(�ߡ*F�&��T��t��c2�-8GyT��ؗ�+���g��Z q>������0�Qfq��V�z3V�e/i_dtg�s�e.� ]c�V�#�8@�cz ��U~i1\�*!G,k�����p0U*υ�#d��k���FAc��jx���\U���wj`{�O�*Ifi��yX����E�C�$�k��V!��F�k[�҂Q�h��O�h��$hm@��q��*J���O[�9�A5�#�)���$��>�*�MK%+Xs��@�.��~&�%��+N%*��� �t�+NDv4���Im�z��e����B���%���M�h��:�!�Eыș�<#ݕ�ִ\B0�O���<��-ڍJ3D.�r�]a��!ۺ���(e!���G�@Aފ;/ŨA�F �����EI���)���p��k) �/� M ϗ�Jpr)��%UƩlJ����aұ��*�@��/���s�����\'Ë^���g�� .���0Ah���M������ �Ѵ��5� �� ҅8��S�k��ieS��A_t��]se���grp��B�rb[���Q}��@I�llW���=X����&0ٮ;��w���.g-i8j7(�v�h����[_]�Y��[��n���Px��҅ ;�։���Z,�j�(����=� u�)�&6���*L�T�h����#5�����%�� =|�S뢻��g!U/r2�2�c�Y������$�7��o T��6�c�c�"�:�W�4X�N�%p�������[.T^�7.� y���C�˯0q,���P�����na+�@����d$�70�$�p���� �vM��D�`��i�*`�5V�{eK�]��=X/H��rk� �2��:+ǝ����Ε#�$�Z�&=U��7SƑj<�� �9ge����na��c��/p6�:��U��\f�4�,EH:��O�\c�����cu�D�f���*�w�ػA��v�3x��U�;�W�{z�1e�B�8�zֈ[!с$=&y;&ne擑S���`���HF:���ؿ�i�k�>��4��I�����21�d@C@qI1�&4��"��J��#K�֍��s����ڭ��N����O�%Yhy�?ӵ)s7��8A��g�&�i�t)�h��TIA����\/-�|19�;���$�<Bk)�BA+�"w�[#�C�[Tg���]#�)%`��䧓��!��2���Be��O$l=�+��|e��ԴF��v�0WuZ�lCS��}5�r+���=)>�I�WƞbF?���r�����;u(Ԅ�X��eF�"S]n����!��������}���]s�֠(���+�L�h��N�a]���A��-E�?a J�����#��Y=�a���gq��F�x��*r��&6�"��~jҌh,K���LJҬ�p��:bp��0�f����C��ԗ�x��{�,����f�������_J�S��@�l-�2ao�)���B(S���}�y�%��0�h�N����j��X��x��ލa���Q��)����9P�C=���̒�f]���E6��|���d���Q��w��� [.�"���W5�A���j�jo����z��XO��VB����"��\{�ۘJI��l�H0j�l��2�x�9�X%��@�@p@/�����NTZ���o�Ơ��g�g��RE5 �S��]y�+�*����Iݫk���r���.�%�ɭqCv����XX��Cm�n��R��+�e<>��P���hȟ�]�Z8�@DZ��1�L���"=��O,�6�Y��vT�#��C�A�����&�0�L v6�a�Y�-+���l��و)q �ac�8��|Z-z��pEdΡ�)i=a]z��tRYV���.j<z� ��>��o�}�qC�������m��h��� �"�a�eL�B�� ���*�3aB����z�O��?d���b4��5q�^Upp��o�m�@�N���Ni�T�% �R��K�M;�IMSSN�#4-���Z��$�3��W�:��5a@3�}N3g��N`�FLH�j4G�eQ�<�s�fHhW��D�����!wm���l�ڙ�BiRz��*Mr�q#S�q�w�ƪԷĖ0k"5��Z�'0L����<か���F��g6=�g����Q5`��}iU� ;r+��^-�o;�h�c�������܀6Qт�{��0.{�n% �i���O�}�b|�B���i:�Z��r0��v����g5x����\�N#�O³(^�g�6} e�-��f���^��0/_��#�v������=����JQr��*���3���Y��o��H�>�Bƹ�{�G�+�|[iK���r�ԡ�a�&���-��D̒�~�����S�6�둞_�����K�b]���-8'q�#�#�H�Y���ۉ���i�ӒZ�z�$\*�-8��Y� ���Z��S��l��Zl;��]��o$�m�P3�]�p͞��!!͈&��Pup�lg����Vpef>���:��s��^��؞�P[���,��o����뇨����,A�&ńz���~�JT�T�Gb�Wϝ1CE�$��h�]�s�[gLy� ni6TBh6[V�̣��\90�}�I���C�MƁ��3���P�\�#!��~���y[������hڌ�Rk8�b�`S�/)��Z�já=��?Ն�{��>�I=��T�?5Y&���$!3D���)��N7�W({ghڇ����8�e��B� �%��ʈ�L䣉 ��u�v,�*�= 3k3 q��L�ÒVGs�Nmt���{��2�t�\�7>$���v��-�A�"���p��9�� @Wbk7�� 8)�2�#]��g���4�ǿG�� ����Rj�F@��2�?�ҤlY��|�0m/�� �eU�9�O�upa�Q�n/f�3�����6�����|�(��@�}*��\sO~�F����Ř�����ڱ��`t������}��0*�l��0�����z %�'u?� D��p��$NaDI�&�����Oڱ�O=C2����9^I�U�xX"��ٮ�N` �9�c�Ͽ^ؚ����.���G�Y��tZ�f02�����P�7B�'
Static task
static1
Behavioral task
behavioral1
Sample
23b26b089848b713cc88c7d7e99976a0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
23b26b089848b713cc88c7d7e99976a0.exe
Resource
win10v2004-20231215-en
General
-
Target
23b26b089848b713cc88c7d7e99976a0
-
Size
1.9MB
-
MD5
23b26b089848b713cc88c7d7e99976a0
-
SHA1
4b2d32c81a85500711a3131777083601bad73d79
-
SHA256
e034889a0fa314a27ada28092def7afe1e2385394c3220bf978e87e27f4732fa
-
SHA512
4c670ef7e7564be2fbda6e3450f234b8f0da9f379302132445774d7294ae2201e1579307faefffdcc982d9e8d08e09916a36c13ba9b66dfa63b736f1138b9ed7
-
SSDEEP
49152:IOn7Claz29co8gkciAqwclm32aIVZTukxcI/s+o+T:IA7/0N8zUqwclLaIiUA+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23b26b089848b713cc88c7d7e99976a0
Files
-
23b26b089848b713cc88c7d7e99976a0.exe windows:4 windows x86 arch:x86
500670908c8b2eb548b380523b4b29fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 770KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.175Yo0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.175Yo1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ