z��0��'��X�����b!H����T d3��F��VIE9�T������K�������oP��L��Ǣ؞5�u#"p�_���4oH�ݣ��$�^�g�`�/���@7�S�i�s�a�n�?sį��K��j�v�,��>� U*Z�fb s 9/Y30g�y�xUN���Q{�<|�97.a����b����-6?�q������A��k$v����-Pv���~-��Nc��9��1��8-�W�+ i� ���=BU����Ww�7$ӸssX-Tv}BA !����S�+h�nZ.�� V���a�'@GT�J�r#�+�7������8���ތ^�_Q�2)r������4�^�@7�~�т��(ZU��V>bJ x.��X�-1R�,e���ȹ�$�2����E?T�I�������G���y3[% ��\f iq��:�X'�v$\*겒���~�p�����J&�q��i-u4�����T 5��ץ��<����[�Y�@K\Y�����<�I�iޙ���U�X�2��7�"Ж,vWA�������_ܓy���So W��q�b�w���=2?�7�.���,�be��w��!�o�\|:Q�ZE�چ���8^!��1�λ��մaEC�D��8@��IF��]�JJ�/���1t�j���Dv����,�\��m���Fg�1�R����Pg���Ob���ߛ ���v 10F 1 ��s*@%�r*L��PN���/���f��fz��B�خ4�\��R��~�N"���ݖ����V��1�]-��mJ��G۰�,�ZiO3�r��h����=��� �j�Mύ|,]a̪\�r ���Z�h��x� �~�fPm�>���gc��28?�)�����ѹ/�-��~���>Ri�K�]U���?6���k*�gW��7�̩�O��a���Q������>������q��cM�R/��F�Q���x���1p��|������2� �Ӆ�����/�ts�o��d��6������/6t7]�7�~�@G�k�Q�O������RU>�^���mr��W�1�oʡ�\��ey��Z�-&�`͖�hģ:��s������9����h���5�sS��!֢&��� ��I�6�x��pT/��T��^��-w۪���0�]xvD�,��3o�]��K��NvS��sr��CZM����6/�X��S���C٦��> ���m:E���n������Q~nr�"D�ǐw���P� B���Kψ�Ɣ-DO�k��m������,�º�*#m��Z@��s*7�v�D���#�H3�����B�������PV �}��^u��J�sA�8�2��s���y������F�/� :[;�nW��\,)������<1��"�̘��7e#����F��A�����V��R�ޯ��ʉ�S����ҜS{њw�Z閔��dz���� ؘ!*a9���p(~�<BS�bfk����O�����a��E���^Y�}v�~zȯ�f���y���"�N�z*�y��������ى��p�����zȓ���\�k�9۲��Rj�Vz�C> Ri@���2�����Ea��hܓ�h�?4�d+ ��J�IMj�۪"�|&�g��ר�sY#��s���!�Nb���v���k%�CoK�5+�㯷�* ~�ƚ��l�_��]D74��݊�$�������b��G14���ՠ�z*��\%�����I2Pu��L���S��)4�Dr���� =a|]�����i��ۧ�q&�H&C�i>�������<�\��X�z�x�h���7�R�.��SA=�7թ"���I�Äi���S��кY���~D�Q���%7R=n�Ϡ�`�GDx�������;ϴ�S���x�t�����DKե�;�}��[N��KP���[l#8h*W���6G��z�n�����:�C%�u��'�ۛ�q�\��d}y�M�M@i��P�{گ1a���P\�mW܈f#�����%��P�47PGf{%n�Ԃn�r�"���N~����/ 3 O�q "G�>~���t/g�2�}�{����vL��0�AKb�M21�i��]|�/bx邒/$�['���<��(Jםo�".V�-֎��|q�2�����f�9?�0��� ��(�A�;Rt}jȽy�M9��"�1 !���$�̒�,EZI��� $�= I���xD4�a�_�J\7�iu�����П��C6D��Zh.�E�VL��f*PrR.z�[�N�0��[���l���X��p呚A*$a��b�@�0�&�Lz�۹�:&�����c>p�k�[�=m(Q�7.����ҩ� ꝷ�Ž� b�sL��WK��]���"{�*{������^�G7��F�BGO��lB��=���k��~�懭Ș��ѮD�Q�Q�X�ڰqQV�{lS\%%��C���k>����v�Ec�.ۢ}JӀ��JG��3m�v^o�%�OQ �*��Jp�;��Cl���:H��llq�e��D_��Y*���*+W0���1<G2Vl�8}�H�&Ut�=��2Қ:� ���Y58�RЅYO��ϫm���M�,����*-�vo�z*qp��ie��9�#�!ܫ�{%����.QBL���SF�g}��<�o@:��K�CB����/�4������}涫GX:V��f�Gs�J�߀?̆Y�j&� ?,��H�(t^�y0�_6��G�s�?�}�+h��O��D>�G���\L����42�v<S���N���:�`zN-�V�}̴�7[�k6�{6�ӘI�vQ��@�.O�Ipn�����agR��"�zo�@��>�����!z����y~��\.ij�� W*U]ˉ��ŀ� 8���b3}(y�� ����X,,���%E�z���t�-@ݬR�����/{���~R��o�!guy�2��[\�nj�~�D39��A+�L�N�]�Ԧ��r�2_�뢉 �!|r�+鲝Hi���S� x��-�@- ���!0}�>4�}��sah��.B�l3�3�Q/oՆ��S$c��a�%�����)�0�a��"OcH��Tw���
Static task
static1
Behavioral task
behavioral1
Sample
29814bad0b56d822af602b345f948377b5c0548f738917edf41dd98d7ab8c0e0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
29814bad0b56d822af602b345f948377b5c0548f738917edf41dd98d7ab8c0e0.exe
Resource
win10v2004-20231222-en
General
-
Target
29814bad0b56d822af602b345f948377b5c0548f738917edf41dd98d7ab8c0e0
-
Size
6.6MB
-
MD5
e96f8eca621164a9d6190296e365cf65
-
SHA1
2541992db841117ba2929181ac3194a779e3f551
-
SHA256
29814bad0b56d822af602b345f948377b5c0548f738917edf41dd98d7ab8c0e0
-
SHA512
7d56e81acb78d821b722e71a6e00f5d9a5a8e59f1bd0cae550fdb4ff803a4ba1fcf130a93c9b516b0678a201208bbb0a7db2e1ee5c3a05bfa6713cf085209b3b
-
SSDEEP
98304:UZ3EWOzUbEuNzjynrKX5iPNz//Y7od4zCXVwLOI58loMUwdMWK722xKi+79TiRg4:UZ3El2EQ3oNPN//YMdeCXViOIOZmsfY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29814bad0b56d822af602b345f948377b5c0548f738917edf41dd98d7ab8c0e0
Files
-
29814bad0b56d822af602b345f948377b5c0548f738917edf41dd98d7ab8c0e0.exe windows:6 windows x64 arch:x64
27d05199e889c75362388450a6cfca55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleFileNameW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumDisplaySettingsW
CharUpperBuffW
advapi32
RegSetValueExW
oleaut32
VariantClear
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ftext0 Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ftext1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ftext2 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ