�Q]����V�0��H0���0=4��e�s��]oc:)��</�kyxoon��2�O�%���㩵�b?Q&J#�D�o`���6?�k�� �exm���*�T��G�B���ʔV+�w�J��q��>�W�)��l�=���7Q�;��bv�����F��������k�7�3�F{�ӭr{�(/�U����e�4a����bcx�.�2]��a9q4���LJ�F��n!^����2�U�n�:�7Ƞ����<�=��H�W���N�J���Lpo�{���Z�1-'�S+6#8�6�_�)�F�n��T��=��X!�8��#�娬��`�I��;��0��y3#��Xpõ��B�������ޔ����V��h�[dF�QY�M�gȄͤ��R:3o�*VR��r�Y����gp����0>�M%�����ы�x��J��`6��o>ŦL�G[���!+��ʳf��M�5��!3l� 5�\0�}�Ib�a[hܴT_q�w�15����nkd34π'$+�����~��g��_��VN�RcFC�� �(�����74,�מP���6ҨS�p�"d�K�-ij�,���Խ:�?��!��Dg�4t��� f� ���`�@��z NUD��A�a�����"� �^j�b�f�,���L#��"�o�\GcV(�9�P.��_�d��}�K�m+�z�� b�9Qf��CHW��Ts�+q@S]���R��U���8����6'榛���[����@����b*H��8EdW�Tӆ�`�؛D�ݺ��06���3�l�i�$�T/��:y[�("��.����'`A��V��B��XԆ���W|'��)�i�x(\Uh����>9=Ijj(!�6c9n�Wˤͮ���E�w`�^��A�%�����8 ���;~��8ݜȹ:Of�����)���������?e J�F���'k;�uk&��l �����elfv������]�!z�Oϣs1,���{A�Ed3�������XH���!�r���F��{7��z�=��(�Q�v��%��/`|W�if��C�>�]� ;a��Uq4��.=�%�,�5`�� j�@?Dpq]�t�K6� ��ȯ����E���GǛ�E�v����fmӉڇո�5�$�i]Aw\�������,}��j����[��S@G�MDe^�j�$t��U����<1�����G��m)���r��D�Y�Qi�N����ba������wC`\1Tl��Y��Hۓ!;��SH�И�ܟ�H�^�۫�p�����*ɭrաo' ������{�(n'k�h[Y���'G%��"���s6ΆV�'�eu�����t��bL���|��Ciz���Z���[��ՋL�g�Ͻ�TywCSV��;��N�����^R�1�K�P`3��a�� M�~�1b���3 ��aٱ���Fە�X�\9�� Z��B� V���VE�p�2��8�����������z���,�h_G�Q� [i�����6���eꦔy��z ף+ �+k�����������w��.�x��|-���ʉx0�!��\�� KK�nj� m�- *�]$6^o(ba��o�~a>����/��݊M0��y"Ԓ��ø��/�����#iy~_K0�3��|�$%�(��ei)oT?s� �@/�>�rlC�D�_^B�ɠ��+X�����:c�c->��u�!�B\�$��F��������<��Ӄ�4�[��wC�����=��N���:��hq=p�>@!�|��X*���Fd<Ol=�P�M�ͪ![1����"��gC\���������pHgi\!��L?=c|�aVaj?�M(�� ��p���X?̶%f���7�W� ��Х䱛;?t�L����o����� O�m)��1�+��œ�̱J}t�}^�/!�����W��?���2��r���d뮊�W�t�T ���M:.u��8�4곹��$"�V�D�'����G�o��)F���#�γ�Q%� �?_�����?�<-�j�WjQ�n�a֧��1�8�e���+�$k1%k�.SMFz�S�G�~�`�@z'�9����%�����+�C��)S� ����<����2yզ�.(�]��;�Ưc��&�_���3�t3N�iA�eq˕ g<���6Җvњ"Ke�⻠Λ�ωg �"��w=)�v<��ւ*� �\S��&V�V�AX��FX�g��x�Y|�$��Q��k4~�?�4Xy1��K��|e[��p��'d[ P��B50u�����l��҅�p��wL~.�L�\ֳ2��fl�~�+��ׄ��n7<I�UESy���3460%�N�g�������6ԓ�E���WK�wd�1����5'�[3!+��Kg��6�� �r�� <'��� �w�&5�Zɾ����Ye�1�n��U#TL���az����W���r8`�8����8��t39/��[W�����5��N�dw+�t�Ӿ��C��{�t���|l�-��O����Gb fA��N��d{ h��{I~��Vȏ<j�u֏|^M^t�R���Y�|pM�ӧ��������3�����ì�@�7g�8K�*.9j�G����(!喒���Abh�K��y;� ��n�碡M/���g���B�R&2�%RG���v�q���OU�swkt4���+J=(�1CF��e��ܺ ��)���G/�I_`�o.�~u !�/(�!��տ��7�Wg5�2�&�؛�U��6�B&+T����p�f��x�y��l?���HFicg�y:,��-��l����ʦȦ_��|;�Z�c�On+Zc� ��m=��3��%�wg~P��X�B|����ݟ�K�H�ج�Ꚋ�U4������7T�����jm(V<�ׄ;��<�����E_����B���� ��V3ZV]�]�R�� �7_��ː�Y�� �5��bP�M4� �;U�=e����|1pkFa�!ҍՓރm��vo���I,�5���Hⅳ�͡ˬ��o�)��+|-e �Mb�"D �U��Ρt�f6�e��� ��Hl#9@����]lH
Static task
static1
Behavioral task
behavioral1
Sample
c29e1cae201aeb5c0652475b566f1493.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c29e1cae201aeb5c0652475b566f1493.exe
Resource
win10v2004-20231215-en
General
-
Target
c29e1cae201aeb5c0652475b566f1493
-
Size
677KB
-
MD5
c29e1cae201aeb5c0652475b566f1493
-
SHA1
015e306a5c2d5cd430a036fb3ce1f5f17ea514ed
-
SHA256
e87f14be1915a7309547421cc10b7b63fec6550273fc27af70145ddd2b437968
-
SHA512
ecdd54724cdc490973ee9c6b912000df567c6d6d51e5c844c57466449961590cd2429fbba3bb90f99637da74f52137d79134f59b7299d6881e3632dc3fd12922
-
SSDEEP
12288:rLNrzbaCozBjXc6iAvpFCWgaK/lGRgOUqmq9kR6lhKXbae/flS/ri0CNaK:rxbP+BjJiGK/cRgOnmq9g6+5/Nl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c29e1cae201aeb5c0652475b566f1493
Files
-
c29e1cae201aeb5c0652475b566f1493.exe windows:5 windows x86 arch:x86
163982c9562e9fa0a72ae1f4463b23c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
MessageBoxA
advapi32
ReportEventA
oleaut32
VariantChangeTypeEx
Exports
Exports
Sections
Size: 188KB - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 52KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 56KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 300KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ