� ��a %�^���n�Rr�G�,`�����-���j�ՕF���,�UN�@!������\i�#[OL�c��|��I�:�$4��[��*�^�Oٿ�D�A��C�*���q�+���b�O�І�Ұ~�0A��X�#ꙫ�e$�ms���(5��Z'��q5p|�~k�0cPV�xG*��R�Ʊ�X�Xm��n(��!#�:�=S=�$���S�M|�[�m�p[�c>2ܮ�d3VV�{�π[��:�#KLǔK��E8�~e��Í� q�I��Xɿ�� ?���_e�\� �<W��b]9ȷ��"d�5t�����|� �M��-�Q�����N#*��ߎ�42CY�¥�V ? dm�aN%k�o*F�Rl���m��r��&j�~f���F���%B�)����� 3,�w6�t��]��m����H�mϕ���N�**ݣ�I,���(�b%����:oP��~\}��Zzr�Z� ��o*�`��I/.�-bڽ��ud�ٽ�#e[�b�ͻ�(R��sI�..�Ou�&��gS���b�����u!̸j�k&���)iM���@R3F ����_W�1�D�5�o�=p�o�G�~f���[�@h� t�p�~a7R�cd�p )�,�P6�b����]�X�}�����F�0;5�A�8zS���k�.����N"ɚ�"�d!�����:ЧN�5�c�-!%S&=��6뤉VN��n=D�һ0��y"�VjH�{j Ŕ�B;D�I��V_zbVHm1j;�,j��,�N�6;A�ޡԺ�F��N���ٞ0�&���|�#x�����#iN��TS{�����6M�w� ��˾ ���"C�s���RY�rɃ��K���o<�SM����y�����x=�|���D'�Pm���Z=s����Ǒ�4�ƆdŢ�ݾ��nWhij>��D����VM�n-�P��k,���e�F�C�/w�MHRj�S뒈��Z �LA��i414��w�Gk�h/������ ES,�8z�����"35jPfx�Ih����=�\R���L[2�������V�����.nآ�����!�&�B�I�mG���:�Al�6�<��� 6F�z-���^���b�P������V^��L��*�\�`F��%3���iK�f�%�v 9�.E'~���O$��Lv��0D4n���7�?B�%�Y3����EM�Z7�}!.����`6�^�#��9u�z_+��b�Fc7<�_�����/� �J�8h�.���yUh���H�)�{6&�=���u�>u�R= hF�T���k^1A�./������K㹶�jJo�52�93�R~h����T�~��*�7(�,�[�� ��t����a���YR1#�Kq3%$2�Dw�/]�� � f1����T�JW�z��I���HǤ���5-��<KD�H�%��6L�����Bx�Kd�:���iuMK�f?{�0������ٴ�m���H�����C7�Y^���Z������Q)�!�=�&2@T��(�VY+����H�?�ڬ�����w�s�t�w���k�Ł��W��*�l��6�\�q~�n������]F������rKAw�1��u��)�������F���Q��TcΆ-��%,��Xu�#Q9 ��!T�k9�� BdȔ%A1�;����`�.� Q�O��o��1�}��H9Vש�B5���@oL� �B�d՛���e�\�Q�H�;����x!`�'��;.�ԋ�K Mf���/�h�*gd�=�����N�;|�7�̳�{�����a�%:���7���A��wb� ꁍ�D��]�6����[SB�˝�!���W�*e$����e�T����k�lvLj�,O],�7��z���yT��_IeX� �?s�<4� �8�e_�7��m�_�T3ob*��͟��^$.�v�]���8{���u��^f{�����D��9��4l�Q��r&�����"*�e6A��א�V`B� �\�4�d5���ي"u�t��j��c>�Bu9��5�$�Kb|zΓ��V���/��7NH�-�ɰ6�7u�ݱ"�;����v�B�rS�(݊�K��q��,I���rtEs݃��T&�qٖ^�ō����E*�)#-�������fdN|^����6��k�aUx--�{U��^Ă��k�'5)Sbo0���ж��E�s?�r6�� �}=�8�H�&�q����ҖG��PJ@?�� ������>�Lf�UA��~��0Kc�V�b�������İ�xm��bdT��r3<���K�>Л�[X���e����l(������]��J��3�l\�x͍}�H?����H��8J��w]:H�&�#�3*9�Q7�6ZZ���HL/}�V�T|�*��ԉ{�����>�(��D�YgS�F���xhљV���JF��;Ys��I�0;ƶ����:�p�Zi�+��0ǜR�u9��VL�Rc�?�VY̾B;��2�3�R����n(؏;e�C��#"�M=dc�ru�zJ����3�[Z4Eװ+��P���Y�-7.HO�ez����L��.'����r�\��[�}zC�`�9ٞ+J� �#��Td�h{�!���/w�N����yET�p*d4Im�/8���FqI]��.��<_����okV7��q���mb�{���#KZ�pm����|y������ŕ����7��7�r��El��I5�# ��������ڗ��I�F�s��H~��!k����O �iK��%��5҂��>������6�B8H����R4�{����~u��$(�Yx.��I��, 7m!���1�53��ڣY���x� Ȝw��L��3�濽Ό��}�a��L�q�.7�6�t�^3r�<a����=�Mo�"�Ѫ1�' ��?-�B�_]��){��Md�n"�%��8 ����iЄ��5����6@B?�Q�2Hk�xjC����qx����P ��q�ع��P SI�vD���4�9�0P3�����9)��`�&]��� ��B�K1���>�5��2�~���� � ;,�~%�'��拠��}�a�Z��YsH�D��"
Static task
static1
Behavioral task
behavioral1
Sample
5099b94565b8ae22ab8438d1b2d7c2cd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5099b94565b8ae22ab8438d1b2d7c2cd.exe
Resource
win10v2004-20231222-en
General
-
Target
5099b94565b8ae22ab8438d1b2d7c2cd
-
Size
2.0MB
-
MD5
5099b94565b8ae22ab8438d1b2d7c2cd
-
SHA1
8c9277146f9a5385243a5a3b3de077a642b16481
-
SHA256
7862df6c467f7f9c38981651e4a293d66fe0996fc431288e8ccd91efa4c4a1e6
-
SHA512
a1ddd50a407b910eee12f68bf560dc309848d196c1c6e0dae6a8e1ad1054a766edb7de84903c855130c4cf65bc259032b0e9e2ece2ea59843cf5844390106dd7
-
SSDEEP
49152:5UpMGw6jRlpAdAyTiGHdnYbbNZV82zRZv7:5UgkRlCd7TrHdMzRZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5099b94565b8ae22ab8438d1b2d7c2cd
Files
-
5099b94565b8ae22ab8438d1b2d7c2cd.exe windows:4 windows x86 arch:x86
bb05d784b5588693bf8bca0da808b5fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseDC
gdi32
ExtSelectClipRgn
winmm
midiStreamClose
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
OleRun
oleaut32
VariantCopyInd
comctl32
ImageList_Destroy
ws2_32
ioctlsocket
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ