8�9Pq@1皸�Qu�Ԋ%����B<tTS����^U������AzV>�*��>�e��2'���BW�)t����W�+�J���Zp5g��6�\q�]��<\4/�0�zХ����U�������fR�7a�@7��J�:D1��ƒ��G��#�;�{��Vp�8i�a0�S�Rirn�kV���C���oJ�t�GUC��Z��T�Գ96J��N��,������yF�>.X]��0��0h��e�F��6�~���+����[�C���1���LZc�/����6�+���Xq,�������4��J
Static task
static1
Behavioral task
behavioral1
Sample
e74ed0bf9b20d57be947918bf2c7829e31fee15f12f903f1bb10838f93e05a9d.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
e74ed0bf9b20d57be947918bf2c7829e31fee15f12f903f1bb10838f93e05a9d.exe
Resource
win10v2004-20231020-en
General
-
Target
e74ed0bf9b20d57be947918bf2c7829e31fee15f12f903f1bb10838f93e05a9d
-
Size
7.5MB
-
MD5
be7902447ef2ecfd7e06d1743272388f
-
SHA1
bc6727214403c96dc61d7fa9986bf492fc51ee5c
-
SHA256
e74ed0bf9b20d57be947918bf2c7829e31fee15f12f903f1bb10838f93e05a9d
-
SHA512
9515f1a2ac45f7cea5b034cd3140704a87c8bcd5b809e1519ba054e4bb456a261e15b0e329b7453029e4a70494ea8a0eb834b00b86490b2aae5161c18af21bc0
-
SSDEEP
49152:CxXSUy7FNMbQPPK/3dp8GXt2I/9dYoUY5sjBlMJRHQ37auZFBwTpkWcrEYSWasgR:OSnXPceZFBJS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e74ed0bf9b20d57be947918bf2c7829e31fee15f12f903f1bb10838f93e05a9d
Files
-
e74ed0bf9b20d57be947918bf2c7829e31fee15f12f903f1bb10838f93e05a9d.exe windows:4 windows x86
bffcb3f546c62b58253e57c9c20b3a25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoA
kernel32
GetVersionExA
GetVersion
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
comdlg32
GetOpenFileNameA
advapi32
InitializeSecurityDescriptor
Exports
Exports
Sections
.text Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upxk Size: 300KB - Virtual size: 298KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ