�J7��ĊUn����W< �U�?��J��m����-^Q������-P�9�iuE%�z�v��x�<�hº'�0���S���BW�q���N �ʰ^���{2����.wg~hx�%�t�`�\ ��%I-���NR������?�뉑���b��%|���o�N��Rx;���R����(�d#��O�JA^Uz���j���k�.��0�Ү�� �Jr���b-еJ��\�F���ù�R�5�?�ޣ) U@J�T�<��pl^q��J�S8?��{,�p�fJ�u=�ٶ��J�:rww��h.̩~��^�ϥ�5�g��~�R��sX���2���?X*D؉��J����cM�������7Y�V��du��Cb��,P���F�5�cw��d�o�VᏐ7*7R���N�vq"����~�ޠ,M�.�@\�{F�L�y���ox���<L�����̵t^��nBX7�`��x���2$ Me�8{�$��ӣj4�:��\ЬʄPJP�l�(���J����E��n!ǎg{%���%g`�=ux8|Gut���s��[q��kQA&�d�?t�F:��9�&6j�LyS(3�+�@���(�Imj���\��9|�UIP�Myo����������µSQm�g���9c Kƺ���4��n`��H�[tr3~r�K1�:'�U�� X��������sa�{k.�M�f��X���k��|c@�ڰ�5+Kb��f�٦m����|��6�.�:��30e*V��H����R���,П�DƟGw��Q���^-�k�,�5��v�%U��pd�rs�f�}1�_��c��-9eB�F�䫲;kTv�T�xcf�T2-� Y�X�� �� }J%Z��^�q]S�@�Ѳ���u!>�FI Ro6����`��x����i7|"��c�W����1Ϸ�9c@3���i?�S�Ia_G~�|����f$;&�$��Z��m�'t�>8��WS�#���cd:�*��;=�\#�b��|Bӯ|pbSԥ���E�u��W&�b���Z���3Y��!�w���ꔫ��Б����6���'�V�oვ���Mؿ>vl�����#C2�������]sā6�c��R��no#`d \�0[��Ų[�:S�a�ۂr�`A~Q{�_2tW�"��N(���K~\2�_��J4cC[��Ԑr�WA!��r b)*24�+�4����,y�B���n�y��o�Ȕ5�*�<���:�3�z��B���]8��8�-�Ȉ��*���Ls�]����,}�3�<�n�T �����]3����s$�e�L��$|���a���;ͫ�'��AB{I #dϬ�>H��E �Q����S12�r�<��gCJm`�+�%���Q1W�G4�zc�Ut���}�X�I�ܬ�h��؊��Y &{Xm."[odYz]_1��;�`�'o�o��F���u3�6�Lm�#�B>E�E͇Bjv��'�C�J7�E Y^�����(�w��'�r���M�����UU���9����jn�v�(`<�L}Y��"�<�#ϧH�-�5���)�\$���*�)��V��������L����+�n�C�%�v��!�����^����E�I�&� fO_G�<��N)���]�)"t�J�7UZ���ޅ���Jx08좩�������;��<���P�p�ўl������(.JC-}~��$�K�c����-�A,�X�3| ���eFi���+��� �o7��cNB�a�l,�P��R#c�ƈu���&�qN� �u�e߃���c#_�^n�N��qO�O]��ӊ~c�Iַ��������:�#$Zqȡ����4�E�#UsL�W���ְ��1M�hn����%�.T������o�x�x���`h��0Y�4١��yP� W`#H����� ��B`�bAn�>�/�悩�,��g�z��ܠe趡YΎa4��O6i*�����=� 3����1q�<�W'���.18�ޠ�hu(r� 4k��o��iU�Ÿ����J�x�-bA��>Ԑ�W>ף����h�;t��1z�.� ��L&�zkȾ�m�"�O�GH[�)���O��*�T�x&}��|晜��V�B��+UN�j�jbd��[�҇#�ZP��췵A�����w�]S1�i������9�]䯕$6a�u�ǥ�i��5K����(�N]�7bx�H=u�3��y��$��r�1z�,�D<��E�;�ێ~\'~���M�a����j��5�f����d�V����E��N\�̌=qot��.�@�q�Ē�"��=!�z�|u������<�Y_���a���i���c�x��#U�h:���n�;Z���{~BUm6Z��cAJ��l-�ڜ7l��<�;�O���z۸=������,tY%��)��qM��7~��$ �p)&�������S���z��{5���������㓠Cph�|x9��~��'H��d�7 ;�����I��� Q�,kT�r\ ����d�2<k����l;�����?�jhR�h��H�Ew�|�NJ�V�T=n��f_�d���A�DE�8 ���N����wJ�Ʉ�<�ɼ71�4���Z"y����������%��4WS��N������^ޅ� ���/Rr�X�����ڻ�:uA�܋l-]���c�|�Ie�7�y�/aE�P��� v�GG���O�_�OX�4�$0F.�\zG��{��<����qw=��94�GtJt��� �&�����x�;���Y���|!� �dB���M���3��Kw����r31%M"�][er�u;@�p��3���X��__��X�]K.Y�O�r��b�2+C.�yJ����`m&$���{�U�jיq KpZ����U���E���4��eW��^��n:��j���h1i��5�P��B����>V�F�2z���"P5g��K�i1P}����)Y|%�f�����#�}�r^��r4�j8u�J�>�81�k���Ԇ �t>�ăk#��7T���z1�UG��p_�!�6��L�h1j �+�_"������آ�ǀޠ�W[4�
Static task
static1
Behavioral task
behavioral1
Sample
e63cdbf8477b8c798cfc36fcdeeed42bece57b7f5d6a37deb7f0a1f487a9d762.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
e63cdbf8477b8c798cfc36fcdeeed42bece57b7f5d6a37deb7f0a1f487a9d762.exe
Resource
win10v2004-20231023-en
General
-
Target
e63cdbf8477b8c798cfc36fcdeeed42bece57b7f5d6a37deb7f0a1f487a9d762
-
Size
15.6MB
-
MD5
d31bd9c0765c43a94cc2a7cd94160a1b
-
SHA1
5fb6e0164fa3ffd72d752dfe6da145623d52252c
-
SHA256
e63cdbf8477b8c798cfc36fcdeeed42bece57b7f5d6a37deb7f0a1f487a9d762
-
SHA512
9d181cae8c6ef409b79cdbc317ce138a19f7cf00fc72b9e46bd8f5b50218ad706fe208af865bf62a330ee57e06869127f0282a37fd1106f6286be59229af1fc0
-
SSDEEP
393216:FryuI4xqFjb9mm256NtfnZ6sKd0ucvQM6aMRR:F9IWq3mm28TZxpucvxMRR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e63cdbf8477b8c798cfc36fcdeeed42bece57b7f5d6a37deb7f0a1f487a9d762
Files
-
e63cdbf8477b8c798cfc36fcdeeed42bece57b7f5d6a37deb7f0a1f487a9d762.exe windows:5 windows x86 arch:x86
168708c1c734fb3aca30d8f108b9d043
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
htons
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CopyRect
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
LHashValOfNameSys
comctl32
ord17
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 820KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 387KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.afwuwe0 Size: - Virtual size: 257KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.yuuatx Size: - Virtual size: 334B
IMAGE_SCN_MEM_WRITE
.uubskw Size: - Virtual size: 283B
IMAGE_SCN_MEM_EXECUTE
.afwuwe1 Size: - Virtual size: 13.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.afwuwe2 Size: 15.3MB - Virtual size: 15.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 244KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ