+�������G�0�� `�F|��#�ן���yN�m�'^&�"]9�J]/�,�T�ޮ9r�Lĩg��g��7�%��iO݃Ss>���B��T6�n�V�����O���Mp�<P��G,2Q����j+�M�P���v�7���N3�ysgC�B�p�א�;���A��wC>��8�t%%���)��#�������hE�E���V�E� ܱTG�Ļ��9�����1��P��Y��kt� v�(Q)� �\J��YVox�+�)R3����\�P|\[}9X��F�Bv��a1�5����¥H�oz]gX�)��*�R!>G��D�z�@\��n������AH�n�]�E�15���hB� 7rK��x��-��Zi@��/�y��U6`5[kT�^7�/ �ȄU{��ޑq����.�7}�&:GJ�ee4���T��ӛUP�-�n � �����D��6��Xu���*��&ϡӬ@��c�����E1�I���7#�6}��%����}���h�!�+7��tq��"�����s��# ��Nl��;��`ǂ��ݸ;��F���`�������zD$pr��)�{�EY�F|��������o ��1���C#;��.�;I�D���p���lU�,�R^z���;,5��a��P�H7uu��B�V]�:��m L\�f�`9F�6��i���{�у��7�س�C��*j��-��о(�`��]. =8���L"$^�,�[�a��c�W�N�Q�㰠���t��BW��_5����?q�����<���E%S;?�9��ǵ�%h�(��W�b���4���+�0�������+mN ����:�Q|M`P� �T����U�A��p?hY�g�>~�6�k�ɢ�Z�vb^�$��>G�q� �|q�[/�p����B釚�3��11�����Kp5q�������I+E=*2SP ��C&:؏�pt���"`=%u(!��#EP"���P�`|V� ��=��'�ܻ)f���N��v9�!^V��qfU�2U�C�Q��f�O��O��g��(�̽1�Co��6�&�>�_�4.ɵǼ!�|�ٗ�s���jji����ҭ�,%��4d�l����If���~����w{��6(ݨ{g���B�O72ł�y���l��n�T'[W�����j6K&��Ul�*67�ȟh������j1w�3����:"aS�ѕ�S�٘"�g�;"���2���Z�g��=7��1`�%��z[3�]ܨv66��y$ϵC��������9��j��Б%�LjT�YͲ�[�U�'��-�)kC[�!����rb������|]�����d��m`�|�4L���S�>����O�/��QP �8!�ʣ�\��-�Y��&)l<�i��Y�����@h0��r��S�(��H)!�g���,��W�`��"�1Ɉ��� ��y���xr�f�R�9j�(�X����B���7�����=�~��2�K�`Kw[!jT}u04��L�t�^�����_P#��j���u "c)A��t8�`�ʗ�F3f;�R<(�h�#҄�6�Q��!�����lj飃��e�bq��ޔR���7)��ojn�i���(�db���Xӂ�3��6/Z-]S�N�]��5OZVɰ$h&�A�����i�a��y!C��"��[�s����D�F�V�E�ƻa�xKUMa�\,����IU�����BWk�B}B\y�~\Ԋ}+�'���� =�Q�� ��|�O�h������b��* Dnw�9sB7l-�/W`�x�f�=�q�����t��G8���t N+^~\:�lG��\@�K(^a����-�-��a��+�yԹ�{��Wَ㺋���FY���*�d�ɗN��ěRv6���i��.�����b��2ۗK$?�UZ�E�,�����mݺ�Wk�x%���5�Ǧ����4 ,��"HH����9�@���϶�� mF�]z�m�����>�"�Ь`n:�+A!�݂�XZ��D�To��j/��l9L�'Vj�-�U�"��_Wݹ��H�Jt��?��CJp4fmI�����v�dM0h����w�!1�&��k����O�<�M����#��!k�b)J��1�%#�����dV���'6��������v��`t��&mOYB��Y�Ex�d���*E���<�뚢T�9�_�|��Q�?b)7��LY3�}�{r����i<Z�85J\�&�F��+��*S՟���E�����Y��l�吹�'�4Њ�V�?�'��h�}��g����c�I�͕�#^;l?�]�{�H�`��7�!x���C(�f��1��n��^�;��2x��������O�D�լ����8�X1�1�g�12:�%M\�[�|b���f�����S�Ƣ����6F]u�A�%!&�Y�Nؤ��hD�ЩW}Vj���4�Q���l*A,����<�U���!-�b��j��}H�T��� �o�1%�r �:���̋��P����-� ����ƅ�l0� �~�ݳS�!�8[ɿ�����&�2�X@���s�'�4���o��p�mi�'�P���|ս�e��&4�G���5�QNs����>��+���� ��Y�}����� Wdsw<_��݅|A=��Qq<�vB�g̪�|.�|�; �t#�X�QW���m��'#�� A�[�O�6u�c�IM!�xd���[�����n���s�4�?{v��C[�c�G�L3�|�1p���~���l��N��W��B��Խ�;�f�$=�^���kՉ��Ӊ,�Fx��u��<�^:���.T �E���>w��,mJ����F�����\�N�d�Eu�)�]Ñl�-�+a��*�Иf!ezi@�z���0d��zC�Zm�z��f#����d����3��g�R���n�<J+����WxN������Ѣ�#I���a�k�P셁i�ԎC�Yn�����;��Д��p{�����V�8+D���x&� b������ƽ���Q�r�����MLr#��>W�z8��c�8�w��p�9���h�ËM����P����u�<�/��Nk�T�NM3�����b��SH���B=
Static task
static1
Behavioral task
behavioral1
Sample
380cd4a24913283722cdea49b4830430.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
380cd4a24913283722cdea49b4830430.exe
Resource
win10v2004-20231215-en
General
-
Target
380cd4a24913283722cdea49b4830430
-
Size
1.2MB
-
MD5
380cd4a24913283722cdea49b4830430
-
SHA1
30b8abfb52501362a2b79dde685de1bd955e872d
-
SHA256
e606fa145e878efe7732c0a22e0a54c57aa1ce5125cf9e8816c27b81704bbbcf
-
SHA512
a624376c3aa0f46f3e623e80af99e93d972e8f3847346dd6d1d289d993c2deb69dd9d82b6d6349a8695c2de5a96bbc26531e42572fe2ad3af173f3d9a134277e
-
SSDEEP
24576:29Gr97c2lwcbJ0SDCzl5A1oD3IicH67Pse3QwZz4xnG6WB8Z0:2Ex9lTtuz6ni4de3ZBSg6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 380cd4a24913283722cdea49b4830430
Files
-
380cd4a24913283722cdea49b4830430.exe windows:4 windows x86 arch:x86
a0440fb73d27ab74b22fd0635e7cd6b2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetUBound
advapi32
RegQueryValueExA
user32
GetClassLongA
kernel32
MulDiv
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CopyEnhMetaFileA
version
GetFileVersionInfoSizeA
ole32
StringFromCLSID
comctl32
ImageList_DrawEx
shell32
SHGetFileInfo
winspool.drv
EnumPrintersA
comdlg32
ChooseFontA
Exports
Exports
Sections
Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 816KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aspr Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mackt Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata0 Size: - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.adata1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ