�OK4��b������o�����"ϊ,G� -=3 E��`e0S1vp�<��H�ꜟ���k�T��4#�D��=I�/���r\9�PmW�y]�k����<NH�k��%��N.���?���������'�V��L��wK۸�1�gR�����=~�����:Ad0����a��I���;%W1^�}������!z��M�kP���k����CŎ�Ix,d�#FS<l�h�N���h��9����k�r��;N�9��~�՚�Q�� j�lqs���i���P2J�EtAP���;�'��;\�ŏ��iA(�� ~�2瞛�N�5�'�A�vz[Q�h��F�$������V�^(�09I����F������p��v�9�oM�F��@�ౕ��������������j ��"�r�p��Z� e5�1ߌ5-�+��^q��]�rؿ���M���"��)Nr�,Y�]�Z͞�ѹ̫|/b��ʻb�!�P�x^\k���7c�($��vR4��sV~�ԯa��t4���S����{s��J� �H\l�2W��\.���_�K����oD��U\AZW�������c��V�Dc��~� ��>�n�o�`<�%�J�"��tʘ7������Tazz��7�HL�CGڷ&��O�����w&L�+�ɁGO���+RX�Ո2�f����a��E- �f�����X+j�a�љ¼r���K��ղ]�x!ˡ�s0����M��%�C���x{@� ���c����hs��Iv��}���_����K�ļ�F7�L������U����qJd_��M$ ����춾E<�܈��0|o�qae��.5Q��%:���9��1@kY�C$\��8�E�%F����B�?+����Rh1 ْ���.��y�S�fh��HQ��IM ��l������e�� )8���R�t��v�.�ͭ7p/��r^>k�`��<�#�����?d���6�T��V���pW����'�ym�Q?R;����F �o�:�Z���=��`x���m4����5�X�:z��zTn�uiy9�X�M���N�HB��w��Y����/Ibٌ��bvqc�������um�TL�*6t��u"[)2����]��r*p�f/��Z�w�ʬX�_�� ��|+C��yA��} �l'���a`�4��Ej��ԛN��$͙k� =�V9EZ.�ˑ8�������9r�Z����zp��>�d`�KoH�#"�=�,���mk�gz��M�� ��������k:��ڏ@���� �P7���/-M����!�����#���+?�!k�,��ƅ�^�ʘ�ZnL�m�Ok0��\"���<��{D�?�U��h�9��YA!e"�� �*IW��v��! �LA(�}h�$�+��f*�O/B%�7g���,����E��w�ʧ��79��z֘ytr���Mˏ�����E%S� D�֊ii�����7xB_`my<X`���E���0�ֶ�D��F� ��f��꿙����1/k�3�Z(�z��3|�����&2Fi��je�Ҏ�;�?���y��!����������a��ih0^n���q`������ �xP+ Rz�T���K�w�NJ��)")EU�A̒�tA�/X��z�;*��q�@S�́�5�?pa��h����� Xa��5�ˑ���[Ez�e�'g��r��M,=�U�\}�:�4 ��Z9+��OI��rτV՜�w��ܙB���؋+�3��i�}��mD�=�?Ki�1?(B��H�)U%W<�M�n������u�V"��� ܒ�͢�j���#`}m�y��l��)l����]��i��v���Yf��ה]&�>���~��U$S�RG�X9�s��QkJ���Cl�6,�V�����w� <@��a�-J�]kc��ad�Ýf�����𠜘E&�UiA=�%#������C~�{\b����PA^zD���������ٕ�B��S��B)בv����쟑��Ńk��ӳ��,L��~�D�SI�'�2��O�y�6'�ROŒ�K�;~*I l.N.��s� ��ݭ����h�7�n���N&.F�h�����Y�ܸ���9��:��V��Z��������w� �Y�lj����Zu��t��� ��\I2Z��#���j�[����\�i%o�C���9�nfw�M�U�`�@�<h�0 V]<S�u:���loeL�ONM������jT �S�|�N#b[k�bl!��8_���/O�³�z�zK�s��a�f������~��#y�P�ƫ���X��L���-3��S'�Dآ�e�Lc�F�ڽ��y��b~����(�����v������&�u��{�U�'**Q��M��(.����-�i��3�&��O�&^w�?a��b����v�Q�&�UP�ힷ�+�=�oyzKѵ��x�w�f��i���Va���Qn;X?V����t�'R����ﵘɒP�7���W��j���\^�8�2^�۸ݱ�}nO%��;�����F]���47గG ���73��9��Ưe�mڑLP����;����-������|(c��ڲ�e�Y�Ϸ �v���:�x�!�T��lju��)��[J|,U"!��HZ:0,ki0����(���@�a8LB��>��͆�G��[Aw6����D��8o9��^�5��qnß�$w�QJB�<ō̼���zͬ�B�����Mפ�7p>�����Q��5m>y��+����q�1'x�W>;����<�->mDw�85��G�,��I����L�Cm{�T|BId�=��� �<A� ��^뾏�z Q���H6#w42�+ 9]��Xi��c�|@A:X��X2�${/�yۀ?�L.��Q,}=�o}fp+8T�5�gF����y������4Z�ZX{�9R8�L�'-���Z��r�xA�4���9|��Lj��ŭ���5�%�D���A���E �"�;Q�Ѣ�ͣwYS'���؍N�+ �p���9��D%%�߃ �����^�Q�ݟ �,e� �
Static task
static1
Behavioral task
behavioral1
Sample
4961c1f4d676dc72bb39864c898d41c94e0b5c1b54908f8469f0758b84585b6f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4961c1f4d676dc72bb39864c898d41c94e0b5c1b54908f8469f0758b84585b6f.exe
Resource
win10v2004-20231020-en
General
-
Target
4961c1f4d676dc72bb39864c898d41c94e0b5c1b54908f8469f0758b84585b6f
-
Size
732KB
-
MD5
df7d79fc6745351480b1f812b296c32b
-
SHA1
5be5ced99d4e0dcad90f7ce3e3c6628166e4815d
-
SHA256
4961c1f4d676dc72bb39864c898d41c94e0b5c1b54908f8469f0758b84585b6f
-
SHA512
11c74e62b813c4152c7a31e6185940a053f93026b9e3e1b3b52cb4677503c234c1ef49777e7b69a9210d7423c56418fdd7f90396d3cab5c2f0c552b6fc5e4ed3
-
SSDEEP
12288:DzvB/YLJuz0cfmoIU56+/4NdxWW/3VU4kHfTfe3iCTU63Qa9L28Qv5z:PvsJofTM+QNdx1FU/HfTfKikUHa9LRAd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4961c1f4d676dc72bb39864c898d41c94e0b5c1b54908f8469f0758b84585b6f
Files
-
4961c1f4d676dc72bb39864c898d41c94e0b5c1b54908f8469f0758b84585b6f.exe windows:5 windows x86 arch:x86
12848820c54a121b0a7f9181bccd0752
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
SetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sqzx90 Size: - Virtual size: 591KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sqzx91 Size: 704KB - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ