O��^)Vm|}"���{�'�{��"���Td��X�����S��ք�ꦡ���"LB?:iPΗ����A�R,�yDyW*�$9��=2�����K5�!2t ����[ʶ���q�� �I�2�Ec��W=;̍�8��l$OO�#a ��# �.�E^/h�"����h���"Wg�4�5�dd��Bf��������AX� ��`ѵ�OU�B���c6)�?�8}��.D� ���K���M]p{^u�kr�Й�I]�����놺4�ry$Q��ԀF�@{����4K9�x�6~�3|#���uR&G���s���P�f�T����:��>�k`��Xp�̦y�qt4��� fzm�qӭ�7_r's�pxZ�� +(�I�d6�Lc��ԩ���l��Ф���ŋ'C?�#�=�g[��Ur"-��o�oӁ9=�t;X�TF���U�>z�&�^8#����!�� n�bu���T��7}��:��Y�Î�Q��2 h��Ch8A����;f��5��&'^i6���=�B� ة��"��J��N��?l7(e�|`�!� DL�'-F2�p���n;��(�I�D/��P������-40�-W��� 7��c�ب�q�!�g0� -)ʓ����*C�hr�R��M�}891�ȏDI1�`n��W������'D ��A�op�)n\��K��V�r�MrĀ�q_�1����L��E�ǣE�1$X��H��d� =zs��V`�.���>El&젔�ݖb����:GDw��jiz�c�cZ]~c���-��5[D�����gQ�95�! �R|.|�v#���h(��Χ�8�n ������P�/_�@��� ݈̈�h����.0=�u'پ!<>!F ׅs��5&�L����x��L\L����!i�;�����t��EB�ϙ�;b�����.��rj��)�pMi|L���7`��ŶsusFݸ�Y�q�J�i�c�.Ҫ����P��UH��a���FW����c� �I�����o�Vه^d���[����nG��3�(���b��ݭ�Xҟ���?��W>34�p�F��o���봻 m}��ӟ� w@��h�ե7J����m��E6��d�M����6���f�WB+�1=���3Jو��r��x6���3�1L�K��Yd@��kj����NU+{�1BQ������PO��Wv�m�f^8ķN;�f�����}1`7��w���[R�Nz�k�4�0�&gg��#�$@�^��T��~��&��<s��k� m6��\����֞�Ɖ�����w0 �`鲮I���T^��Y;�b�O��a ��][=��9 3[:Y���V���]��,��E�{i��&���us�#S�R����iY+\���c�� �$��;�;D!/���T-+F����Nt�;t��\���C�1�)2�;�y�a|~��G����&��:BW.CxX��c���b�QѪe#J(@t}d� �R�c*:��%��f��(Q��GO2���NRwy����t/AD�T6�-�M܀^�=�q���YQP�g�52���d��B`���n��wid�w��~��=�i�i�Q�Rd�)�OӞ7�eIv,�W۔�t)�]��������_�nyA���;�I����7�F�]�ּ����Lk�������1*k ݢ�Z�J���g��,��d����w77��Q��=��\?J��B}`��\�m �Ru�W�I��ڭ6c&��%�E���iz8����JY�?�Ř��c^G� AJ������l�����qۻ��}��i��;>�aN=k���D��rJ��K���S,��s��7\�-�F����.w#{I����8�\�<�bW_�N�J��'HS���%axF�h�̈�/�qe5�}~g�{������a��m��Z�A6;�%q5�*�n���z<�����/�B��� �k��g�0���7}�I0G5���EL�4r�k�;���Q�D���k�I?Eq�&s�g3�eM��yu�p0Kl�F�4�Ɵ�����hB����x���3�٪u}]��H�mG�4�GWgqv��s�ޅ������s�L��� � �h>��-�T��9�!O��z��:.�.�� e5_j�`�m�C��x��K���^� �Jȇ�U�D����O�O�B �����nl�����%�;�߅��R�$}Q��W�m�_N�C�p5|@Ԓ��ȹ&K�~b�6�ʢ/O�ÿ���6ڤ ӱVR���� �^ֿ��㊙(^��rE��5��,� �W���#W=��'|R>�����r��;ߍ[P8���=�9�5�Y�=Vb�/�1���Ꙧ��d�Ԇ�"P��Qvd�4��̣}��r�S�wUl]'Xu�E�H���`攻���&�bta��s6k���zZ�:�\"T����L�+�p�r|���V�:�*�� ��J���a� /!M�%���̏2$t̪�( �r�����In�Q������#�t����������Y�������ք�&�q��X������[76���1S4���B�#���O��k`��|ړ�uv{��#̧�~�I;�Oa���VTűq9�Wu���HIQ�g��t���q� ݼ�W#���G4����\uNSA�G_|�ʮ��hY' ��0B���L��;��̬p��+�>�{P���E>,3���1����]-G�7˳�T��l�sl�����SB��;9W���q�J�L$�R�Ep'�D���W|A]��̡\LT���/a/L�^.�nƂࣨ |X��@�� ����� ܮ-���'ɟ8��N��M�Y�{�i��1sGI\vJJ��|���+@`�g��y�o�� Ț{$�7�~ʖ+}{�?�3n���%���|���ا�tk��r9��G"H(ŕ3'��m</��ɟ6)m������ $ƇQ�P?iC�B�}ƈ��,�����i�bX$N�4��*��p��j�Q�u�dwr�8 ��?O������@|VLsT�U ^�H�SWK��*���)O�U�W��#Q���ټ+.��$���M+^��~f5�K�nï��s���`eӸ�KM6*�$����
Static task
static1
Behavioral task
behavioral1
Sample
8a5f87865a598744aedc1a2274d5954bd236ef2164a5b8195b7be838db19649f.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
8a5f87865a598744aedc1a2274d5954bd236ef2164a5b8195b7be838db19649f.exe
Resource
win10v2004-20231023-en
General
-
Target
8a5f87865a598744aedc1a2274d5954bd236ef2164a5b8195b7be838db19649f
-
Size
3.6MB
-
MD5
7d711f57b35a86b60e49030ba8a3c42f
-
SHA1
3e56933e88f004976c43078e3d22698bbe25efb6
-
SHA256
8a5f87865a598744aedc1a2274d5954bd236ef2164a5b8195b7be838db19649f
-
SHA512
a6323deb1ae064e385f3646dbfee098828e3c82e8b63c5457ba3b637cdca2f18fc5d82e5a44dc3aba04c26606b042b6b706073ce09e242673fb9209f73397cc0
-
SSDEEP
49152:hZ9qWXCYDO4Vmj317F20Z2br3c9+51mym8wAXxKclOcSK0FyRDWiYx+9aZ6:hZYWX/rO317UM2H9hKcYZK0FyR7YZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a5f87865a598744aedc1a2274d5954bd236ef2164a5b8195b7be838db19649f
Files
-
8a5f87865a598744aedc1a2274d5954bd236ef2164a5b8195b7be838db19649f.exe windows:4 windows x86 arch:x86
b355ccc8fb757b09ff4302a0c4338017
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
kernel32
GetVersionExA
GetVersion
CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 280KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ