(�5G��٢�(��<ѣxu���ݷm��ًtj��^H�l?��y�q����f�;���.n%>�����M� ����$g�'V�e�&e(��2���֭i&g�i�./O4E��<�������C��<�m\�@ �&��YF`��ȒC�������";�$��� 8�N���Yq"�f�[��aG���7���xX��Ǿ�_�n5�Ӵv�i��Mp�˙EQŕ�#��g��L�j+�:;��?�� P���E�8�0��/�R2Sk�6��v�G��ߗ�b�+@�K�������D �beIhk��#��6�0��Q �i�O<��%p��'D]��h)�.���I�ba��`+��E�f����W�%���:�E�'�\���Z���躜#Π!��TQ6�� ��/y}xso�!j�ꖁk4��qXJ�x��[V�\s ����F�(��u-�63����,�a&JbD�z���b���k�3\��M��ٝq��/�F��*B�t�����J~:G��U�4�uSF��^F�5_�m.���h�����ӧ>/��z���dz�����֥%-u��X��� 65w�\m1k�N�������k�o�t���@G���g��>��2Q����)�K�� ��7p�z�\�H�~�G�/r��v��ScLҀl2�����7o�L����oh�"�~���~�$+���LKuha�Ȱ@4�Q���E��,ϗ�j_�倫Dd=�f3HŨ.�ia䌿u9�K����=ݮ�N��j�����zi��A�ƴ^��N�$����\Ae<=�~�@*bM�<S�p�qT���k��N��ʬ�*W���������c��!Z��^X���ʗw��TG�6{Ss�wN�lK�3%c�2�KB�(�ر����V�k��T3�0t���eI�±>~���2Ӱ@��X#q��^�4r朽k�ɏ[���}�@'���L�O�aq��YFK�\�Mdq��*�LU���ڥmtΏ"��Y,y��Ժ��ڽl�i�g��.٢˗�a�mG��;U&�v���(�M�zx/i��?0�����@��E3+UK�u��2� :3F���, �%3��v���:<��wuPV��*Q��7� �w�yg������c���fX��f%�\�N�X���\�~�#4~ʟ�H�~���n�H���GPݸ���hR���q}��D�&绲?/-��7��|���2��^���'Y�u8��p���)"̯���ƈ�Ȣ��qK��-1|�w_�m�DvVP�5��ȹ�-�)@���R�}�9��j`P��M��T�¶��������H�a"�BI� ����l�� ���\c�0X���wg`��d�Vw����A��?=�v@�z����'^��� ���9��x�Z����$�c�in,L����o4��A�(�T�-?\���^,���pB��Z���>r�ŕ)zm� p���X� ������u�����c)��AR�MJ�����6��DT֩��3]���Y�@�̅#φw�x�����!|2�� '��¤��xg[�8y��ʑ"�a5�-Lؚ|t���u����G��A���q�f�����\)�?+��5/Y����� �J�W�d��2%F�i��6Y4/��&��Bs�0A���|4 �<E�|����mK8Ӹ���}�?����p�)��=�U{=0��0�0 ��v�>�b/rv)�� r�[��h(�u_Y3c&��*-�̀���i�������Fju����<ˆ��|���a��(Ze�] @;���V�=M�g��/�V�q���a�)J�{a��:�D�;z�����z��hL-Ko��T6:�-�gz ލ�X+MPX<g�d�TԤf���C߮2~�������P�Y�Z1�+�hS L�?��/���*˻6p��(R��=���L`S������q�4 C,�Wcn�<Nb%����H��j LP�b7����zĿ����� ���=�զ�ZĐ���G�e;M_���u����k�[� ��BO�Σ �`q�+i��+Sv����5CP�u����_3�l�;.�ĕ�l�V���]־��$$�X��|�0,�|V��@�����-�����֕���À�/37�S��l�t VD�v�NL�<b�oYI� ��J�(������?���4��tjc!���і܆��=X���F���i�9�$F��R�3N��H|m|CLQ_�y��x�O Q ��md&\h�ڡ&z����͏�N� ����&@�$�s7��H���=�!I6� �)�o��KZIW9�7sp�>�f`�h?﹡��Υ �43��"��;JU�'��`9N|ݨ;�UTHٿaq�����B>~�t�%/���+��t��W�EL#�ղe�0ߠlkCV䔓�5�����e�ùQ�s�7���(:�)I��Z��N�������}��.؎�PiuJ-�;�_�Ϡ�����H8� ����:Q{�4�$�闘�s�@."���6l�Fñ�F6K);����rp�\&���l�z����.��!�]I��c�nq}�vx�=Hzm�(�2�+�VQ6��L�шH��za��0��Me���Վ�;�c��gq��V�e�����S9$���*�E�� Y BU��� L���w�ps�ڽ���3f�QH)z�)p�� ��T���CʝΩ?�x���}3�l5���^���h�bص���k��ȸKl��3â7���(����[�Ƅ!K��u&�Ir3����L&f��\r���xf/@լ�_�3W��uj��ݴ�E�y� ��� ��EV��OZ� ��eW��)s�w����}ę��ɵy�n��[�E���Ҁu���+e��C�&9 �m2��i�.0�g,$% 0"�*L~�'���̄�S�Ďb>G��� J���j�ʓ��Z֗�V=� �[�"�)8Y*$st:�� ���� =��+�I����ʖ[{���lF������L��$ zI_�N[�9�~(��cGE7����ZQ� yWf�l��ɚKi���BC�d��2��=����_')�0���a�1��Q�@�W�`r>Q��d}�4`�z����W
Static task
static1
Behavioral task
behavioral1
Sample
5688e114bbbf188a67104cee24a578ff.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5688e114bbbf188a67104cee24a578ff.exe
Resource
win10v2004-20231215-en
General
-
Target
5688e114bbbf188a67104cee24a578ff
-
Size
2.0MB
-
MD5
5688e114bbbf188a67104cee24a578ff
-
SHA1
0bb4e665e391a7dae0e2bc1f91c76849915add02
-
SHA256
bcf6426696d8699a4b2645fe3bb1c36e53dd7fad9cc1306314a9fca6d377749a
-
SHA512
1c63dfe178e3872872efc6c28066f44efb8a9bd667eacf6983b81d484d48b473c6f7c3b98805693718eedaecb8f645a6c18f241b7a366f80a6519161caac4eb7
-
SSDEEP
49152:uPyWV6MgrS416oU2BlR/FVXzqvKVAlmQfbM8:0yWIJr2oU2BvdaSAlmcb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5688e114bbbf188a67104cee24a578ff
Files
-
5688e114bbbf188a67104cee24a578ff.exe windows:4 windows x86 arch:x86
708243464a1c8701465ba1b8958ecd84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
PeekMessageA
MessageBoxA
gdi32
RestoreDC
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
ExtractIconA
comctl32
_TrackMouseEvent
oledlg
ord8
ole32
OleIsCurrentClipboard
olepro32
ord253
oleaut32
SysFreeString
shlwapi
PathRemoveFileSpecA
ws2_32
listen
pdh
PdhCollectQueryData
avifil32
AVIFileRelease
msvfw32
DrawDibOpen
wininet
InternetGetLastResponseInfoA
winmm
waveOutUnprepareHeader
skinppwtl
ord3
Exports
Exports
Sections
.text Size: - Virtual size: 562KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 565KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
game0 Size: - Virtual size: 454KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
game1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE