�~�{��B>��i��G"%���E"#j=쵘�F0��L��8���Zdb���/_�NmbS뀖V��nx�@�p�.1R?c�^M�r����k��PB���'>��v� �[Gd��pr�+Q��le��7b����"T��#��������y�"̹* �AR����X��;�!���W����E�{b>�U(\[�"�$G���P�dR%A��"�o����H�ur�`Y�C��� 6Eŧ��9�:��_��:��K)(ءQ�/#? �qr>|���fݿO�m`]���Ef�Zh��Y;�Ae��FTCV���n#������zr@A����C������\�LJ�8�u)��7������:�&���y<*\5��]�ڀ'{���M~��Z�/��`o��L�y&�%@ɐ���m�����/�!�C���9��ؘxݨv�ύ��K��� 9�|� � ZZK�ȵR5b������[8LB��fr�,*��~}� �������Ȝ���r@/��p%MH��LJ�eҵ3���t�K,���S�iߨ)��e=E�8m�&�p�рΜj� ��JY��%�i���kz��|K�������|����54R��_Gl�[���,����� �=���c�p�LJdt�(q�^�xxsBǎ�럻�E)د��Ɇ�`hdu��]�֍��W�h�J�[����_6_�tE���Z��}�|��Y9Y���j�ɨ]*+�@T8��;�c#ۋ��75 @��|a�l攨�'b�x'��N�%͂��9���Nx��5&JIP>P�Ů`)&��e�����F5�f�-:3`ZO��|1�����rh���Es%?ܣ�*�am�7�;���u{<;nD�Y'Dz�:ˮ�(S�;���P������ȳ�n&�:�fT�v+�c9�q"�Fǣ;Guւ'��P ��o�r����5���Ɠ�wX��]�ie�-��'k����oah�� Ug�����P,^@�ӝ#G}�I��M����K^g�v�d��U&*�Y_�HԒ�a���F��?I���6?��OL��"Bp�D,[e��T��]P���ֈ[�ZIFF��Y�w���S�4�Θ�y�j��p̼pS�?�`� z��$�_հ8���b��z\zܒc�����X��=��P�ň�?7� �������\� �&�nFE�9���Z�_s��|���{c6�p��?����ܾ �-u]��?,/��%`��P=�&��K�z�Azԇb?�g*��� �ȅ�R��rely�h��<��B�Bsg �a:2�@StU(��%�W/�@%�.,~�L��Kþ���{���d�{~B,�G�W��Y�Z��ȭ�?���m�h���? :�3��.,�3Q<}}�����v�r�l]2k�Y�:&���q�l���[Rz����s����`ے�K�M��}@Ns����,��Pz��0���f��aY�g���!d� �����+��M����L+ ���-�T���Q��iO �06��Aײ|8�ld���4��p��t'eD�� ��|�g4mj*�#8�zH3�҇��Q�xզ���Y-�������O��^j�g�X�%��h�c� ��T�I} ���C��� [æ5�.���5�=�W�X���_C�T��o�T��脄]��?�����<��?�t"�m�?��cC%K�Q��o��ur�Pj濃Miί�N�{�i\ �iԲ����"E�O$W9,?�Z� . �:�P��SPF�@9LI[D?��ɷ�����(nl������n�:���}�đ�j�Η����R��$����H�P�l�T����s�/�?w�t�,0���VU��c�叆�>ق%}�Π�6���]�GY�S �2t�!c ��x�Mn��آf��K��Zf,�K�* Қ�B�d %A�Hsg�r��;ۤL���� Hm��8��+V�u[9.�����1����� �҃&75<��9PH�qAX�.B�u>�,���;�t��>y*!�Od���Nݯ'v=���9����m��6�D����x#��K&�t��e�ތ��JA'9�ĄW³���pg�\4 � [|�����{��h�阎�k�a�S�iq �z���(��y��E�t��G p��V�]�*���~�C�ij��|����P��g�A�;�����ɞ9��<[!�t=���� C����J��Ca5�<���m�Dd�x}��h�� �p�� ��DaI�� ����qX���a�2��N34 �� ~��+���&�ɐ���В����葅x���)�h�������r�_LAt���si4����}Ѧ��������X�Β�@&ob� ���/j�\B`+]ʈ���C� G��$K�c(���'�,;[k����y�&+$s?��]^����c��@�f��o_yt�1�-K��CO��w9,�ֻqRu�p�*�¬M?�pO}Zu���~��3SusG���ю��J���X��Ho,��t�N�*��&�����)ėaj����y��<&<nu���1�s�+�Z�f�����I���^�����љ�-�y�g��x�1�s�����V��ЧĮq�_��B@}��c�'%�]`/(t�V����4L�L� ��O?O����[�g��#�� _���&<}zQ��ߐ������'I��I�%�Wƀ��rtDz>}���.�~7�b$�s���+n����h����8�L�yv��s.�(]�[@�ے�"�l�ͤ�,_�¤s���6k� ��c]%Jt̂�5}�������~jj�#�l�/yw��?�Ie���Qy\�p�2�B�d�B�fk2v~F��`�d�����Iz~e����WR|�)��-��i۩�^G��7�?��#��{2(�.�b'����'`Xi���kz��̌�X����Z��쎑�[7z���r��6;ZT�vx��-�u�zO#H���7΄=\��>:���z�Tx{���V���j@<�,͗����s,dD�ʐ��m5ıW���\5"�/��~ 9��b)�a����H����!|͘>�����o�C��{ɽo���IdtZ�
Static task
static1
Behavioral task
behavioral1
Sample
510ffb43e650e546742ce8e2ee53b62316b31989dec4c02788404c9cfe99f2a6.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
510ffb43e650e546742ce8e2ee53b62316b31989dec4c02788404c9cfe99f2a6.exe
Resource
win10v2004-20231023-en
General
-
Target
510ffb43e650e546742ce8e2ee53b62316b31989dec4c02788404c9cfe99f2a6
-
Size
11.4MB
-
MD5
7e6f0b25fc80c2a85eab0fc8416785dc
-
SHA1
828ab7c90be5e9f8d2294bde2da3aaaa32e0239d
-
SHA256
510ffb43e650e546742ce8e2ee53b62316b31989dec4c02788404c9cfe99f2a6
-
SHA512
420f78acd78fb1ccec0f1aaa609776b6b1191d9e45792fd84ab60471b8f7c659c08ad01171e93f46bd4b38407c387c5fd1b965d8c39045baa32e8bb6cb3296e3
-
SSDEEP
196608:aJsxtqo19Obpu75L3KmPH2LGsGNaTQIulToWtIvB4Ur6X9IuXJoxWvrl8c+:a2tcb87h3KT7GNrIulTxSvHK94SrW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 510ffb43e650e546742ce8e2ee53b62316b31989dec4c02788404c9cfe99f2a6
Files
-
510ffb43e650e546742ce8e2ee53b62316b31989dec4c02788404c9cfe99f2a6.exe windows:5 windows x86 arch:x86
19263325227e08297d824ee8f6af6532
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
CharUpperBuffW
gdi32
GetTextColor
msimg32
AlphaBlend
comdlg32
GetFileTitleW
winspool.drv
OpenPrinterW
advapi32
RegEnumKeyW
shell32
ShellExecuteW
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionW
ole32
DoDragDrop
oleaut32
SysFreeString
oledlg
OleUIBusyW
gdiplus
GdipGetImageGraphicsContext
version
GetFileVersionInfoSizeW
oleacc
LresultFromObject
imm32
ImmGetOpenStatus
winmm
PlaySoundW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bus0 Size: - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bus1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bus2 Size: 11.4MB - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ