�\P� jRˬt��ڎ��Z�JG��]ˉ�����s���w��|,���*��l����U^븳�_���b"�7㏝\t�j�A�e8�):��DN�]�*�x�s�����ﭡ/� ��������¥��q4RSy��n$��+��0��\��J'�,�Ap�y� �H����<1�ލ:?גΣ�#��Ӛ�F�� =T�� ��o���`��}�.�K��7��H9V�����.�,�z�P�.y����_N:FQ�1���{��v=�~-|5BZ�?��qU8�a�v��=K�X�V��[E�G��"������h6Je��2E:�_%v.�g테_�a�ޙh���o�L��W"�)�N���qH��9"�)�诈mr�!��6&�V�M�?�1���?���~SM��/A�}���C��'"ҤmZ�0ɍ����q���~��HZ��7��9 ����Ws��\{��?�1����J?�S �:S � �S�gZ1��/�h��̽�'5�jn�s٬�Q�0������{s�>X��)�ن�'.��Q_k��>�jij��\�dأƳ��#�j��fYY�MS&�k��|���L�{O�TѝD0��1� %6�.��x���o0z�kf�e��8��)�:P��l <A ��&�X8�= Qv=�"ꂠ����R��Y�5�IN����6FDEڮ���Ƞ��*�f��p&p��Y�V�_dÍ Qw��z1R��]�^t���-�DA�wo���t.��+���40���S5�Gь�9��)�T�������陹�r�i~��p{)Bs=ǧ�����a!W���e O��O-h4/P�2�>? �L��s�O?�z�T�ݼツ���t����L�q�$�-_Qv�����!�k־xତ)]����`�_4ɧ�%�y�9�\��m��]���;ȱv���ЎM:�`�2�8O��&]�g�"���B#%��� ��ҾK+�k���2fc�!i'����7�T� O����;����#���RK�qpgN�W�J����yY�i�����7jZ�o� �+��QPCx.��W���=&-��Odn�^���Sd.���Ƙd�t���/��B�1�u��X�SZ���MJ<���i���YO:uߖ��Ι�S&��u4��$�I��R�y����UQ^��iA5���taN?��ܚ��Rm���d�הM�'�DY���eo1�$}R$�[\�(E�M2�D �L�~�m�5�����ſ�x^�J����X�lb�h\���1���PFv\a��1ƳB*���\�8����άL��5�}��I��Y�ח�\L��h�B좚4�=�{ɐ;Vb��f��D���nV�4�&�7S���f,� ��k{8�s�X=,��$ 42n���Z���Ve�.tӥu� ����/��ej��I'l�alcq���9)��{�'�4ft� ��������&�tA��pS�å�"�oWgRE2.'3������`�.�i�Eg���=Mc-��lz9INN Q����ˤ�y�|ﱜ�L�,�c�.��3��aJ9gX��l)�d�U ���+�"9+��E�:�x!C�Ѥ�kG���.��8Y�:�V���Ӽ������4Gn���э��M爫,�F81�v���m�n\����:}�H�F��?zk���X��_e\u��ʋ�1�+�������)Z��]n-��o7F~��ձ�� AjQ��u�\��c��ORjŭ8��N���C�|$��a�4�pc���%�w�",\j�v�욮�_��xn�M��Q|��Tu��-Vp���I��,���hLبY��cH��a�.�I�3.��KeB�NQ�j���rjME�d<�r���'���xk� '<"_���a��ls�˸�s����5�)��,P��o5=�ȱa5&,���-%`ɄY���w�5���[A;N��a88D)6��:�L�بV�x��\o&Σ���.P���Ɇ�j�ff�̱*o��L'f�5jݷ���l1C]?�Go��Hm �|�����.��M�XN�����Y�9� ��͇��d�r;V���B�F!�.���Sm� R5�DL���ONOs��֯[98B_�[]���}�p����_u5x���B���,�#�:/X�f=�����-�U�ndы<.��?_��۪����)̔�3 �8�{�O|ӑ�,�M�� :���*�4��8�H��'������`�4ǃx�d(��;���/RAzJu;���q$���� ���?��Z�vw����]�m��U�^�:�aZ��@�����5�����I���ro��������J6�K�XX�F�U����(�@j��1lT>����B2��?5"n��$��J7l�Q����N� $co�\ uv��~p.���P�ܸ�j�Eq?��j��E�:���g��e�BŬ����S��g �����`�ͬ�� �r���Rb�Ȍ�1i�\�rgG�0;�1�p` ba�u�L�:����K�Q�O�P��+����.�z#9�ޓ�*D�eyF�1��Ik�u��x�0Z(H��%�Ķ2�;�B�t�te�ă�.�+��Q�!VG�� 2������[������lA\�)O���=k0ȐI?�_��~Ox1��B��؉]qq��\H8�۔�W�ي�]�J�HK�U���պ�瀕'��3���k� B���ZwN�EI/��`V�d�Ԝʃ�!�e�E�$�n(!#v����} ���W�Wؐ�/�3���WT��R�����S7���W�B�"�����Y�:��Se� ��s��� �!�BS�P ���7��RF��}h�+k[�ລ�4���}j��u۰Ԩ��/�Z$�?&hm ���ۯdt�]�~ҥzز�X�4j�3���i�Q.c4惋�.��P@e�ɂC%Zy\�ܐuZ`�J%�TNSR�./��J����ǜ��@���z�3/�^8nU�8BVI ���Q��;�N�ԡ[h~n$�[�VѮ��)d�q��z���l���x��6��L��q�P��gOXڙ%�����| �V���x-�*�_z*۬���t�������4�o1>�X�:�=in8ڂZ
Static task
static1
Behavioral task
behavioral1
Sample
b736f874f45fb6cb4bb99cf0c5694dd6d49ee23b1f69763b29ea3a0383861a75.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b736f874f45fb6cb4bb99cf0c5694dd6d49ee23b1f69763b29ea3a0383861a75.exe
Resource
win10v2004-20231023-en
General
-
Target
b736f874f45fb6cb4bb99cf0c5694dd6d49ee23b1f69763b29ea3a0383861a75
-
Size
3.7MB
-
MD5
ea26179502ee87a44fe0d860803dc5cd
-
SHA1
c230cc2a3b7140d1102953f00f584ac21c68bceb
-
SHA256
b736f874f45fb6cb4bb99cf0c5694dd6d49ee23b1f69763b29ea3a0383861a75
-
SHA512
2b03dd27ece169e7d9b0db20e859a3d56813be7b7de8136193133b078149cedad5586aeab6082a76c712eb6c39a8d7b2d80dab2a55e5ca87bc0a6c789fcaa411
-
SSDEEP
98304:Kkmkg9KJRTzMpeD313sU5mMvk5teBM2Oi1CdDQyZ4RD/QyJ53m9t:gJYHP318U5p2gBAUCmdd6t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b736f874f45fb6cb4bb99cf0c5694dd6d49ee23b1f69763b29ea3a0383861a75
Files
-
b736f874f45fb6cb4bb99cf0c5694dd6d49ee23b1f69763b29ea3a0383861a75.exe windows:5 windows x86 arch:x86
188a39017fded61cad9a6b06258efdf0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOpen
ws2_32
ntohl
rasapi32
RasGetConnectStatusA
kernel32
FindResourceExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
gdi32
CreateDIBSection
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
DragFinish
ole32
OleUninitialize
oleaut32
VariantInit
comctl32
ImageList_SetBkColor
wininet
HttpOpenRequestA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.date0 Size: - Virtual size: 899KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.date1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ