��[a���p؉[��`���95 �ke�N.n�s����.�T������s$"=��7٦��l#RJ�� qa�!rc�eC�B�8����������݆z�|�-YXS3����nԖ뮥��%��%>F���}�;=���qN�_]���R�7<�����i�i��b��l�HUc�{�����)�ƖNV��a�91c:�9�PiJ��x���I P��϶����m�%?�R`�[��_4��\���*�>n��G�k2O�oߠ�Fr%��j|���:� &��7B����A��Ƞ`A����'�i&�� %��×J��Ѝ���q���t�E�v�t7��>���$TL�w����`N�d��:�����7yx����4:낅R��G)�WZI���X�m�6>,I$�Ui�ZLM�g�CQ�w�Ѡ �f�R�~�^c�}r/y�ƙ�U�_��D��� ��a��sBp�n�����dU��x 6�(#���U,o8o!e��:�)6�����S�F��������Ȫٞ��eȂ�+�'w<9�������[��ɀ1��z��1��Lj�I�s+5�F������K��r�S����[�S�>����:��X_Gy\WZ�Er����[r��f��r�"��>7~��d������W�<� Lӎ���a�+&ׅg��s�(GK��&�BD���Y��8�t1wc)K��<��M�w\�|�����'�˧�K�8\�|ړ�h;t�|�p���$s��_�JXG���\��)�Bm��[��z܍�e��б�����n �-ׂ�Ҥ�hz7��±�tj�V&+���^����zVD�/49ɭ=�^�*G#��)7���NM=-�"�5�qTi_�귕����1 ��r�֠HP���Oy�@,����2�����0��e -S�+��Ĥ���P�%0s���'���������o��C�q$j��j�$u��q�9/��X�Udk����Y�a+`�w��ds��F�ۢ��K�8)��_��&NL�:����I���{��V�j���bV���7�a��bnƗ� �?�������K6���C�iT�$hc_�N7]�>>T\J��S|�3E�w��B�$f�VBe[�E�8O}���!����ME1���3�<G�@�'�n~3���}NY���,<B��ũ�:�-fE�O ����(�V��NYttC�a�u�lMpb-KSf(�1��VK�`����������nAlLQބZwO���$"7�nT���'a�M�[����cM�M#e�m�s'Zi����`��}Ѱ��U�)��V�"���M(�lV_K����^�cK���:���P��oR��WΥ���0bwbg�b�y?�t�N�ηY��7�؉�;���R��qf������ 咒x��؝��]�؟+-�)�"�D�B©��?#����aC����{�����*�fa#�i$���ˇac6P ^F�S�@I����#��R�7��*� ����j�D��P2��@z��O�S���֣M�Æp��鎣s:�����!P��]���X�.�1�x���J����h9@�lS�Q<C��5�����{�E��ԑM+2��O[��N�#����T�Ӛw�>sd�H�&B��K��� s���)ىlD�.я���7�/����L���n2.���2?w�(RW#�:>�Z����o狽���4�8�4X��W����&7���q!'�8��K���ԅR�� h��x���:�0��?���h�S��K'�w��7i�!���7�A�o�c��>�詐v_�Y�%��PT^��N���r�Х�Z0D�% P�y�-? ��!#��ͥ��{����m-W�?��/�P��M�[ۮ�r>��7�1��w���K��K�85}P�;�2D2ą��fs7��-f�������4%F��&�w[���mNJ:}h�k�:�ń�V���"L`ü� _S�H%���Õ����ӄ��)��|����za�� �WaW�>��}�Z���a��Z�a�Q���f_U�T����M��_�N���\�eͮ�����H7�����?v,R�#�Z�ƙ���L�(z��%-6կw\��+���L�t���!�RIttع���ֿ~�Ej��-�Lj� [�*�NCu6�xuwp��������}�v�@<����=s}�4F��è��h�K:ۘx-�Нbt9MA�t/#�;^��=�o�0�u+-��s��FO9 ��be�*x[uM[�7��� ��PtH� N[;����E��1?��T�M�H�����r"������K�������%0)QǨ�&j>��1��Ay����D0��1�z��mٱ g�t;y���T+�]� �h&3?����j�b�x:�8.oG���j:^<���6�m�y�yc��,���hH�)F}ն) 3�J�c��;u�����/w�\�}=e�ݤg����{��"�m���|9:}q��1ê��� ��h$������ �>� �T�XEx�͌1�Oږ8�v@� u��u��o!��2K��Y�f ��`�_�At�=厥,7�\:2����o��`�n�!��S=������,���+�ŔΙ��zM�:���!�-Жݢ|?�xv �[$��uH(z��-a��/�J�+��C�_��+�H�'����v�*�vb��f s��H��Z�:��!$ޫ�O�n$���O�C�Ι�֗�j�}ˎ2x����|�-���.S�w;��.=Z��V3~~��`̄O�$��8W��5�_��>~��M:�#���[Jj> ���F���q?*��c�� ��8Y����b�@ ��;y�XP�u�����d}��+���i�EpAH�>y�����龗PQ���Jx�y���x��N����+5���Rn�Dw^��QQ�#O��B�7��|���V��i�B����X�gVW��ߓ9u,��Ҋ�J�<��J�BM�భ���O��%w�?�!z0�P�l����ܜn�5Uʐl������W����`_Or�:���(��6G17D٣d� VOYq72��8"���¢����E"��R�;t���9�Q����ҽ��W瘬4���a L���ۢ��ҿCO:���r����Ҍ)s*�
Behavioral task
behavioral1
Sample
1bdf8b163a9a3f3dd47299e387294bbc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1bdf8b163a9a3f3dd47299e387294bbc.exe
Resource
win10v2004-20231215-en
General
-
Target
1bdf8b163a9a3f3dd47299e387294bbc
-
Size
1.1MB
-
MD5
1bdf8b163a9a3f3dd47299e387294bbc
-
SHA1
1fcab913e4ef95c3e44f8a4c529812f90d781770
-
SHA256
22b374ea25f4fcee86b8ee006adc5bdec3aa869ef206bfda22912c13ac5f888c
-
SHA512
bbb0ff70d532f61d6e5fadfe3cac5f66a16eef01f2bac7e80eabd0829284bc5c767a6d66eca27336260f8f7127f5b2a4e21439e5b36cb1e572f6001bfe9ff199
-
SSDEEP
12288:rbpHYUKy5U1bo9t8DMRSW9vbciUiLuAvOxMt11i27QitjpuMHANUTN/:r5sJo6YrFUiyAak11Ltjpu0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bdf8b163a9a3f3dd47299e387294bbc
Files
-
1bdf8b163a9a3f3dd47299e387294bbc.exe windows:4 windows x86 arch:x86
c2e0f0e47c7fa6db22f2ab52dbeb43ec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeviceIoControl
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
MessageBoxA
gdi32
SelectObject
shell32
SHGetSpecialFolderPathA
ole32
CoUninitialize
oleaut32
SysFreeString
msvcrt
_CxxThrowException
winmm
waveInAddBuffer
ws2_32
recv
netapi32
NetLocalGroupAddMembers
wtsapi32
WTSFreeMemory
Exports
Exports
Sections
.text Size: - Virtual size: 409KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rodata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 432KB - Virtual size: 431KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ