5�8��F7 ������zT�x�/x�P��%�I�$[��m兵:|_"��&϶�&�R��?��.@�l�F�_�V>B��\0ϝ��V"�lU��|/�Kg��7|�)?�ri�w�m�����[s3�����p���y���Ѐ�aٗ�|Q��|�����`��>J03�o½��~]�b�{�q�C�Q�8��-��9��������)ӣ~��B(�����<����~Uv����OےH��y� tE�����(����C��&�d_;��r��N� �-@��T��"L��&;��C�Z=�Â^E�,�B5�-��ؿN���QȨ_������s�H��@.��Q�LЫo5J\�����֒���c�0�7s�����h���^�<�����`_j`ٮ� G�}���g����8pHU�V2��F�̎A�\�����2�O//9s��>?�z�W4防k۵�`^0?��2$n�9�R�L@ >�6m���ւTY*s{c:�c���W��/��'�(*���I�J�ܜE�ӿ?s�i�� �a\p|�ЌT5�`�� ����^a��3G.j������4G�x���U+�)�P��?z�=;�E���Eէu��_�T ��>��+�Y@�����aw�����g�U�h�E�E�����q�z_�E�e�a����$@s��I&v��&w<��4-a�����T�^_�)2���@�X�Uϊ6�Б>C��f�B���)w�JXe�����D��5�q���RG�I*d�xO�2�ۂ��p�{����H�Gɏ<ƃ:�+BF��؏[��g3�RF�be���uCm2��_��(�Q��Ճ/f͈qU�X��� �Y��α�����$����+�w�њ����j�ļ��B�K�g��ꅙ9e+���y���9�G������H�p4֝�n���f5.Ҵڐ��U���A���zO�����5���`��]�!��e�n���F �����^u�9��U�P詳3����~7u������?��X�-����W�Re��Hm���^�A����h�@x���`�A�&�<����4 ����܊��'%��Mj��1D�zq�lHݶVS�[ʾ�h�i��q*A�Qs�i�4��)�.�+��0f=��2������1�Y]E����A�KO_��>�t����X��DhrjF���3�@_3k�N�?A��"?iMz-S�=����K�y@�켇�>� $��yiJ��o+<I��Z�=mx8����N۔��?�T.�,0sMU'��2����IA�4̀MI A��������Nj,���d-i��M8�cԐ�'Z��c��bO'��P���}��r����)�%}�}��I��z�sbkV�N����2OT><5E�%���D�̽�Z�e/@e��Ճ,U��[w����5�[J# ��c^'v9�B��.`��-ъ��Xn�_�)e&�+^�{[6\�Y�4���&U��<@�0U�;SB mݡ�n\ 4�������,Lv]����4j���:����Tb�V��t� d�X�JV��o�'�`u���z��VT��Y�7:��=1�!d�hg�>�J�Y�+p���swf��rCH��]�b ��D5xB�ꮳy�$y$ ��6&ZS��b���Z��k�ߐ� y���w�-��O�S�F$��$���*����L�go���ُl��6d�CC1��� �i�e4��86)� �kR�9ǬU�6�9d�3=�vu��E����1�O�Q^u��:"}�]h�7��B'9�p�U���|@�l)��?�R��`�C� �mz4�v���K��Q �� ƽ5��|��_|�K����R�''���`�ꉚGp�2U�˰[�����Ume<,�h��dI �_w���ح��������a������U�8�*&���a��v���u��gl���ܻuF����\�2�h�V���0In�Unu�gmo�v����U����Sw��D�~�p��������jmM��P@��ID���Y�σv��|�bcZ��,��O��~��Jn"[M�X<���bH+���[��xm������m�����{�4�J����#֫'���v�����KI�+�>w�;{z�\S�n�3PKZj�MfTޕ��}����Y1�OL<�q8����I:n��`�0�Y�9����|����[ ����#x�2��_�"X l=����U�˻����L2T�����y�E���wJ�����PV�Q \R+b�0�`����Y���[-����#�N��[H��l�;��a���,x�ޕ1}a���Y8����a�U�u�n�T��l��Pr:��OL��:��"��l�V�Y�P�����D�icbb� �/��� ε��~6S��5���X%G����˼�x�g15�y�uP�YAb�:Xσ.���/�{]�h6(���G�Bp):{j�(Q�������Z���y�hH�E�v2��g��U�Y�7lJ�k� �j=����k���A�"`��We��B�(*�v�(����q���!��i֊/�9��F�bS1n@�E���ā���Ȝ-��nĊ�������1'=�I��ڥc�p�Ц67Bg-�]�X9�c,&�J��ARX>E.E�ʑ�b*nM�74c�l%u=�j����eT5���0����I���x���^�d#�^�s�%H_]JGS��C�DZ�[T��̠��|ʰP���k,��4�p8v\0H>l��0X�*e��+<ցo�*]�N�� ��%P ���Һ�2+���}�XϿ<��`M���>i{��q�H:��}�eI�e�@ML��L���[P!�r�˝��4���3;$ &sELJ�9B���쯎m�kVu��e��M��"��+cg)8�l�04�&�ݣJ+]�P;'�?K�4�;��*�z v�6�����%BYE��Ɔ�b�X���黌j���?�c�S�ىl�g� 6`�Vڕd����r����TZ$�qp| �f�"��=���P�Yçs��E�Jh����7 ��Q�h�۳9p_@���x-��P[Mu���ZF��@{���P_��[b^0sr���O��s>wQ�T��{���Ɗ
Static task
static1
Behavioral task
behavioral1
Sample
a243e0349441cc0e6e138c669717058f63ceb2e990e45c8aad7f866244ca1ade.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
a243e0349441cc0e6e138c669717058f63ceb2e990e45c8aad7f866244ca1ade.exe
Resource
win10v2004-20231023-en
General
-
Target
a243e0349441cc0e6e138c669717058f63ceb2e990e45c8aad7f866244ca1ade
-
Size
15.6MB
-
MD5
ba9947e5d1b23a11bb3e5165b3019760
-
SHA1
d37f3689d470954542b6e84eacc8c840dd87574c
-
SHA256
a243e0349441cc0e6e138c669717058f63ceb2e990e45c8aad7f866244ca1ade
-
SHA512
bc97b1cab829a91c767a2a77907eb516c0f3271f4e0de543cc22d80fcd7384d0f86b9e8f973ae1585c99b803f059a1d847384a9da605fef24a5126d0f4e563a1
-
SSDEEP
196608:3PUlvL9mRuQxGuIVqZuxZbHx/O1PQPeW7qq5ZPK0mEK1zuWvBYoMa0tdKZzCn0Qh:3spLKGEuxtxAYPNo7EKLHMgZzCn0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a243e0349441cc0e6e138c669717058f63ceb2e990e45c8aad7f866244ca1ade
Files
-
a243e0349441cc0e6e138c669717058f63ceb2e990e45c8aad7f866244ca1ade.exe windows:5 windows x86 arch:x86
168708c1c734fb3aca30d8f108b9d043
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
htons
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CopyRect
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
LHashValOfNameSys
comctl32
ord17
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 826KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mpebly0 Size: - Virtual size: 257KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fngqxk Size: - Virtual size: 334B
IMAGE_SCN_MEM_WRITE
.rlmerv Size: - Virtual size: 283B
IMAGE_SCN_MEM_EXECUTE
.mpebly1 Size: - Virtual size: 13.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mpebly2 Size: 15.3MB - Virtual size: 15.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 244KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ