�l䷁�|�┻�Ю���O(%�r:0~#�D��B�6����q�ݴ����Z2�!�g .+�I��ˁ��VF�~��� &�-�m�q���'���H�q��, ���b��L� �A_K36tg+=���){�� ����T�l9���e�U��\Iu@�������y��%���Cq��\}ۊ��R���O�Z����UF�}�s�Cqx�x������� �����w�*%>:���>��E/h:@r=�uf0`�Vz����W��ݾL.����PB��ۓ:�\�|���K�_�Y�O��_�HhIo�u��z�gc������-�������l���6(�ރ�u(��hO��>Ѳ��E|#8H�a��F�r�����h4DA`w����w}_�Hש�I�f]Ńj�����/uQE���ꟗӔ\Z�����Z�8d_�ʱXd����s��|�Tl|���]з�es�*�l��z����8����_�p� �]����^@Q_`�FN��s�1츨�9t�g/�ts|�OT��>�-p��3��&����U30�\W; ����PX�Q̿-;oT7� �j,9g�q_���/nw,�EZf�к5�y{}�n�bE�i:jO*N�`��a��~!)�����S��UdT[�,e���e�l�Ub �kE? �} �3<K7wyycy<��AfmlY\��Dq�o����0`���#��2��+�z���� ������T��\r����3�s�F�;�c�X� P_5�<x�V_I�~�>?[a��72R�f�:UL)� N�Y������{Q��Q����5���8��L/$E�?���#����������9,�?)�5�tZ�rߓ����}��ȗ������ �ҥ��5_��j�@6���Aį��WeAp�{<#( �y�7�� ���j�>���~��S� kIu9��K=J�r��Og�h��;q8��K7��'a��p���y�����p���}���W�腱�?�ᥑM?�r���|���tz�=�aӿ�;���J;�"�p�X}���M��\X+�n̨m�Ͳ ���ёN����Oɽӽ�0���7���G'����R�#�L����_6/d}E��&u�_ ���P���PЁ�tX���U�<Iׅ;�&������YMF\2*�ab�A9�Z3:3�L����o�����zF8q����%�~|K���D6��].��$R��9*�`��hgA���\���� ��pd��L G�3�1�Y���H��7��[�/U ����hڷ�P��A3&�:1�HR8VM,+?�Oqt��#��0���?4���+�W.�k�JNSm�6�v�����Ԗ4~�����t�Zj_ޞ���Ӹb#���G`�ɿ���4@)��;�͝B�~s���S�l2�7�6�U�B����������p��S�=5�pB��g���ԻWg�y�]¶ `o~�_B��vB��������[�O}x��9p���<��BG��?.w�Z ̽��#�R]g�;����[/A������z+����Q��-[4�,�Z%�q_t|�0��K�C)�6���o&�>��]u)-k7 �dE��?�?]L!��o�Y�AoQy��c�.Ƌ?�k��먃�>?�sS�-���� EK_��*�\�ж�t�2��iާ6};f�%8~��\����`4<�Xi����2��\��Nfr�MZRh9L��1�8���塪١�z5��_\c�}�g� g�lFKC���,�8p��˻��`�)"0 oS�(D9˧���o����R�3h��}�'M�샃�������+V$�HYB�Y��b� �v�0�u%G� K7E\���Mm%��`C�����N,�� �����"���;�U�Z~���(�a��F��}8�6%�b�������X8��2��Pј;L設wлŬͶ�mB��6��`߾�dhf4�0��=F�&�8�dwF��p��X�XP#x&4_��z�� %��vaLت���g����2\��눸*��Q�P��&Y�������cj��Q�,2�� FX��u��;�T��'�Ҙ�+R�⭧�}�p7�����1%>f�hW�/�]n>�����m3���C>� E�y��̥��4�l:nH�������O���� 0�bG٭�,�#_�G^�͆�]5i��B�ۺ</�(x���~�gB+`��6����`\TlFaO�<�D����E�m���z��Ap������X�A�>���mבɺ._.�M���v���C��y.a�� �a��K(��ZZ��L_�����t&�����HU0���~1�+N��2�����ƿ�A�/« N�'���ND�HƐ��}�!r�1�w8����=�[S��ˮ̠��B�<��'& &d� i�"����s|�����_|��E������u��w��>� �$o��l;R�� ���%ǵ�䶋�]?:*��$H�@��Bq��(��4�-�j뒔s�����9@4:$|+�Rpj���~D���'�?Z��8"Û��hl�ی�4� �?ki���1���!�����p�NCA��@[�bR�=�]�c��� ��UB�Y����pUh^}���!c6��K�$-N㿧�����U��jl2u9<[���W����V]O�Up!��t-�҅�A�o��Wk�"�@n!�����JScj8y��3bPb�"X]}:���5N���Y_�z��2\������Qۥ� x�/���3���27�a1Ù�ks�,P�U�KB2� ��v���� �q���*`�K�e�~�r�i�7�R�9���vD��3�sD�[ _�4�;�y ��!P���N�.�����b>���F��Q�֜���zcjّ�3 ���&����ͨ���u�stp�V�T �I! ����/� &ꮵ�}���jR=��回M�_��9��� ۛIEL�!��<` a��hn���[����$tyQz9���ۧH���1c� �R��ۇ��� �� *�4�z��I"GR�'���i&���VT����֠3�T����G���MG�~�F2y�P�M~T��?��\a3��>�`��9;�����W��)��tm@֡�b��Z½�
Static task
static1
Behavioral task
behavioral1
Sample
6a035004be2e810435ab668cc348bd74.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6a035004be2e810435ab668cc348bd74.exe
Resource
win10v2004-20231222-en
General
-
Target
6a035004be2e810435ab668cc348bd74
-
Size
1.7MB
-
MD5
6a035004be2e810435ab668cc348bd74
-
SHA1
56fffc0d99587f9f3a2dfa35096af22063071327
-
SHA256
ceee8e22e697887a7a308fa2982a96a99b69bab0b09b0443a30ccbbab5e70790
-
SHA512
71ad66d25c3f8e82253b604843d1ce4d8422143f1194ae29c237171eb0596074c5510e5d34dad6287a9f0ffda65dff968309b3012622635d3a2a0dcdd5d395dd
-
SSDEEP
49152:1HRucKultg/OoxqMFQ4He8s+VZj1zD0et51UlBwu:1tKulpMFQtN+Vtp04UlB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a035004be2e810435ab668cc348bd74
Files
-
6a035004be2e810435ab668cc348bd74.exe windows:6 windows x86 arch:x86
5a99307991357faaba75b020a8fbb385
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowLongA
gdi32
CreateSolidBrush
advapi32
AdjustTokenPrivileges
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXCreateFontA
Exports
Exports
Sections
.textbss Size: - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 850KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ