�HKK���:�T�?<>P{�4n_}��lr�f(Z�~H����7���h����-*b*!������\�U�a��?�ND &'��\0��f,f�1��]@����S��tכֿ����Y����]�M�99ܑ8k<)B %kg�P�y}�{��y��1;�7k� ������?����Q�A�=�!��}W3����:��W:�k�((�|GD?��g�L\���f�Иtt�\���;�tE����ƣV����W�f���&56��a��h��6����d�.�e�i�qQ껕�0�����.�=dP�,����Z9?�6�� OWt���}�|�jOT�sp����}������ψ+x �L;�d%���舔X��H��\�\P$�(�����&�PM3E������6 D?����5�x�6��OZ.K�� ��r+?a❈3��|�n�@ŹMP����i6F% 4�N�����v���6��\�p�ϼ��I]Ӭ�Y3ɡ�"�9���Q�,-�Y�m��4��;���>��Ņ�a�V� y""�n�a��P��&WHd�:��%2�>G��\�3������DSh�Mi� f� qߓ���za9\/���b}��ݸ@�������_] ��G��c�p�)����ŘҤ�����"(9�� V�p4�p�fN���t(��g��n��И�+<I� ��"ݷ�]y$�G��u��#�5��,`$�gK�P�������IT]�=���&�8���x��v�.Z���[vK�/W�V�e�TaJ�&�t�y�^��y\{RZѱg{iS2e�9�!&lV�������������������{9Q���H�����&��̀6E?�]��rw}���D#`�?4�X��^諩RQ1���@W�F>���]l��yȑ�B �Sԡ��f��jȄ�O��E_���5�����g��u�c�[$w��&�;��`�f����ʿ����J�{a�V���*о�_ߏ�XTI-�{D^����Y��`ۑ�%>N=�\���]w���<Dz�F���ߖ7LX77)�t��$������rmgCND��q�% ��C@�!#��獘Q�X+0���4pO ��y�u�C�Mq��s# R���]D��mG9���^�T �|_��Vy��B�V�t��b����n\<��������@��aPe#�dL��-�K�G��o��p� H�2wp��۫Y��ݏq1��X�`�[v<NA�G�9ό��Ǝ��P��o��b�����[cD�O�WO����mPw���e<Pv���B'֣�� �x�e��B��J�cc�⧼k��:Y�hB"�)�oj�;g�Z��P�-M4b@�d_����&�dڥ+i|�$O��Ԫ���R��;)�O-#ПJ|�0A����M�Ճ��$��\��y \�+Uvl%.�L��p��1Y^����H~os�h�Ʊ@7���nV��~�����~�c�'�K},vwE��{T5���u8�P�?�:�g���Ư�CWg��O�k�{ZE: �=���v~��K�������-�NX���ղ7�jԒH�UE=��';O�i㳞GNب]}d��nJ��RJ%G?���_�9�V�S�g[� ����tӬ� %�Ҳ�%�r��]t�C���`oW�:���u���V3�t.��M�;hz�� �}IT��J$���1��0�b��������N��~b���'O��Y�|F�"Q�6�ѫjdl���"���e�EY���)"F���/0��}���\�J�'� �6_v^H�`�V���,luyz?����w���!Sp�XK���M'�]��p�j�֢vmF�uH����`3����w��W��kNwǒ���cwR�B{Ș�X��f����"�4��"���<i19������W���_;�o-X!�d*?b_Ζ̮ �����o��"�(UT�r�tE�H:�����ɋq�^��P�Aol�V `a�#뢗A&�p9�0� *�(Z5��G=���W��iq�#��h�Q���M��@�v��;m��BA��麜,���-ɑv��{b���,A��v���y� �Q��l�c{f�\��#��8 ��as��(�*��I|[�mB��Ȑ�\�gx.�k�wʒ�/c�sR"ۉ�/I��u)� �/�m�ټ���� ~ަ0�F����~��4d��ߕwM Us���z��;NB��w��c� �u{���1�d�Go@t┚UG����0�%�`k��b�X�)�B�gq+"���NG?��֯;��30 ��d`[�;��b�h��]G��(�k����A|�QZp���4r��#7V�!��������tq���X����#��~j@��y'�6�nה�Iv��{Q�U�l��$�ٴ��T��7 $U�+��$�8;F�}����;t��j��E ���� �@����>�^K^1*�#9O.3���'��TՖ��]�N���X��[�q�oV[����XY�H�D����/N������R&�����z���2s!\`�*�������!�.�GOe�+z Ș��6��œ)}Pp�qỳ�D��./��&� ���ꞙ7�[�:<.R��Iz7S V��ǭS�R�b�+����n������p+�!���=�P!~l�����z�Rc�lU����/KX�1 n,��à;ڒ��{\��C��^ ���h��|4\�Y���m�* Vbt������)a�����V�V7}f�b����^����x� �(&1i��"_��� ���Ls��k_���XɊ;��E+瓶�o�r�eg�˵T�J�+���A�J�"l�UhT�7��e!�TތV�� �S�0;�D��nfe��-�9BC��K�g�����������ILG����k:��E(��-�pm�q(��f�lfrCL#&��U�P2��o㜳�����`&��&7e���&7V���?���\����HX�ٖo4>��%�@��ό�?��e`��gT`�2i��&S�a�<��'������)g%Ek@'��u:Dh\��İ+�d�R�o�˿2\u���!���e��Ke�������9'���z5�|�p�Wof_��z3�1H�8�'��
Static task
static1
Behavioral task
behavioral1
Sample
52b645442fbe9026de183b494b298b5f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
52b645442fbe9026de183b494b298b5f.exe
Resource
win10v2004-20231215-en
General
-
Target
52b645442fbe9026de183b494b298b5f
-
Size
906KB
-
MD5
52b645442fbe9026de183b494b298b5f
-
SHA1
909f6693fd7b5d0012a6550df814373bd596a52d
-
SHA256
e93b97366fa01cb51aac8f587c79a92583d092ee13602cfddc0f3f7ed7bb1be5
-
SHA512
90fc298fb3e5ec31d8ce2a91c2f4dfee9b274c98d66fe3d819a25439a6ca060e753afb6459b0d692052531dba4868f0c1df28455b5cc3f1dbc12d23cc3bffcdd
-
SSDEEP
24576:tmFgRn1tY69oQVdqv5KjZ2xOxV7Ep3W/Lk4I2Pd69tOG6:tHRnc697mvMZ0AWuL+S0X6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52b645442fbe9026de183b494b298b5f
Files
-
52b645442fbe9026de183b494b298b5f.exe windows:4 windows x86 arch:x86
29e6e5b60b0ab7ed837aea52cf0d9d93
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
HeapSize
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
gdi32
SetMapMode
winmm
waveOutPrepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
SysAllocStringByteLen
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
send
wininet
HttpQueryInfoA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fkggc0 Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fkggc1 Size: - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fkggc2 Size: 816KB - Virtual size: 815KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ