wT��5rDr��n�J��>ס�k��l�-o<���0Ӱ��o��`�l��u�{g)xJ�"�7�&�b��S��_�'LC$m����mO۠P�ű�F�z�����W�x-�t ��l��(�hה�}����^�$JH���J]�"�;G\�^|q�R��(6���6�?��Zzr,�^r'6E�EBVe��bzv� �R�˷��ٖj���>�������<���]�JD�$�x���0�ƺ<ӨFz�N+�j�l_�a��$��@��.�\ �K�愲��ĵԼ~и���o%� e�KJ8U7g��� CjD.�}��x�8Xr�A�% �5Q�gbx:{W�\�nF��^Q�[���k�<w�Y��F�L����l/���ϥ-~����eZ^9�b0����б�zCT�H ��<i�zKiw�H�@�[H�1aĥ���1=���ؕq������[������#��y��#A[{7���@�`�^u���{�[ ʖ�a�hj��+F����"(f �)�UoS�^[YUok&�T�� cOevZd����8i�M�tz�'����+ ӹd�3�G�4��W�Y?��U�x�Z�R8А�����V�s���^�%��#�Z�������\!�ΡK��O7�hk��f*pZ��.��Z���4=S�g&)Ե�؎ˊ��N36�1�����F�g�/����W����+���-�=a ��^XAp A�Jb�,�<� ol�Q�|�7 ���ͩE�g����/������{1�q;X`E�0af��FtԾg��X�v�'-#?,�&N�3Κy�mYm��#�ngF�A8\m�(����_�p���Ld�;X�� F���a[0�մ %�k� �s>�~%2Y�n�S����l�;�� �Y,��ĻѲ3$��_�!+��W@�������7F|D�F����h����^�oEѡ \G��H�����|RC�c��I��Ղ������L<�>�1�bM���/l���}5�X �lGwd��_�{�o7?�>�#�b��7��C&�Z#�y�i&�g�Co�V�%E�B��ݜB����!{"��������26}/R0�ɷ�H�;?�ȧ� �N-'��>��%A�G�Q��67d���Sł�b������2��5�@�@C���Il�I��'T O�B�_+�N�;� �2���:G��>��I�O��� ����p�̄)�"~=���y������} s�s鹀�f�5ꗆT���n���a�Qݨ[��E���ȅ'�z��u$��7`]��8{x?@e����K����l�;��HQq�X���g?����p%�`�*Y}��P��~��%l�e ��$ξ'�ցi|�����'CN���)���4�br��g�/��oOR�-o$�+� ��:N���A(�����p�0����1���ӝ|���г:#.�A�\kJ�G��ʟY8�=��IIJL44Ǧ�b���n��A�bd�59sw !�����rn$%6\�r�ݎ��Ċ��ܲ`�C`��,�)\m��� �a=q��b�I �?v� qx�U� �Q�w�:$hj �v��������{˒D3�����M��!�9{tY�Խ,��!R&1@s�3 3Ǒ*'��~_����cV������;�$�^`�k[:�!���(.;g�E��ox��Q֕8����\��s뷼%�w��gua���ԧg�v�]��(��G� Ь�{U�>�2 ��q��� �9��9KW�f�҉|i�aA���G�!Т��* �$�� �6�r�)�h�3Lcą~жO�����`Ij�U�����X �����<�.�]<m������#�ng��X�#��{�e8��%��~�J �]lZ�f��v �Q���/��8�z�7�����C�-�R��ȫ�v�a�:�?�Ћ<r���,� x��^��Y�\4������y�J8����:9�|;��\۶+V-�`0g��6і�q�:��_�-o ��2��<�����vl_��q.�s)?w+T ��c�h(J1��$I%}�D�D6��Ϩ�����[)YG����6XB[Y@?e�"�?o�W0({��s^�P��A����2�֗A�����rs¸��V���t�h)!�Ӡ8~LL3��g�_��ogۢ/�qz�B<=Ǜc�Y@�1�9�h/�������bU*�&�s����lp�T�ru�n>1H���0I�F��[^���q�B���uC��v�K�:O�ϭ@qr�YR�^m��+��>^zet�U�K�����#:�ᆤ!�w㊑7��p1|�|�x�c��mV�*P`w�2�\��6�O�b����H�t3�����8/i}4j�N�)6UO�3�� G��\�=�_�Ad��!�� F���}���U3� g#�m����>P؞�,v�n6��2��_�^�l�U&押G����|>�����g�sF���)G�#gPT�3J�xv�86��;}���*������r}x�5<i��"�I?����>2R��x�����6`k�z,�ҧ��G��_�VM)Z�8� q�5+�C�[$0d��>J-n��_�cD�ٽdY�VD����px��0���qb��楁Y���;g��D3�������.�u٣;xE�xcߗe��Sz,�����t�w�Q���,��=⁗z�_���[_��iØg�:�ҥ��$01�u�/����KHlYz� n5a����u��9y�Ӂ(�`��K寵E�������#V���d�3�g�T���9+�6�z�ÿ���U���|��pH�?�UPA��dm�dh��Ƞ���ױ�{ ���,�2=N]���[��H���S�F����rE�31���nh��i1z�2��w(R��B70P�}���;[K���{�n?(DT�x����a�p��K�8l�^G�>[��u��R���(TD%�wV3��%m����ϟ��8V�5w{k�FnS�s�����4א���Rq$����4mM&m�JR�&vQډ��E$x�m�$���M���!��9X��;��lQ�膂"��1Wu'�
Static task
static1
Behavioral task
behavioral1
Sample
042b4335251118b57e4a5858c6113d54.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
042b4335251118b57e4a5858c6113d54.exe
Resource
win10v2004-20231215-en
General
-
Target
042b4335251118b57e4a5858c6113d54
-
Size
1.4MB
-
MD5
042b4335251118b57e4a5858c6113d54
-
SHA1
52aeb31ad80a0ebf938afedb6673f535d5c83ffe
-
SHA256
dd2e4a60971c118ed916de04b0eca08890ced74a7c9c1a8f4a919ea39d37adb0
-
SHA512
cc526dd1f4bcea96c3a15b19eb27b2815d52cd530c90a60f87bb402f28f4c6d9b242ff5e0979fc4263e7551f0bfc153c5dc631e577f6a357bd20fbeeccb3f567
-
SSDEEP
24576:H32WUbHZFG0s3siMQhJtglmeghRf4NCEtzBf5zoapntroA+r0pstCU/L+:H3mDZU0msiDvtg7gr3STkapnmA+r0p26
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 042b4335251118b57e4a5858c6113d54
Files
-
042b4335251118b57e4a5858c6113d54.exe windows:4 windows x86 arch:x86
2cfcfe57a4ca6d4b9e4870f86f47895c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostMessageA
gdi32
CombineRgn
winmm
midiOutReset
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
ws2_32
WSAAsyncSelect
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1004KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v120 Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.v121 Size: - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v122 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ