�pޏb��)��ȸєʹ��U)����ۓ�B�kI�z��;Y�0�m"B����6x��Ԥ�#Ѵ3[�b1R�������D�)�v�qS��K~cy�l�@J.`��01������B�S�5,��G��6i\lb�����$�J%HW�^���Y���پi.��~d}�A�|B�=t�{2X��=8�.��K �⦁z�/��Χ�u;&c���'^��N+y��� ����5;G�������|Z�W��G[?��t����9�1 H rx���[����n� !h�1�6��Ne���={c �{n�)��̗D��`�=`7��:71��(�L�H�<V�h���#��VaWik+C^�,����tw3 |K^�5"/\{C����`�����0"�v[w��J�o�<�6^���kL�6���(S���g��X��s��l�d��$�.�d>C2ALAH .Y������m�!G;�D�#�U��b?%����E�1-��h�gT�e%Qy�[t�r�R��_)6ШV�q�z�ء��RFjMǒW��d��8��:�����Nt؏c���搠�LX_i����l��W��N}�y��s�}x��y�� /�Z�ĉ�6����zo�T�_痧Ut��:z(�e������Jh!HqiD�&3��g���KcӴ��U�0|l�� )+.���>�~D�HO��u�H)4Y ��o�r�.K��D��G���z�wk��26#�hQ�2��O�))�0RC5���Z@�{H�ǾO��G6W�����r�{%"LW`��c�f1k6q����3�e ��6�L�0J�\�&� �)���YA"�}bZ��s��~�6�x�'�N��D���U9e�v٘�hzŠ����۟���pe�?'b�UQ@���܁���4��~��|)�H�U�GC���L�"���R��,���am���1������s�;T���3I�i٤��2m]�Nz\*!�����&�hN��^Q�m��N�7��Q�l�+b�sn ǗfC~R�I/&f��M7>ޤ�4�0���$��O'�5x�1"忰��,o.��y��������d�+����6��U�E��� ���#����^g}��ڻLB+�C����tV��攎,kD��J�P�Wv>����|�j"��Y�o�Obd*���d�Ɔ;ш��Q��G̸�ʲQ=7&X�?!4t�#G�4u��!@���u_�v� �rYa�7��n3����в�� A��G ���Ƈ&�D�[�cv��U,�t�M����s�p�xm4���-\w.���I�;x#��TJۼ�ۼ ��H�\�1X�4haRZF$�������e~��r���a3 ����c#c���a�Y�.?9��@���W��aB\�9+�@2�1,߂���B��v�lc���z"X[��"��1���:���Р�0R0>��Z3��&2�6�"X>S���3�����_-���{w[�)��i���x���cZ#1c\P5H�H��� ���ĕ�p)�!�R�IT�!j�9F������^�ˑ��\�T��X� x6�ey�!FcIu>�K�[���!����v���Pіq�)��������MC]����n&Dc��d�q+q��Y�ÿ��b!7ǝ��\�(b���/����;xp*�&�Ąe��(w#z�MH]@ <�,��r�3@�����n+}K������3��t��n���F�0�n����ʸ<z-=�N�TR��*�Z��N�I�O]�������<�1�&��N�����&����vGL����F�浔 KE�Eҋ^JI��<��2C���flb: ��!ㇼ:��}�������J��{g�|���Q��ʘ@% �[��?�]��i�n�/���ܓ�xf���ۿ�,մ�Bݤt��a��D�K�?�fl{�&SDf�ϭt�g�Lh�k&a�P�s�I *U�t㕝�T}�+�%�n�-dž�8���&�c- 2�n����^o�΅6�E>�@2�ƥY��Ve;���ݞy��_�|:���,�J�|�Zh��[�+�A^͋M��I7:� E�Џ=ON�yWR�0�-��+b���A��E����2L�^�=@�.id[a�:��(���+dr���ke��%�<�k;�����?�+H����X��^���!��ԛ^X�{�ز�Q�(���b�u)V��fO�A�_��$Ed������%~�+�����!��V'Uӷ��5��M�X�A$�X��!��Q����o.�� �%d4�=��^���sMԆ��qL:;�<�E4��� u�#�Tybs�V[0dp��N���CoH�<�r�[ܫ����9R`v�F�������=�̛g�V��N���j,�`��@��t���3)���7�Њ_Vpw4b\�~H�]1J���A��/D�� ��de���ƻ@�RLU)��^�@3��>��I�)w�]K�Dv �G ���qp����,�����T븁�3��L�pG�(�Ҫk�%�1����w��{ ��ȸ�櫋�Ћ����!�|�W�}R2D+%�蔊�$��[��M""�1�m����"Brx�85�?l�\P����Ԕ��"�/�����h�sf�5��5V���t]�/������w���xP�W��F���-��,zjz�P��G�$��-F�����ޓ�c4Bb�-��);�Ze�V�q�r�Cj��C�*w�FG�N6 Y��'�Z��_�������Pf�H�Sd��䯚�7��# �\�}g����20��h� �ͅ�6[8S �*�ǥ�����T���+����q�mT��5� �Pe�P���!��6�TR7@���#�����Y�e����������Sw����C� �̵��E���6�&��^F��������o���|�7rY���t�p&TG5�~��^���/�����-����F���/h��1��������uD��]]$0���������o�r8)J�A��ۑ� ��gmA��P^6���K��伾���2�b�b�"����|[��� ��S� �1�}���(eΐnJ��؎~͋�M�,ǵ#C��iZa��%:⛞O KeR�0D�Lx%�����v�݊�QG��y���);�r/
Static task
static1
Behavioral task
behavioral1
Sample
0e6c4a7c9b649b4b511b39a76248d506.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e6c4a7c9b649b4b511b39a76248d506.exe
Resource
win10v2004-20231215-en
General
-
Target
0e6c4a7c9b649b4b511b39a76248d506
-
Size
4.4MB
-
MD5
0e6c4a7c9b649b4b511b39a76248d506
-
SHA1
6dab5f918c20d8f43f2052a1043f4a5387599fd1
-
SHA256
e2884b5661c11864376fd36dc47ef22e2f809c57529c4efe15131a64a7a38e6c
-
SHA512
71c5565ca2e5fbba1e987ad28e04480cca7caa6e2804742284f51c57fbc6401481835e78543cebf5484a4b8d5d8d0b96fbd70cded0c79c377d20dffeb7913da3
-
SSDEEP
49152:kqWJLFHPYzdVy43kz6rcViF9hBjSZxtvxPscNznmAMCz0BAjKWsl98Q1F0foUci0:kbzvYzCgHjSbscNCpBAjPogw9qa3IPk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e6c4a7c9b649b4b511b39a76248d506
Files
-
0e6c4a7c9b649b4b511b39a76248d506.exe windows:4 windows x86 arch:x86
392fa302444d5ce7a181229b8c0e8995
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss0 Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss1 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss2 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ