{����7ټ"?G:+ӳ ���������}w���?����)²�Y����ݵ��8�Y� � ꑍ�]r.�cbȂ�ݚ�/P��B@��f�{ W6ꀐ��b�4�'��O���,j�?��$QI�7Sh���t_��j0!�e��I��������c���z.wF��[����r����T�����nO5�%yp��A���z�f��3�Ɠo��5x�S� zR�a*�?|�HzՏ��K�ޗ����#V@�����F�8E�D�8ݴ���܍3���w��[�����شSr6��y����S��smR������Oܗ��\��x)�`V���I�ƛ�r�VHݶ����&o�6�+�������V�Y��#U<ԧ���A�g�d3��Vc菻��2��g�����΄����c 9aA�I��ч�Tcn�}Tڴ'z����&�;��数�]�[QaDeJ����<%$�C= -�f/�}ű��{�܌\��N�Ն�q�8�� Q���}O��J���I��k��g?uZ�cl��M�?X�b��kpR�D*�P���vb¾���!�G@�,C���N�����O��(����Fv��n�.Ö=V���qiޯ���*јQc�?��6S��:���lJfla+���)\."�]u�2QX@f����9�3���fa�6�8�,����W�i��l� ��dꛁ��whl�r�f ��J<�GO<6Nkƺ�_���).��o4Y�r7�3�K�]D���k�����A���W�w��uZ�\fˑ [H��l���%8��'f�qu"������\5�ZOʻ��%���?x%%Gbfv� 1ͦ�E�SK#q6T�GۿN��lo��H��7�D�+���o��1ʫ������A���������}?S�GG�9#��4����b���L�<J#w�|�D7L����?�ˌ �:eXM�1`���Dk�f�C����u�t�����9��C�ЅW��˵���Fg����Ӗ�`Ue�#�SX.FN����eG��b�Z. ��/�����Qw�'��>h˛�.�fG#�w�(�MK�?kj�uUn ��39��M��l���]\Gq��b��z�L�����/�^x|�A�Dc���<r���͑۹dN �2l�zi����E��N�,F�1R�":��L��&�$�0"�e���ɋ�#���e��E��_ց�I�g����~l�%�֘�.��i��E���Ӵ!E�̢�K A��ke��.|0FH��ۥ{�\��(�T���v��%�ςz��R@<�!U���]Q�L����En%+ V �����3$��##���-����7}��k��\X��5�(J�,^�A������E�ۇ���֦�;�����*}l5�uD�����[%�פ�M�_�¼|���,�%���q4s�I�H�@p\3w5U1���4��T�b(ס2�R;ejK�a�:?8��f'�^Tz��վGޗA���%)I�)�Q�>�.�_<Nұ����V�Ll��fYn��ɨ��=�'���G�A���$ɪٸ�LK�n�v7VCr/9�k��k]����8�A�3E�͍W: ��P���E%�'m�8{��=���:�����ƙ)�����>r�-p o;�����){n�ŜX�^��J������~��ߊ嶍}�cS�-/��<����SV7b�/~�Jn�+4R$Z�����8;�TDm�@���ħZ-�dg7hR�[�*�峝KVA-� Hu�1�L%n6}�@,+QI��CsΫ���Rg�M���m�S�<)���������5-��0 �nߖ�5zI/�?�6w��=�lc`�� �����n���d�l�� �8m���I<P��,PI¥)�)vzN ���S~[�z`-��o�T9�q���Y=_�o��N��m���-Z��eAS�ᰎn�b���rJ@�ԙ�K�R��Ղ��Czr0�v�����R<S�E�p�h�A��9�R���u�q ��:��E�,m^,B��l� LkE.]h�ܴJ��%a��+p �-D��9?7� ��fx\E����?�H3Z�}N�^�&t�6;>W���7юn�KN���?�-�r ��ʾ��15��)lؤs[��L��1�4��ީf���2y�<j�#������� � ܘU���A/�B��G���e��l�����J���vjG��r9��4��%�E��_��8�^��3X�{��^qF�f��6n���ͺ��9��9�v�U�oZCo�j��F���}AN-Y`g�@,ѬW����������a�{$͠y��ԧ��Y'r��;@ҖǍ$?Պds���BK��A��!�::]�V�&zD3�ڌ,1];'����ivTЙi��h����e��c^��q�75�ny����4~�G�5�~�A�7�� F*��49�E�� �ߓ50���D�S .<|�5�H�[%S� � ~�s��j��ݪ.����k�~��`aRh,%�eǁ�A!�|��_%Y���#�R5����L�CY���+�ceP3�W��A����Y��sѽ�Lam[�tO�L�t� ]����G�z7������_gT�+V����@����^O�(d ���>�3�=4�oٱ��z.�*t����q_u)���i'v�:���D,�5����"�m��pW�Ż<�i����9��E�þ���|�A�W!7��~a�%����Ļ����'!��nb�I<9�,�a�zx��mFYu��X((ւ�y~n ��u5��C}�F�sd/�f���n��4���T�З��Eݖ���%Do��#A#�m�1o{�À�_� �T �1} *�J£Pt�F}ތ���9*������GB���jO�N��l;A�?�照!%�_�`x����ti6�J��6��c�@D`W9g�U�"�%�WE뱡4lP<h�ʼn����t�ɺy��t��#�`�Ǯ=A����A�M���nM��( ���"������"���Z2���N,���b4�����t�8�g�GC�!2w����?^)��|㝗��P6eB}I���{f��x\B�
Static task
static1
Behavioral task
behavioral1
Sample
162087315b5d6e4234b786e1262971c6547b49f249ae077f6ee7a7f865e4d327.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
162087315b5d6e4234b786e1262971c6547b49f249ae077f6ee7a7f865e4d327.exe
Resource
win10v2004-20231020-en
General
-
Target
162087315b5d6e4234b786e1262971c6547b49f249ae077f6ee7a7f865e4d327
-
Size
7.6MB
-
MD5
b12e713dec822ba7f2c78369c061a645
-
SHA1
5ec97180f36c5df8305edb9fe35377310440c7fc
-
SHA256
162087315b5d6e4234b786e1262971c6547b49f249ae077f6ee7a7f865e4d327
-
SHA512
65adf0e29d430f4628f4d43b0a5cc4477ae0940594458eceb75c7350fc054ae89f2e06784ad9a915dc4505de83b9f605b8472d9cf927f1cc72ada690eb6b196f
-
SSDEEP
98304:jL0FZff+ApHuHHHS9gqlNDKDVniNYkmNHlDgEDCadN/IMmkiwA4FPstByNGe9IMt:jLUminlN0GmNHlDgEnaOAAjNdIMPV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 162087315b5d6e4234b786e1262971c6547b49f249ae077f6ee7a7f865e4d327
Files
-
162087315b5d6e4234b786e1262971c6547b49f249ae077f6ee7a7f865e4d327.exe windows:5 windows x86 arch:x86
749556803de9d38196beac50b71a973d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetLBound
advapi32
CloseServiceHandle
user32
UnhookWindowsHookEx
kernel32
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetBrushOrgEx
version
GetFileVersionInfoA
mpr
WNetGetConnectionA
ole32
CoTaskMemFree
comctl32
ImageList_SetIconSize
urlmon
URLDownloadToFileA
shell32
SHGetInstanceExplorer
comdlg32
GetOpenFileNameA
wsock32
inet_addr
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ