����U�xx�g����J�\���^�٭�u5�@�� ߷�^��ѫ'�,�묵��ϰu��{�7m�6E�J<;}B�'�KM�գ�X2k���q���&��V֟&1�w��߄�KX@��L��o 2�P�S;��N�ș2T�^����d��<$K�9��&�2\����zC���K������ŵH�C�oˉA��/�z�q��ؤb���6Dr��;��/M���a�Ozr_�,���>l��iUS���n_+K#k/[��c#�_��2��?�M�Y�nG9�2TJ��� �� F ����ߜLpIM�J�F���S`噉Q�\{־B���uȒ�� �"�xhmzd�\��'a[�`+�q�p A^�s�r=��!�6X�+sY�_I6e��jPgI��˭w��V���ږawd�*��_Pe�.j��)2%��.W��p �6�g�������Ąg��d���C[�ʿ*��x�W�ެ���\�fB�ޘp�W��u�0�b��!�(K�zX^��p�"wpQ�RQ|��%�+���� ����KT������ A��=M+< �`���t��BU�E/X�����T��\T j!���s������\��WPӴ��7Sh,�Z�:'*� ����_{/���Z��s�Q}� (t���y��X�&����Gn�%9 �gF������[���BkX�t���R 6�l�&��ښ'�t����k�����+%�}��Oww���� ,=60�������K����^�2�Y��Y��|x!�Z���A��D�z��l���W�|e��-1��$���=cfZǭ*�'�z��s�,����p��]����.e� Q���~�p���j��ʃ47�x��MP� �U�t��<� ��{x��q;�D��BA>N�ȥ/�n� ��P�����0c���8��,sQ�mR�M7p7����qxb���3Զ�w:~���j��u�������4���ɷ���I�ELN��~uw�JBw�m� 1��:Nݦ�Y�`xޱ.B9��ƨ�4^��YS���T=<!��s�����ZW����M��d�1���Ϯ͛5x�W�˪���-��["�7:�Oh_���ţq���0K�S��K_'TŃ��n��0�L�['-8P3U�;�ݍ� yj��Tu�5��V 8䵥��ؠa�|̌Hu�Jc!]��7�j$,�o1�iS��F�*�����3l�����ug�C��WO�`�!-� G�%�ae"T.��'늓�����m��Sى���Ҽcv��s�8n���z HE�,v�v^f>�r��l}�2�����IZ־�A}n��W���B`�9��I��~����ϯ��^dN�M^J�ѭ&���lc�2;�˳4 v��$-oR�فs���<���>9���t�Y�� +[��-��HY`[�FAȯ=���Q��>�������Tg�غ��v�o�]�%'���U��`|!�V��W,<=�c��T-�7�]�1�:Ҙ���vA��uaE����y�#CmV�%��������h�K��fx�!�z�c�:z�Y��U�x���FX��_�yf�y�k���(@\T�K��~}�KZ���tZ�|� 4>Q,sDU�����7e�t���ŧ1�h[����S�?Ěz�H�b=֭AJ�h��=d���f�T3с'�?oŁ��t�}�ɛ�%��T �cJ����e%� D���Zv�%�z�'7��h��z;T���z���ެ����k�ky]^��,���p(�nPX�"b�m����� ������$��J I����*����BM�Ԛ�XQ�%u���������[�J��\>$GK��)^���Ji,lu�!�6��@�T|�*� ���7�?����s��h�(����xV\���4�B]h��vGUu�t� m��+������V�ˉt!=?�R4���"VԠ�#;Ĝ�<,�2�s"��+j�xZ��b<Nl������s��/xN{''�n�٪g������N\�h���bu�[�^�"zH�$��M��*��`-���/h� Qʨ)9)��m��E��x��R�Ej��v� �P�݈�(9 c ����%c��/f��K,x�NIOC����L������R�=����B�{Y��J@K��T�4)ٷ�5���`'&mr��9Ue�A��`�PO�}���;��8 �E��h�����T���|�*�5�P\# T���@?� (��� ��|a�H\.h����nԵw�k"˃c|f^�")�~�A��9��Lr�/==J/�3!K(��b�X����"f�kE�*�es����_��<��O��ƸX��r�L�ikx���4\W��X�g� �;���D<�kπJH��Wx��`�22��w/B��GO�b�c�=;-����o�8+�T}7�:�� kPEH���[O�����g&�۞]���_��031��E=�B&F�y�R��p�J$9R:�E� ��q��E�s����."mr�J~I%���k~��V�+��QY�2�B7�����0J��������ψ������l�C#��b�o�5T�����k�jo�����yK���2��\����� @�6z�'+�������E�n�5����]hՑ�`ؕ�u�J����ds@�)��Zv Eͅ�� 6��Rb���f'�B;� ��n M� 4�KPIbYYt�����#���%D?jR�uX: 6��l��uT��d�8F����q�&�����c�B�u������R�ES�qE^�[����Bغ�4�~�>�f�O����g� A�k%���㩤���8T�3�����0�����e� �Q�^���u�蔡�=*�V�Ɋ\�n�_��B �����:s��p�mb��v� ����_����B�����ѺhX��{R��x��[ ��9����t����=k����Zѓu}i��Oj^�b�*�εt�=N��Jkx���=�z���9���D�>���^�Y ���T�5e�LB��oThI��=�%r E CۣD��c6���R�zI�D�������Vh_�6^���41MPf�
Static task
static1
Behavioral task
behavioral1
Sample
04630d8e8e2eae093ac2ad8eb78e7285.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
04630d8e8e2eae093ac2ad8eb78e7285.exe
Resource
win10v2004-20231215-en
General
-
Target
04630d8e8e2eae093ac2ad8eb78e7285
-
Size
873KB
-
MD5
04630d8e8e2eae093ac2ad8eb78e7285
-
SHA1
fd01b7b792ca73bb93394ba7cacebb8d8952c490
-
SHA256
32e53667e8dc7d62f522463d34a9ed87e1853733a92b54e6927b8ec157d1ac7f
-
SHA512
ba82917b2182b67eba4bc3da2d3cd2ae5760d275a0a9ecf12839ca6ffad9cfb09bd44d369880367a962018263106c26d8056eb01c5622d756f3a934f1cb24dad
-
SSDEEP
24576:RxYsxaCrWJ29GxYzR8E6eFZfeLhJxHcb8OD6iq:RHx9rD6YzR8J6fSh506V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04630d8e8e2eae093ac2ad8eb78e7285
Files
-
04630d8e8e2eae093ac2ad8eb78e7285.exe windows:4 windows x86 arch:x86
b14efd15e9daf1939cc2757882c9fe45
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
GetKeyboardType
MessageBoxA
kernel32
GetACP
LoadLibraryA
VirtualProtect
GetModuleFileNameA
gdi32
UnrealizeObject
version
VerQueryValueA
ole32
CreateStreamOnHGlobal
comctl32
_TrackMouseEvent
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
mdll
setnc
Exports
Exports
Sections
.text Size: - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 864KB - Virtual size: 863KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ