��PF2;ok�}/���3�������((�W����"�Q���v����>#YUQ+�KYXF�#�`��gK�{h���4��V���ʭY��u��âۈ����a|���0s/��-�%C����.YHA:���v/��?W?�����{����{q�]O�&�A�G�*�v�þ5������x��{aѵm�����'�{^�%S�b��!���^�>�l��3�£R{Ķ���y�X�� �$��%�����}�1Dhp�c����0r��Mz�u`���?i�eJ�����)���p��\QK�F-s�b<�eW��ʔ���w�ڝkr���bǧ�\K�~��)�e���9�����꙾ni0�%���"\�G;��)@9K��^"��Z��a2h�Gfg4��]�����0\�X�!;��ډ���pQwn������G��3��o�*F�w#}����� ��m�H���O�k`�#�/iG�|1��u%PU�`�4L�ެYZ4�Ш?�ړO,r��R5��\�_��X&)q��S��������+\;IF1�+j_Q��`dxV�a۬?�������KKE��5����~%�S�y��N���x�Xq���s��~����]�kp}y�� ����x�-��'��Z��s��V���N�&Y@Iy��������N.�4ׄ�+�8�nd�;c.T��W�����}����f_�R�o�Ċ諻h� �'���Q�tK�t �/�2[^�"T�%h&��qY�q�`���I��TM~ۺ!%��#���{����P�D�7��?+w[¸ �aM�[Q�s�$u���X��ؕ'L����:/p+jA>�ZJ���%���.�HVB��[,���~XRh�C���Aj;�V�� �g�����2�#M�^*�{V��5(����)��,cO���wdV�AW6#��"� ���[��É�;��~���\$e�N��"����i��ni����6�28������qE�� ,�;�'EP���� ���f�"�x���|��3{K��+U�@c����{� oOiG9X��G���9Ѱ]8�S�����V��L-zFqZHI�(,>����� Ƃ��:<�|y��"���A��w:�Y�H}"j���&�<Z��jeHɀ��"����G��O+�㖦���Y^_]⪲���"���rkplPn�ĬX'�> f여ţ�&��-����i�� ��O"Ѕg*���XIi�P��ysgc9�Hf��7.�Q���5M���Φ]�>�qVG~t���ڜA�?���������~i�J��@[�W��:z`�ͦ��o8��C��v��QZ��{-�o ���WX ��F�����S���?4�J߉Vɒ�[/7t(q�e���oUۉ�+� wfדP�U]F�Mti�V�ۋ3��в���&@�o) �L�[���c��Qo�W�� �/��bh�Mћl�OX{_!H}.ǥ&�_e�f��ǐ����z�0ĉ�AwhbU 2֣r~ �LT�V.�o������ʲ��NTR�b?�P��̬�Z��R-p����y�~u�{_щ4$*���`�C�����e�`��(�������S�7�KO��{7��� ��&` ^��3*�A5b�'��Հ��9�J@�؊sK�ቍ�A�¥Gz�Ǔ�e;��},��,y�,Tb���R�Y���z�'��`��\#2�ʧ_�)�x�����XU�%`��>GS�?�{�U`h.K����^"�Y����տ&ܦs|�Hn�j7�����o�9D��8�ni��F��;�\ב�Y��{^�����W/�9� is����x|���Th�`O�{;|h��/��RX��=�SrG���b���4�<��ٵmo�-w:���b]�zX;��T�#5�� )ĶbR!�WL���� ֫L�8J����"�Ě�|Z+�#����݅G�����c=�㠸%є\d&�x��XKA��j�R�b��B�����~v+���$�l�h��C��Z����6�6>�߷e��`(��� �V�Q����Vva;C�Me�3��I7� U�P�ZLJc��Dk�����m[i��E�7�ƚ;�yA#���C�x������y �M�7 8���g�n_��� sŲS�!0�V^WP��iw�N��^hJZS}���$vg���{��AaS`�;�@��{H� Ké�%�-���*Rd��e�0g�>��&��Fx��9f�<�L+]k�|�tV�pꮆk֢�Ӟa�Ư��MЊuo�i\�D!c\8�w�6x�J���ܬ9�x�<"<q���(�[,�#�Ox��!IL�䩉,)^���ؠ�x���3$1ͫ�LԊ�i���k�:X��?� �3�{��A��a��41�o�m���cV�^u���"ASO��1��ˀ'�\�-�u�6�#a�������tmz�[�����C��<���ӄ�%X���m}}H�f�j�����~q@P �L<7����I{F��K��S@�H�MT���>RW�G�W�?Un/����� �/����EL��%=�1��Cy���E�H�ֽq:�w�����e,[T]v� }��7�tB�@���(zm\2�ӿi(F��Jn����r�w�PL��5��DkE}C�ՠ{x_�9���bӈ�@S{��C)��ձ�$g��S/*�h[NB����P���\B�sR��2y4�W��U\!��:LA2[sFhSK\"#���S0�{��y��0ZRÔ�)�uuLsQf@��4\�� G���e{�5������)�09� ,T-''BQ���`|�;�!�+��W���Q��Èeu��@7�eJ�x*#3���IP_>�i\�8�W���lQx����tK|41�4�%}��=E���S�ӑ�����>�I 5�����_�f�%��eĕ|z��4JO�n��<,ֆ��#� �vvջQƏ��30@�<8l뺺�;ʷ����yR�w�����Ϟ �ݗ��Zo}�@���v����Uc��IZ>�&c�ag�n��\��1��o���E�<�g(�<z���f�l�ۦv,����6�p9��p=;�J媄!3`
Static task
static1
Behavioral task
behavioral1
Sample
0c63665b87d4033b4330e27e2133939f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c63665b87d4033b4330e27e2133939f.exe
Resource
win10v2004-20231215-en
General
-
Target
0c63665b87d4033b4330e27e2133939f
-
Size
988KB
-
MD5
0c63665b87d4033b4330e27e2133939f
-
SHA1
2f82237603d793e9b8c83b5fc13a50ddad08e027
-
SHA256
6f828c4ecb657b23da8e653aceab405176b408dec990368eb4822efe2a6659ad
-
SHA512
39d2afd43ed2331602e5931f62e00d4b7bbf4c00b54be42e755f212bbb561df4bc8736cf3a806cf33da406ff63f2fcc06a573f508939cad631d3cbe0589bb89c
-
SSDEEP
24576:5VSOxMVrsiGMJCBLNMDE/DifspfH6yYtvYGw2Nof:5VZyQit8LNaE/Dwcf6dYGwpf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c63665b87d4033b4330e27e2133939f
Files
-
0c63665b87d4033b4330e27e2133939f.exe windows:4 windows x86 arch:x86
f1660e0677418e60c1ce3265bf290ae5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
closesocket
kernel32
GlobalLock
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateDialogIndirectParamA
gdi32
ExtSelectClipRgn
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleFlushClipboard
oleaut32
SafeArrayUnaccessData
comctl32
ord17
oledlg
ord8
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 466KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 286KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Smoke080 Size: - Virtual size: 417KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Smoke081 Size: 908KB - Virtual size: 907KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE