�=���[�F���H(�AMl�eb����)��������h�4���� Z&y��O��n��"~J���̸�a��^��4���%��2l'A�m�*���e^D6���U�tl& �艦]pOr{���1�ƌ���n����=�i�cdqb����?`�����z�K�lTѰ4T�5c�h��+sʰ�yt��i�E~q9��?V��hˎ�HQ-j� أTf4� �!`rA㳽�$p�w��V�ڐ ʜxX���ف�V_��N87s{��t`��|6�0j��j,u/�g�jXB��焍��?��̔���%��OZ;�>���X�~�(�K�}�1�f�h�����`t�3n �>��vP��� ������S`�^���i�^C��V%��X�I�n�{{C������x���v��)�B��Թ0-fӍ4(,����Mk?�h}��6 d����� �9E `����,\Ff'�}���"�������u��'�cM�.s�K�Ü���o]:;�a�h���}!1G��[QC����fl_r�n��:)?�!1/q���XN����b=����w�Z�ݘh�������u�ˏ�;M.Q�Ӡ��f�>�;�8$��*���N��k&ޓ�����_�Β��@�&�)�,�A���BxB~���l�f��U0�� g; (�'�5�Y<\L"Q�����;me�&�� �Ό�Uo�L�E�P����b��/�i�U�&��}Y���E�Ֆa�:l��ɫ��1�� eP5�����Zi������eU�;�@�k�R����o"�t����Øf�������FiȪ��M�w��'�zksw�bV���6��Q�%�b W���>��`J�yV#�é2j�A�B�x��̭��7=w�1����#s�y�*e�ݯ�R�G��A�_L����'=�`,�s�FW�z[��ؿ�3�EL��{����c�!�B��3�(�'{���.Q���e'�Q3�������S`������ѳ�.��](���������0����EP�݃��1��������xZs�L�˨�#������YFq��Wp�T�J �`J -]�C{*��;�uT�-�����3?��#@�/��q'�=��ҷY������+$��� �Ć�p�]3$�Z�0�O`x�X�-(o�lY@�-�Z\�!�և�)ey��\����M'�Q�(���֨�ձ�f����:�Ű��zQ���Ƽ}h4�(9�]R9���7O;��io���_s�d�Q0�W�|��6]��U7�U�(���c d���G͏��t�uɱ]��k�/$e_M��ضlØmV������N��ͯ;��E;�����r�bɸ��/�#�%q7�ҜD�*��e���r��Ow˧��;�Z��|��Z�Nuz3���o4�.��ayT���p�L�-��������I3I|��Ъ?�������P���o�h��)X���(f��QP���e|X~�HOb:;��U�� T:���5��)��;AlJ�0*�q|ah,�B��#����n�[7�^|��ٽ�1��]�s�r����0Y؍��ʅ9"��{�� ;��7p��H��Dha�W?ݕ�8�O�r?=kR��[�@���T�[�b �a������0����xj���fd�����̊x�� � �����*W� �z.̴��>#Ʋ���"��67[v�XץW�{�oUΝT`�#�ci�a$�����{�#$!�L�7i�0�D��k���x�(h��`X�M_� >]���~! +�2D���O�,�,��f�S��5��X{v`�7�m�t���1��&̻GX��ˀk��D|I���=��ۗ���r����mQu��+�QMEsh����?I�D�އ/�{f�Ϙ�Yn��,���?ĕ�;�%�V��F?�yY%B���O*7�����]��(�(�ۯ��{������B���5@e��[�Qr�[� �АW�e��~�H�/ E�}�y�s�;|نj'�T���Үi.�<������`[�S��ŴM�pwh�=`u2�>_K�M |>�_��>���?[��2 g�@r����ʬj����P��-�ՅŰ��1D�e���)��O5_W�gu�(��nU�Q�2W��~�0�Gl�W�5���R�k�d]��P�5���[8|�,�=�ӭ���G)�z[hY���?,+C��� ͏�*Ǜ��h�V N�S��'D�I ��]�xA��tK��N�y�%-���8M��+����D��[C� 薎0nu�RI�,BXy�������ȟ��9ww�/f�Ss��K��� |���WJ��TN5�5���a8��g��$�7���uK��=�BQ�z�%J����z���\���r�%\���g�@=�N6���ԉ�ڝ�\8N� ���c�;��+[�}HKY������S���"�Ȓ�����*�M=���F�^���r��J$[{OoWc[�)p+���P*@� !������d�@�}��7H=v�g��}>�c�ٖ�q�}�(#���/����Jt ���P(�|��T��' Sv�U�\�a��n2��c&b1&zf ̓���OyYlo !��$��˸l�(��9�<�mPc�JU6�qfT�lj�U]�hrNƓn������(�~�j��h�A磖����3�2�̵Zf)p�h�?k��J��vu�t'Փ�6`#!C�Q�cU%�vDO����Z�1��Y���Hek]�7�BP�G#i��Q�[�!�s� l.P<�R>7N�ΎW�&}��N'��Ce�������){G��އ�����V+!�:^���X{�d��7f�M���� >Gl��t�;���c���/<S��ߡ��w��v�M��e091��u���gQ����b���U�=����K�,�H �}����0�[��c��ɯJ͖��}���D��'K ��o�kX��2u=�N��!~�5�M��?�[����|�.D0�w��~�1����n��?��y�.E�/�> �rsx�~@K��[����ɍ'����3���b~0�IPf�lV�(����� ��(Z��ުc�>�[5]M(�Y�ɺL$ ȟ�o�D1A)��!)�b��.W������6Z��2�y
Static task
static1
Behavioral task
behavioral1
Sample
2d527f76de19966b91bab174aa9e6e10.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2d527f76de19966b91bab174aa9e6e10.exe
Resource
win10v2004-20231222-en
General
-
Target
2d527f76de19966b91bab174aa9e6e10
-
Size
21.2MB
-
MD5
2d527f76de19966b91bab174aa9e6e10
-
SHA1
cdf2b99ee8d7abd5fe784d7b8c67baef90e1b331
-
SHA256
d7bba6e2ae642686d2ba6417bcda304395fb089169a378f3207968eead1c2761
-
SHA512
1fa29be747ee9e2c018633f143d51e44563d8e45924b7d2ebce19d84c9bd851b554c0f27c5ea0a9efe3b2c1894e1a07ca2878f411fb69520ec27f825ae4c17df
-
SSDEEP
393216:tlHyJmD3Q6rmo5GswZPJLULBUQ3sQxJ0XI2XLGhiHfxd2zMOKyjY:vXDgBvJbLKB5D0Y2XQOfxdsM/y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d527f76de19966b91bab174aa9e6e10
Files
-
2d527f76de19966b91bab174aa9e6e10.exe windows:5 windows x64 arch:x64
74ea14a31d6ddaa7b1e575a9760e8708
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
inet_addr
version
GetFileVersionInfoW
winmm
timeGetTime
comctl32
ImageList_Create
mpr
WNetUseConnectionW
wininet
InternetQueryOptionW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
userenv
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
GetVersionExW
DeleteFileW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCapture
gdi32
GetObjectW
comdlg32
GetOpenFileNameW
advapi32
RegDeleteValueW
shell32
SHBrowseForFolderW
ole32
CLSIDFromProgID
oleaut32
CreateStdDispatch
Exports
Exports
Sections
.text Size: - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Tmp0 Size: - Virtual size: 20.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Tmp1 Size: 21.2MB - Virtual size: 21.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ