�6��2n b�/�r>��79 ���2âD����ϱ]s�YʼnZ�ݠ�� (R�r^�Y����4R�4�����AY�U�tօj8uU�y>݆�9�uR�J��y#��:��saW��]9حJ�G����.p/Qx*�V�Q�L�-�_�Z�3N=����@�%)Uj���c4hz����tb5���%��dڪ�r��iT�������Z�lzn�`:C��I������u�$<3ˠ2I��Eu��fT��_Y�-j��Ց���*l��.�]~�5f����nGYв�Q�w���F����qn�A�YN/z�"�����-���d��ű�ć��{��\#�����||�������;�2��2"x�����Ԑ�c��u��nqx�M~)?��d��jM��#z��"�,4ʫ�l�+�p��Ϧ�s�9��^�:hh������������ʹ�����ٽ�S�+:kxݻ��������uƪ�5��9k�G�B���ˌO@�A���w���ipx����C�~��L䔭� X]��y\`{怦`c� Z�++�`��|��c����n�j7����h��j%dd}����jI_U��r�d�p�` �*��t�L�������w��;Nά �|�yWK��F�r�w�u�5IΑ.AAN���������h@d*�YƗ��^;(��e��Z/p���e����2ROP�᳇Q��i-A�Me��uh��ڕ���8�>��0ri�% 1����k�:7,!ùύ�+m���� �J���b��^X����aL|�" c5 �'�h/��-J���#u�X�g���6�tBlȬ�������^�\����&V��,��'z���V��P�WK�V9�g�w����~�/��]������"����ey0���Zv�`y|�\�N�Ҽ��7�!��RX,��<~7�Oٿ:h��~eO�[�1˱)�������b��]KS��^��)�����;Sgmv<���o��낉V �����O�sQ�]0w�j�TA���CN=�M�[8�I�C+U@�`����?��:2p��U▟��|�5��q 9�?�\��yj�^��'D:D��"��nH�F� 5��rÅ��J� .37���Uzgh�7c� �I�Ǹ�ә��S��i���Y�P�Y8��RR�#'S����ש�K�O�/ңO8H��\��uP1�ƾ�ѥ��!9�����s��g.|� �֮K�uw�R�TA:���o�N�p��m��3���$�������)Ek��{��� �q��ׇZ���^K)��^�|�C����.z��92�����:��K���F�ݐ��DY�'�>kՠ���ۋx���tLB̟�1�J��c�r���G����X�}�Kx����C���"�ǎ�'4�z����Ϭ�V��Pq� ��Y�Z ��VaÀh�����>�p��P���;~������%I�j��_��'J��\���I;���^��f���"x�#!�um��:�W��ʠ�C��U�?$�N��d�Ǿj��.xeJϻ������wt�����/\��i.4������kO)���o��O��3��b�KR��f�$RM�z>�Z�Yv1�!>V 40V�ڽ�ط�ҹ&�m����&�z�y�^�*j_�/�Y�i�M����"4']���j::����$�+!|�qFWĊB����A5��������D$�l�cK�m���wR�N(8���?^PZv�( 42^�EuUDS �R5~�9L���2W���O[����hrh�ރcP��`�����.<\�!O�������ȱ:H�����.�?�EX�շ�A߸������� �t�k���G�H��o��&�;�[y�l���`qO��tVN�.�3vJ�����`�`�q�� %� �w�-��'295��r��&�0��bc��n� �xc)+���}QH��+%';D�læ�^HӔ���� ���� -����'T���Xt4�1����5�l}{A�FW����ӭU�U�7���]� ��k�&�)uwd�uφ�"��B��8;|���&ƕ.��n'�2�t���"���< �gGK�����'��t,#v���0u�����ℕ�Ҝ���..@��WڼdV?o��k�\_�3+���������o=� �Ӵl'Gk|�8+�>0��v�q��ա��]�E�O><:d�$ ፶ ��bEp$,�gzV�Q'����.�ݒ7L��xF>L�� S�1���bt�WX�W!���A�1������NK�����j�u�g���ZE�֟dvq����AJ�{JT^�߯����D���҇�����\�_�1��ES�tnh>F����,��T"zXxҥ5l���e�u���%,H�A����y<�%��7@!=��WHj��xr<�+��I��W�dH(�}y�sSkI�b�܉�x�/1-�u�<Q/�`�� /�o�;&L�Km��A�|�}�]�I���e�*v�/��!�t#��k��Ww��>����"�=Q��h��}����@�cG0��G�Iܦ#mF�_-���%EH#�ߘ:T:�����8���}��(���r� ��'������Kq1�*f+������53�+��\�+Y���F|ӑﭥYE���nm^�g��9Ta��lG�����{S���"��$��ݰnЁK:$,�1�aZ�ԩ:�2b|d��{�?�6��+�ގ�k,Eq�.V��mB��SNOU����7�?�#]2��X�La3�x,E� ý�M��-m��_`�+�//���t:�6��U��mE��/6f1�Os��|�䃐��_�Ipa_Š����W5Op�!p��v!�{R%���+t<$���8B�X��?5s]rv`:�z�7<t�#��K���m�o99���w�H�4��]r �*��_�l���3��r�S��5[����7@��D����ߥ�۾�z��D$.�������.��E�����-NqF+6�+<�}�0Ba���T�!"��ӏ7 �iv ��) (=s4Jar�'���6|�����%^|����d2�Ny�ss��c�3%�\k:e$���� �ʅ�����Ԃ#_4
Static task
static1
Behavioral task
behavioral1
Sample
4b2a986ade311b9db6daae68bce1ef0e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b2a986ade311b9db6daae68bce1ef0e.exe
Resource
win10v2004-20231215-en
General
-
Target
4b2a986ade311b9db6daae68bce1ef0e
-
Size
203KB
-
MD5
4b2a986ade311b9db6daae68bce1ef0e
-
SHA1
1fd70255ee09733187b903092b83550e63ded569
-
SHA256
740e46e6bd919ad1de12a9a09f8bc2ca867df48810b5ff7eeab8fdfed6a63809
-
SHA512
057083ff1e577c1126d3ffff752ad77bcc539f8313c2bf7add16c76901319f8623fd196ddab9981b3eba96f0709e80d3c4e3525cd8866cc21a2be513244ef46c
-
SSDEEP
3072:DFbKuN9rTTvmL/wGYBdEfE7fBOQmLYNma8k4zm9N/IB3JOpFy9D7VFyGF5Bl5BLT:xzXNdEfE8QIQ8kRWmpEdV0GrBbBLT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b2a986ade311b9db6daae68bce1ef0e
Files
-
4b2a986ade311b9db6daae68bce1ef0e.exe windows:5 windows x86 arch:x86
04f7bc179fc888f164d26090692bae80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBeep
MessageBoxA
gdi32
GetTextExtentPoint32A
winmm
waveOutPrepareHeader
Exports
Exports
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Psych0 Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Psych1 Size: 167KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ