��������F ��a��'T��[����:���wK9�Su�Z�4u��gb�u/�䞆���jx��ez��Rc�d�2��i�f��@J�Y�Ő�����^A�:�e�#V �Y��H�H[KB��$���n���T���Jeɢd+�n��& {̈́�Jo�Lj��ܞۈ����"���V��H����<�,z�/G�P�#��'��#y��8�S�'"���¿�}w� �9{(�`�Z�Um�BM;�;����x�(F�]�F����ZG$�[w����H���}��i!b 0��U�]��ѡ�d����9S�D���_"o��ԀH�؈V�.�YD��,��&�u�B�Z��!͟�X$p�L�����\��Z�84@�YZq���� �m�\�D~W�M�c�^��l�� ���5aټyQ�>��^��oG���`j�;��cZ���:ɜ+%~s�x�Ϻu�DhO� �����v���MO-�V�k ��� $�'Y]�w����&r��DD������kZ[ZS}%s#T+r�pۀyGk㖵a������Vy���@�Z �`l��-r��h�ּËM4[-�i3�Ɛ�[4�^J��J�;�/YN�멢�w6�A��%Z�����������Ѳ�u�*m�*�6YDƗ엔���\�2WG�f��Ir�#5�Q^Ƴ�Fh(7Z��M�"��[����=�A]�C�~Ϲ�Ć��D���+6�1��Nh���;��2j�)�*�r^P��s��e)t��;����pv ߋ�ʑ���wc�Țn�\bɬ����ͧ�(��h=��:��]C���N���bʫ����)�$��ϊ�O0���@RJl�%�Z�7��T;ă�����:�Q�Q�C�={T�k͒i�ü�xPB�۩���$�a���#�*"��m��g �g|I����/�/�������?&œ���54l`�r��m�M��'y�,�p/O���L�9��&~�q�g��ڰ`��_)��|�n����_u�9H�����?������`b?�֍`���!w 'u��"Gf����t��4�ɣ�盛��@ ����Cqh[.I��Y�q�M� �q��Լ`w���5�H�����p���.� Ao����P�|#�� CkQWm2�{��o=J$ M��ւI��34��{���*���ɥ��U��P��&� Ox��։p�wGJpp�hr~��Kmx9��9s��Cz|=��W7(].3���ڥz��`���d��i٣��x�C��=��XMg*u?d0��ᴽ�P%�7���O���(�� B�4'��^K9���?��9?���ۅ���G/o-��<OR`Ol�/̸�y�k��C�P�n�{�����!ʸ1s�����gQ:� �|�)��ς��Aɪ����g��'YU�l}��$�h8є>��-O��-��V�9u\��3']��A 4"c�K�vo��dO^�q'o��c�rv�f�뿉����veK(�V�,�x!]U8�t9��_,&���2U�k@��H��M(7\�6=����셆����v� #i]n@9�G^� r|s�`+��<�g}�`ފ� ���Og�x��v����|}H^��7�֞F��O��_一s���@�BU��u���h�'C1�9�^�4�Յ��7_��,���e8`@5!�0n�LIj�<u��yi�����������6���2߲�[>/�O�kg� ����wzX������&g?-!���#�E+`vv'�\ˇ���35��Mե熀*}���卜�@l0���;s��[HNM�HBf���d�9'��J Y�����mi�9�4�'K֥H9 ���X'0T{]R�"̃���Xt���<�^-�����k&4��YV���(��k>s������c���t꧳�y�S�∂��b'��_� �5�T"a�r��c�/T�!����pI�Zcd}��f?M+}8�R]�E��3��E��X�b��JlJ^n9Ds�\��m_��r�(Y��J�|Ȳ0F,�����C\l�2�-G����f��Q�r�t��aXGs-�"C���� ᧧[ŋE���K��_���y��(M�\K���+#�@T���)�ORJd�0�dP��� �=ΆB��b�1��������%���!IP^�dP��z���밼���������+V���¤�V�J�����e���ϓ��ˇ���j@Yj�j�/��|�,�s����[P��+�4|N���v2s{ܔ�.o����������v��lf��P���NJ7�؍�K'���� A��$��|���2=K`ZNU��r�>8�F�fP�E��UO����x�'*�d���ac�S^~y=��+}q��Gm���d�ck;Bf=�P����K �-��D"�����mn7������:�����yѳ�����o/l���Ɓ���Y��Ӎ�u��|h�+_$R"d�+vM V'Ҩ����I����;Ƣ���&r8�������������X{^j�4���Ύ��3�̈�q�5��i�V�C������4�oD�R;} �:�j��j������yIvF�/��fBp��� �/����ri�� ��s��3p\�I�Y�Q��,�y!��Y�����QNY>��/�u�ܑ��0O�:W�Y7���#�J�����!b;��օ8p��Q���ŜU�7I2U)�F=�F�O����"ˣp�It6��q����_.K�XmFy���e����[N�r������Ո�I��p��e��C��O}fa�����s\v��d�h�ɂ�%Xm� o�Rt��d���e�H�2>[F��0 �/]�����!aĞ���q���cU,�orSZ���ן�x�&�D*�O!V_����f�7Q`�E���p�MPv9��Ǹ�����0U��`Zx �gJ��S�����PPT��m��ug�i��<:[��- ���m���\�A���k��ъdp���~�#�Oj`�!Ɩ���=���6�{����!_�)O�b� ��YS����h�c��k�n*m��/���k��M*+"`>2��#{��IQGӳa�L'�ZB�wXz%d����~���#q�f�xW$���Jw
Static task
static1
Behavioral task
behavioral1
Sample
38cd11a5fb0fcb84ced063e621f9ac92.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
38cd11a5fb0fcb84ced063e621f9ac92.exe
Resource
win10v2004-20231215-en
General
-
Target
38cd11a5fb0fcb84ced063e621f9ac92
-
Size
4.1MB
-
MD5
38cd11a5fb0fcb84ced063e621f9ac92
-
SHA1
c661bbd6bb411de95c55be4827a7d3983ee0e6ee
-
SHA256
e9391e71181b1396791eb0868e64e373fc0b5884cd4ff313aa8fecc3fb55cdf9
-
SHA512
6f6e1c13231f8ecc9376e8ddeac2983a651707a60ad3defa9656a4dd60dd4cadb3bd59e5f1e9b87f785c8c825f84d148dd2e6a88c82d8f53a894d2b483f10b84
-
SSDEEP
98304:BijBrIpag1tDkDZKTqk1xfAjZCAaObNVNeQuXHj5swbwhkWZbbpc:BiFrIfIbk1xfA1Ba4NVNeQUHj5sThZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38cd11a5fb0fcb84ced063e621f9ac92
Files
-
38cd11a5fb0fcb84ced063e621f9ac92.exe windows:4 windows x86 arch:x86
2815a7a974432fa49945356206ded159
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetUBound
advapi32
RegFlushKey
user32
ReleaseCapture
MessageBoxA
kernel32
GlobalSize
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
GradientFill
gdi32
CreatePen
version
GetFileVersionInfoSizeA
ole32
OleUninitialize
comctl32
ImageList_BeginDrag
wininet
InternetOpenUrlA
shell32
SHGetFileInfoA
shfolder
SHGetFolderPathA
wsock32
WSAStartup
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 19KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 35KB - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 833KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ