�+K5����cOG������b+;�)`n�f�vq�y��*��Fu��\9����Z�N! ��3�l6�E�rߓ&ۘ9_�a��ü�0�������Έ��ǿ�����4*���_��s�m%Y*9��XU���E��y7T�+�-a��ߣ��s;NBY)���"gě�b�_�]5U��2��*a��k�V#�m �(�wx|��2W���E=�<�y]�0Q ����;ø���?D���}�3��1�Fr��j�A&�\��� ��0�|V:��a|�["�z*��KٰƠnDU�)Z�9X1,��<�4v��S�+���;��緣ez��n��=�Я�c��+�!��}�D/�m4�����#1*��GM�p�5�я��4:�F &|O��2{}�O-e�K��$)����&�U���8� !,� f�n��.�����S7?Ґw�����lQW$E;FE[��)�Ȇ��s��������KM(���K���3�3��+GҦ3u%�Qk E9�v�\[V11��l�Ղ�u����<���]�-t0}*c����ET�K@T��r�RG5��s�c�� O�b�B��%RFqX�9�_�T��������}*��a�� �ϭF�i`.ƀd#�������'�������� B*�k�(��|8��zkV�|^�40]X\%U�s�'����2%���@Y��l����L��̮l���|Ke3�6���.\��k�U�>�.����!!�Fe� ��+��F����0: B�=�����Z=��f�w6���i��'�m��~���ڔ��]� z�l�*�u_�!��@]8��@&��6 �S+$v������B4� �^+�<�D�8 ��,��]�x��w����63P���0��"會2���闂P��B����+�5]e��d������-����ky��#=���c��Ga}�(T4'�]/Vfkw됄v��NA&$����ς� �r[<����z���綄˹��ttΒȑz�P��B�#Wj�l��!.t�4ي�̴oA���@Q�yy'�����x�3�N{�'I��z~ݥ�_��j �QV/5�2��B��!��X��D@K�,ޱpkj��3 ,��%�������jp�u��D]�Œ4(�+i��R�w�ʏ|�2ҀEg�,%�)5���( %��?;��O�7�Ϡ�7Ҡ��<A�{�b�b�L����������sz�UȖHf���Z�c�WB�C�z9B����V�ƫ���re��x�1��ͮ�ǐJ�V�l�%�&�8&��hTU��(ĄP���E)%I�!G���i�ɛ��d���F��o3-��NZ>�}f{�� C&��n#N��xu��Ƙ���L3ߎo��d6Cx.#M��s��Au��V(�Q;�yL��sF��R$.�LU�0X�2��� ���e"���F�#$�2��-~�s���&�`��W������3��0�I'�.��&��<�j�X����g�{Y��4S�,C=_���ͪ�`X,���]f���[�+ޕBn%RNu���Sx�Y#@���Z�3��J���d��n8��fv�Z.g�$<��!��˪���'lRy{���-��1�饱{�`YaT�?nO�U���b~��F�<��a��s犺�P������5VWYxk�I냖�J���!�������=�q�<Q�X*,����)��ꓒ�o�$��C���@*��{�$���V��8��'1UT���< 2�-�~P9�ji�����e C�2l��?7�X�:x��%�3���=�O�mEʺ"M�fcN�LH-�f/<|��5 �� ~�Jx�mFX��X�e�ů�S�v�T���N�� H�ww�h$p�AU��¤�L��"d�2y`�S�"���"��:;Ȭ��q��h,{����Ҵ��jf�}U�Q?j'P�Z5�`��]��SR��~0m��50>�4��m9Q*��:�A�m���3@ �(S)���z������p���K�T9�>ѐ��;����O��[f7�UPJ?�wo�]�<xF����"H���b����H�3q����&��9�F�Bڂǜ��̻�� W��.%�8r��.�x�����*x73��7�Hzd�9��Ifՠ��< ����mJ�D���@��>AI��jս���WL� y5|���� ����N%�k�O���m�˱|�+����TH������1�ڝe~��+1?�1&M2�_/��i,�6�T�ۀ�ʻLDA����`���)b i�f_<�A�`z"�]e��kٺʭ��g��@��Iʗ�Q&���ԄrF�.s�:��`l��T��Bӛ�fh�&��u*MN��9���ͮﻩ���%W;H4^�}��?y�6�v��9*���y��3�~E(<�7�� H;�a�<fL���0��J,+5�h{��իH�a�.��#P��9,z���z��Hô}M�Pi#';z����}��~U��+O1�F[Z������]������1���~����7,%�ؘ?�y0����&��a�{�m � C�㿺9�A�is.7zV�P6�dHGI�t�\�~j�IǶ�!����d��9���o��X��Ur���/�A������=�� 4m*��̢ptx��<�ި�0V�B�h*��<�M����g��)���?k�������Iէ�id�9M.BV�Ac[�X�Q�(V��(��G�h?+A����*���32����4���^�.��� ��5�%��Ҋ"W#X�+;}��*�M�H����Z+9[�H~�W�;�A��ϰ ��,~�_ύ��v|5�[et���g�ى�_�7����֚{jJ����1���^��b���:oq�*��H�a ",�������[�&P��T�y�t7$Lz���Z P��ʴ����hB��¬�rj��Ft����?���8I(3�<{ 5���۴���>����<��ה�W�n�!b<�%)��Nj�ك�a���T��?$�>]�^6��\�I�Գ�bz�}J��x��\�I;�<f�<�V5������Q;#2���`��q�q�";��q*z��r�� ^��Р4堮�I&����ˉ����kw��A*�Jύc��u ��D; 2���{�V�rD�u������
Static task
static1
Behavioral task
behavioral1
Sample
3025bb02b932edba1f20ed41048ef8a8d44596d536bd799209ffc6fdb072afaf.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
3025bb02b932edba1f20ed41048ef8a8d44596d536bd799209ffc6fdb072afaf.exe
Resource
win10v2004-20231023-en
General
-
Target
13021996938.zip
-
Size
808KB
-
MD5
2fd062aaba34267962764b275b17c580
-
SHA1
188893092ac87591744f8450bba45ad77aecb1fc
-
SHA256
1df29c57724e3710de2746e7c66ed1587572083458f9a9ba28ed0e0381c7eaca
-
SHA512
1ef3f187b106833609af799da61ee7364269703e1441aa67dbc66efbfa80afb73793b92267ee5cf5f67464a8d1fa947e9681a4f2c3a804eaf0617aed4014cd0e
-
SSDEEP
12288:Lyzdg+5zgAq0tKuz67Y2xTV9rGuzh7b80tRxaVh7XUc+g58NbNAULvoY2vHg1NhC:4WK+RxvPxmE1g58NbuRdvoXC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3025bb02b932edba1f20ed41048ef8a8d44596d536bd799209ffc6fdb072afaf
Files
-
13021996938.zip.zip
Password: infected
-
3025bb02b932edba1f20ed41048ef8a8d44596d536bd799209ffc6fdb072afaf.exe windows:5 windows x86 arch:x86
Password: infected
7864461c183827afde09eb6f61f56a01
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
msimg32
TransparentBlt
gdi32
EndPath
setupapi
SetupDiDestroyDeviceInfoList
cfgmgr32
CM_Get_Parent
kernel32
GlobalFree
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
WaitForInputIdle
MessageBoxA
oleaut32
SysFreeString
advapi32
GetKernelObjectSecurity
Exports
Exports
Sections
.text Size: - Virtual size: 450KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CODE Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 287KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 780KB - Virtual size: 779KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ