�n��f!~�W:�Q]�H� �͂Ӱ��7�G���+豅��_/Tx��7nζte� �Ϯ��,$�� 9^"�a�Z��/�#Ж �=��_ȿ�Im�9ut�#U� y%�e�(����G�����.�Y�A)�ǹ9�y0"[pb�YUcNVH)?\k�R��$ �G%�Q��v6����Vfeu"�؛c�f�v�k~�/v�nF7%%|��U.�B/A�_�}���>��{�����H0�@ɫ%�k\�[�(����뇟��|�ɸ�z��4��r]�U3�}�\�����'�� 'v vS��%N�=VK��?��5�T9��،z���� J�b�~��+��o)�j�%u��>���4 ��El�n�Q>��=~��4A�4�3�����5U�Z�������O�B����[�z��ފ?��e��(��Nэe�Q�����B����OZ������s�`�ZE [R��1���L�����,���ʷ"�PI��.˿����Iu�$�$HFE��GV��<��d|Y�$��w��l!p�m ���LO&%�5�$d�wIࣔ Ź' �{(9���)��Q��=�H�R���/WV-�ِ�xd��f��2T�f��J=t�>_QP�҃r���8j-d���"��1�㗴c���z|7ȶ)�Dgu�{�s�n:���&V���Q�=�<]���!'��������xZ#�Y|�I�:�fL��ecnZ����z���З1q���/g����E�!�Y���_�B��<�ڰR�~�X�~{ ��n��p����~/�t�T�m��P�$ЪސMq��[�$�`Y6߭ka��D�ǽW�|�k�n7X����mSNMQ�^��W'�0�V˷�P�!���?i D�Oδ���u~��=;��\A�1w9boD-�ܣ+���I~������X�������*�P�0�����}�v�+\�b�c��2�� ��� ɱh�%�1�K�ܬN��T�W���Й1�F�/���^��V!E^>-T�oj�0N��C���n���D�~L L/`��#[���r����q?0�������b��K��_ ���U��n��S��+[�}+%��3&�p�e��-C��ꌄ�M��n����m������g�X�? ������ �� ����mK)NR$��U�~�A�ߊ�-��z0^�kZw������i['�A��4���m�ӓ WQu!��Lٔ-\��x8`�{8k�vۙP�H�c6�!�$���C1� �$�7"�Fui>����ȟ���]�3���y��3���a�3�\(�헨��*�6h�Ó�O\1ھp�~9ܓ>G��j"������oS�{��Ԝ�T��Ҕ#��g���~g�1�#���2��/�m5��Y�AX&H���RL*f�� W�h;e�����+�� "�}1�GN U��k���W<{`4cuI��Z�ϛ��6g��5�b���8��3�m_�#��Ą�ڣp�-s��I�7��i�T�����&ϗ�y�U���۸+�X�����V])�.Z���zj�qE~T��2�#zj��]iB������,�~�7D~H9��;��&�`h�!I�v�Po��fo���o���O�Q�&I��[x�`D�C),gx'� r ����1(i�gjϤA|ˏ��2`q��|����_��J4�k�e��h�WU�����TЈ����C�rh��K�|���-�k�l�%P�o�ôؿPv�5�x�?B&���)zy?�Hs��M�1�ya����١�E�B�2܀�*���~���zY,NU�~�(G��&0eG9\^h���qd�d�{ &���j���I���e�)G��\���p��aBN�gX�}��+����Hn�v�;�r�H��'I����ל�ft��P7=��c��� ��po����h��[bhm\\r�_�W ���pط]�o*��U�?��Q_�-#CA n}8�'BA�x.�_���9�����3 B7�M��Q8�dLs�����ʞ���y��uϵ n}�1��sО*��������0��V9��*��\�(T��c�'��a��i�ۤ���K�_l*s'a=zfE���Nf��Cy_�B?o��:`t5�Q V0oO�w���ݖArJ�OI�LͰ.xm�q�}�� ��A�(�R9�&7�M���L�Ҧ+長�^ c-�{�i.��]$�c�t��n#��u0���z6���ʁ��z#Wp|���)�L£���_�ϕ��י��ի��a1����W*ߍ��U���� *��$���@Ip=�;��Bِ63���������1�F��ܡ�ӥY-����wlY�J�l~�[E���1~n��m����10/��;�ң��鵜���+n~�A�&�\��4!�]�s�����*[�Vه�ڷ�e�ؿ^�f��B�fB��]bn��l�Vjq��/�9�ޭ��^�o�)�\���C��*|:�iW I�>�+b�"`)ޝ�uNL� ɥ&N� �⸖���LZ��m(M�(��$z��&���y����c�H�� Zr�@/����"�ܴn�B��Q��1�*!Oc�w�Ŋ��;�[�P�S�x,��Pq�X�E��������0?@ (&m�*��Iu6����H���D�����NQW&qn6�L{�)��v[UE�:2�8�3���2�I��5~��>c�������$�hf}\k��O.\����=�-��V"���ҩ��!�D�/���á:S{/P��w~�o�1�q����uL>��u`�qW��Q�0�Yf,-�����<��x���� i�RSFw��� C�z,�;�&�;�h/�'��ڻq�0JCQbe�� �����x��/ۑT+��J2L<��A�U��5z����B{(��ã4Q��bC@�k�`|�%�T�hc*��]�H�qt�Z�K��S����ݤr�/c.^�2�ތ�*`l2�H�<r��8���Q<�ݲ��V��эk,K-�@�)ysd���M�TȺxT��U��MvAe�O�'�����5�{]���]4��L�6On�0���*I|�<#�%��_(�{rɆ�[����� z�w��։���^��щ��4���fsR;}��{u��Qdg�@��
Static task
static1
Behavioral task
behavioral1
Sample
03c6248f0334bf9173fd9d282e82203f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
03c6248f0334bf9173fd9d282e82203f.exe
Resource
win10v2004-20231215-en
General
-
Target
03c6248f0334bf9173fd9d282e82203f
-
Size
1.2MB
-
MD5
03c6248f0334bf9173fd9d282e82203f
-
SHA1
eaa9c50d99d3d5a4c753100a2d91c13d4002b2a6
-
SHA256
e5b61717bf75c01dc84f31c0eca9b5a76714757f0aac5d0db8528e32cbe5dca3
-
SHA512
f9704b0db5882d76b5de2ed97acd222271aa82d39497b156505ae2c6ed9df75ac917f1e61ab0869751ce25a0c6bd6390f0217248612ad4fc9b279baa1def09d0
-
SSDEEP
24576:tYBAuUG+NZSf+rNkFVQYxBR77ExgxCXrEkM1e6f5KyegL45w7vIsX:S/UG+/Sf+rNkPBR/EHXoJe6KDgIwzIQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03c6248f0334bf9173fd9d282e82203f
Files
-
03c6248f0334bf9173fd9d282e82203f.exe windows:4 windows x86 arch:x86
500670908c8b2eb548b380523b4b29fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 890KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VSMH0 Size: - Virtual size: 981KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VSMH1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ