�P ���f&��so�^�L7��=F#�fW?[���}��B��ng��5��k�f���~�o �W��/��թ�K���`��_�J�_v�p���3��%�ʈ���V(��&qy����A�p �ph= �'�Aq�pZVN*�f�8�����\���-HZ���w������n���wy@o��d����G~���vU@%��lqj^lH�x��u����������㊖�<���08� ���G����& ��6���n��@C+�� �2ʕ����ߙ��v�E,��(�(#Uz=��/U�@7�ٜ2�G w"�}yZ�sp;V�i�� �p]蘦n/ ���&�G\��>b-}�����nD�m�U��R�6����A��g�KGf�H �A���06��S4'��'��5�A���zMo[����%���^T�;Uj�aau���bp����sR4����ݺ+�;&p��ﶞr6c�=���c����D�X]�Wت�])����#�<6~v�z�Գ�]���R��*�|�Ԣ0E6��n�7�)/��>��G���&$��M��a̯K�T��O ����#S�{�q�6�ӎ{ s�^��Q$0��rP�@� �$QdU�dͩ�Á�@٠�gi�y�|��K��[c��M���35��Ꙅ�������@l�ĩ����V�#�*v2��H&��QЄ����Up��2(��W���a�4W8�����gy;H��;�����5�c8�G����7\E 2�����m�2������c*^9�,EpOn8���?��⚷x��+�R��%S�� �}1p�����}/�����$�#��<���%�u�-�z�1zQv<{yvGs���.pCj�Er9�G���]F���t<�e��^I���o���u���k��RM�d�u��k3+�@m$�))�G��r�����(d� ����؊���&(�c/��=O�O��o���t#&�g���Q"����{��o��h�����]!cd���t&c���cѺ�-t�L��㘳��=м63./�3�6ld�1�K�n��pp}p���.59�����I�M0)��Y֜#��i�=���F�O��b�p_��1�7B}O�6�щK��5f�����(�gƗ��F��4e6���RC৹_K�i����zƉd3U�C0f�GHU���<CF��H��k��T�� )��&�����[��Ot��g�Cu���,>�y4z�)7�Ռ �oJw�Jk�<�e�iPi4�1?7tN�)�l"�IWV�C��������g�R�^��x��ǣts:< �v�A��>I:X���n������N��iwC�0s�D�;� *�EgE�iv���B���8��J [��F���Onrw4.!.qs3��,��"���7��Qw'n/������.��T*0��d#���&|x�hx���,���1�<���̄�JR�'��4�cDC+���K�U��j���p5���A��h�Ҫ�>�� ��xu���H�?szq%y-M���A��ʚU���� y����\��[���ԛR�$_��.���SX����jD�)F=�29�;�?6 �4��G�j�����úB��Ysͮ9Z��$d����CRmn����rbq�;R��5��P6�)�(˦� |s�e�}`�6sy0�+�^OB��9D�v�O"�-� �D������wą��i0��qA�|�e�e9)B@l�'�"7x�n��n�a!��^������:��ĴӀ�|q&���G0���h���S��\uZ��#�q�G4�����;�>��)_)����u���F)$���i��r�Hp� ��� ��J��I"E�I�L��3�?2�RNX�NM3�j-r���ŷ�nd��&��GNЄ��2�2(c@M��*���Ff��2�C��*a�"�l���h.��tɾb���4���J��z�_MVhH��dMg��Q��k%��h��q�D�lLo=����]�o�Ϻ�'�ʜg��{0�4����p㱳VBW���,uXzpLMeb�S�i�A"���26����+j0�h�9}P��� ��ׇ�ʴ�d�Wd�i�*�<r���t C=�6��"��͓ ��;���<��r��(��i��]��{ܮ��+�t� �~G({�S��-t~\�{��8��As��i$�������OP%�5�����^l`?vB`d�I6E�vm3}7���OB�2W�dbp����.Y�����c�w!�As^��F���^L6>��������72�&�x��U�O���٠Jj��{b�`�����b�X�V�����+���� "iF�$�7 (�D*�U�u���އ���G��nJ���2���Nn���^�F5�s�m{��3?n, �B�R�F�yZ� ��o���t����V����Y�M����Y��g�A�mT�(����(75>ì�s���9Wk�u��h�U����^�YX�?��nJ5-�C�%�dV�1p>�U�tC,|��/{yx�]ݧ` �)I�%H���5��|�~H��v��t��]"GR�&����;���3؊c���r���b):�6� G��^$�s?�p��>$Y���I�;�9Ɣo��b��寚�PS\�鄔�i�Ҳ�P-���|�V�-5��dʸ���9����PGe�|��ka����d�Յ���X�uͤ�?*-� "���������gӹ��F$G�n��9 @T�)~b}��4��6f�(�)"U���w��'��ڕS�\ǥ�����j��K�D8�����D�J=K�p)�;h�Z/��,&]xU�I��f���O79 T���Ä꿚&����]u������^"��A���'d3��J�0�1�ٺG�U_E�{����S���B�}v���\=�ԙ�2cx�N]nNy!�<Q�"-1A�yM����̋Wqv��ZWI��=��d��c僑����P��1���?l�7y�F���JౖPL��W8 e*��:Tn���l�2����װm߈%�bH��|2 ��#���*䊬���/�5@F>����f��V�'���������,��z��6�{��4w�iK'#Ýp�1��4w���7�\�Ӭ =@=~� ���ʪ
Static task
static1
Behavioral task
behavioral1
Sample
54426d27c5b9d4fe2ca203d181533ea6c39241c34b498e9457cb9f912c4a7a95.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
54426d27c5b9d4fe2ca203d181533ea6c39241c34b498e9457cb9f912c4a7a95.exe
Resource
win10v2004-20231023-en
General
-
Target
54426d27c5b9d4fe2ca203d181533ea6c39241c34b498e9457cb9f912c4a7a95
-
Size
6.7MB
-
MD5
c6381b5d27bfef466bb85a47e9bf0796
-
SHA1
8768d0375ae899bfab9a89778cc06649f089e0e4
-
SHA256
54426d27c5b9d4fe2ca203d181533ea6c39241c34b498e9457cb9f912c4a7a95
-
SHA512
f7a68c89d55fd1c0765a36a176a92c615abedd442120b4148fffc15e55209d2546c07c2e9751f16eaa0e56e9e72552f8eff3f6ad452ad1818e65ce9aecde9075
-
SSDEEP
196608:BAd52XEE35xhQzZAzri7ex0F1GNKkSL2/aFOjmb:BAd5exazqjq6Tm2/sOCb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54426d27c5b9d4fe2ca203d181533ea6c39241c34b498e9457cb9f912c4a7a95
Files
-
54426d27c5b9d4fe2ca203d181533ea6c39241c34b498e9457cb9f912c4a7a95.exe windows:5 windows x86 arch:x86
92b3004d33a8b1ab8a3d63c0f1ae5099
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayPtrOfIndex
advapi32
ControlService
user32
DispatchMessageA
kernel32
SetUnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetDIBits
version
GetFileVersionInfoA
mpr
WNetGetConnectionA
ole32
StringFromCLSID
comctl32
ImageList_DragMove
urlmon
URLDownloadToFileA
shell32
SHGetPathFromIDListA
comdlg32
GetOpenFileNameA
wsock32
closesocket
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 49KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ