��;���-ׁ�o�Y;(=���ͳ̀ۚ��Y[�#���{|j��s�%bg���D�Ȏ��(Z?��w�h$:e�����G�&k��yx)7���^x�'�&g< H����%�$�^� a��>���S>�BcU��MXf5>y��w���)7ӥo��mYC���c�@H�gf-7��U D"���k{əR&G }8<qE�u�Õy�ډ�۰"@z�?d諈T����>�z!Ix��;e\���-�5A@W�V�_�#� �����ׯ:��]����2�O��+ع�p�nƣaE{E���7H�-p(�;��*��i��H�G�R0B���q���]���"o�;R��~�ɀ��?�R\���4{Uw9x��������d��_!i�`~�:,��a.����n�lxR8?κ���<V��"U�:t�qRR�����6���sX�Yq��7V����Z���N��~-������aͩwJ�_ْ�C���9���}H�����������[��x�-�����jd�{t?�M�jʶ�И�7�������@�)q]��+K4�8:�$3N�cNm�����J\��ݝ� \�&�"g����5w[�ͤ�����Vk�vA:�Z?G��3}*ҰH-1�KihK l �<�DAU��C�w��و�-$a\9�ٛ^$XQ�@.�Ԅ?G6Z���Jkۚu�nF�GT�R�؉2s�G�B ��i�N� ��vǞ�����| �#�G�鰄>!uEg<;o\A~��=MC�Ʒ�'�X,�tL�{$)��,��x�<�Afl����8�0Lzy���n���T������5���*�[��\_�l��o����r]ɴf`���c'�C'���SY02g���n�^��g��:h����e��f�mPsy}2C��]��w7��=ث��a�����\���ҡD�7������B50�0^�l�����^�*�k� Б�4��D��x �c���|�x#��c�+S��u��i(j�Q�^3(r9,N�p��7&�ћ�Q��$�3m*�;�t�k���=��Xd|V�>��uM0����Md;at��B_���;��ЍģԌ�$���H�Jr�f_{��x:|j�+��k���A��#���Q�S�o���_�/���I�8ys��/־gFl�0U�$�Y߶ ��ixRt8N(n���Mj��'��$E0}Tg�SXE4M�����ˬm :l�)LYh�-=b�Wĸ`.�*T������~�wV�tUI$B5�N�,��թMі]j��TUZ�`���� �k/�α��y/8�5k}ӿ4z���{��s�t�IC���g'���Ǽ}8�o!P�\����{��?�P�/\���m�54D��� ï&G?�t7�(����p���k����m�ǃ�Ll��e۩�Hr��)*Yn�*�Sw�dwg�����/:o}�i�[�{�d��ن#K�*2�2�&DzR�>�Aa�k�Q{Ň�$�3����C����A�=�~����+���\�0���ջg?IS���e ������љ��� �ӻ[�����Q�ݳ�+��N9BۄR�ߒ"U�`�q10U"��6��~��Xq+yKLi����7Tpv�$��zvz�@�\t2���ƭ�,��ȉޝ�SF'3�Q�,d�U@�_*�UR@��3����ǬX�� �~ y5L`���G�o�J��L몼UnS��\ �^�����c{���:�`�&oI��b�Ź�DmanA�_�7EGB|����Lc��E�|�0��*-fH'R����iGP�|������ 7iH�vW��c8�%�V�b��GG�0n��Dz���> t]BW��\�#�����YL����|�n��rf���)���+�{uK7�=X���xf�ZV(>�%�$ORV6w�_��)�h���� �� " ��,�o�����`��af<c��KO���'X�^%�2�%W&lb�����ޚc�EE] p���$���� ��ă�%Wr�Ӑ�D C������n�z$��˕ي#�^}�dW��n�D�ԃ���C�����m����������� �]$Q�|q�����v���uNŰ�v�O�ڱHr�z�YW���1OBa*�!��l��@�Q�U�H�V0�_Il�YԁI""ث����d-,����Px�t���'�v� nu��a�0���as}(EH>��akQU����O�~ �{�娬��O��Yu] �����?�h�,��kx ���0�R��)D�j����&�-��,� �l� ���5n�tڻC����F�{���y�[��b�y]I��y��@v�Drغ$[2�N[��;m��ʸ� �����<scL�P".q���.��+�>�w|ѧ�4�����J)[:r{R��,��Mr��Iݯ�%V��nE���X���ĊN� �U�?/t#�����!�E�XI��רZ����Ls\~�5���[n�ᄐC�)9�₁��s?�q<�Њ��eɍS�� ��8��q�++��������k�}s��()�I-�v0�x����۽ ���C��=�&I}��z�jfOK�������0^����l�V6Y2 P� �z[" �Y���4�U��|��5�)�<�'V˳�(������.�5pY����8Kb���}���΅<�a���Y�� -����:��UQ�8s����y���q��leD��<PqrƼ5p��W]B=,�{�rk �����h]��}�k^�KQlw|6�*&�'�.�P��t�"���?F�t{0ď���n��-F�"�^�7���{��a�c�] H2-[5Z���Ӵ]O�"o7.<��k{Uͅ�<�3Sk�F�r����� � ��$'|;Q��cju������_��;פ�V`�%��mRdE{���GB���Z�Ӓ{�c�E��� �!O �e˩Si��$$hq�x�/���cx�jF���1V/��.��j�j��W�ñ�1��K�Uַ���$�o؞�g�����`cPA#���m棝�8�����ٽ��W��%��\Q���؆�N����®� ܼ?��<�䏿E|VX�����W�L�I<���;7��'�+��Ii��̅�/C[ *���
Static task
static1
Behavioral task
behavioral1
Sample
54272025cc26471247265af5e9d0d2b55637920956a49735c49f5fe870c20ec0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
54272025cc26471247265af5e9d0d2b55637920956a49735c49f5fe870c20ec0.exe
Resource
win10v2004-20231020-en
General
-
Target
54272025cc26471247265af5e9d0d2b55637920956a49735c49f5fe870c20ec0
-
Size
740KB
-
MD5
572c906400a3334ee5c561fcc3ff0475
-
SHA1
dab50b9c97685b5eb7365c493ffc742216eb75b4
-
SHA256
54272025cc26471247265af5e9d0d2b55637920956a49735c49f5fe870c20ec0
-
SHA512
d21ca93e598e29513b3eca9799676c832a0f05de5ba3be49585b73df250e7fd94b4d9ed23c8408801b20b62ce840049cc9d7b2d1e588e7bf1b9b41f867423761
-
SSDEEP
12288:ljj2lH+yiRj6Ne0m9M5pp6nhhKxcx7oLu5xmDWtzHmKhtl7k2TWlHaKXsHF//:Zj2h+yiV6K9M5pp6fBx7owxmDWBm516B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54272025cc26471247265af5e9d0d2b55637920956a49735c49f5fe870c20ec0
Files
-
54272025cc26471247265af5e9d0d2b55637920956a49735c49f5fe870c20ec0.exe windows:5 windows x86 arch:x86
0c925434a965aba9680f232f2933b733
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetOEMCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v390 Size: - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v391 Size: 712KB - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ