:�b̟�ۇ�15<��X����I�)l����U�2DP�@�L����ܝ���A���Gh�C��{��=Š�oz����-> ���k�GoB�\�V� ���z�NtP�~H3E��ĤH]C�C���ד��6V�/�B��m'VIk�S��s$��{����P25����ι��.|\���#���}� ����P������W�e(��}ӟ���E�@d�;DM�rȧ~��qz�Y�a�7��R� ���%�:�R�m����[Ԧ2�!;���;t.��?�Mz]E�ο\?�j�����D�h�*�+�o��D��#�#�S%�]��Db��&��}���~C�����z�r�� ��Tg�9�����ډ+�3;MVvy�R��ohF�x����Υ�Ɵ.T���!��!�Y�Sɷ�D�9�����{����LF��:]��ˎ�h�nM0�u d����O���0R��!@���?]�ۦ����@џ���w���{���D��tTܦYrk��3Z���[���Ȣ+A~B&u ��](����;1Hq�(`�ת��`���c�/�UIȄ� ���뾿���1ni�=u慎��u�K57v�Cĥ}O-�-�cG��� ��i(���X�����9S.��d��(7}>T�M(��b��D-NQ�9+ A����xJ�l��T����Y����@5꾳8�X��W����?�� �t������ ��ǢF����wC�����n1��OuwI�-g#�T����C����)}���ۈ��ES/Q掔�uoq��zz�ު^D�5S����uߖxn�B�x뉈e��� g{�)��NДK M��K�}��K,'�+�!��$��j��ϓ�����X�?�}DHN%�Y�:-KNv�� ��jR/��S�UQ���ݞ�=7a�<��)���>in��[pq�~L-c��SL'��x�ߪ�t&5%�*|H=�� �4]�Z�`"�c�B�v�֟F�: �D+��.ڦI� �S*�G�Ţ�o`il���Q��*��.�.�-S��g��b���M�)OɄ��<��|�-閤�f����0&�H�1g�������B���D���Mu��a�`0Ne���(Ƣ�&�A�)`��v6�C`��t|Gn�WEXx������"̈���5���+O���X��e�Ϛ�� T��Z�������ܽZ���{�,!�x�;*�oܼ���vG^��N���*O��.�31m\qk��NS)Q&F�ә�ux�r*���u�����M�>Ӿ�-[������@d<�k,(�3L~��o>�>N�\@����}4�����a�|4-T��=uZ|4��sb�.��v};��Sw� ��`%�R��_�����u��H��[�\z;�SS� _������`jb$����ߋ�����ws.��P��.�%�!x��_㝁a�4��;��F� �Q8��Ư�""r�{n~�*��d�RppAg��ʯ�&��F���*�����d��k�W�6��}���S��=2��%С��)G�;{yXVQ�%LJ�Ɗ��/�E�g�\��mfd/��o[��_�&�<�����QJ/e���� 8U6���N(��,g�D����]ˬo���ú�%��>������ �O�7��/�Ŀ7��O嶓S:DD}� �__�~�}˺�xE_q nEzC�s_��<A5a��Ĺ{��e[X4��G"JL��=7�6D��}��t����?���!B/(��E^�!����: �ozx�#�q��geqwP�$�]�1��m� _���������(�e���La0��� �B_���Ǻ�����k�UM%E5y ��G�� J�]� ��'*:�����i��M:�9_���HM�����d����БH�2��0p�&�g��V��O�ڦ���G��M��vh�o3����ĵ��%0��h|��\�҆;�Eq$*_x{]�/�4�{�z�N<b~�+ċ��]ɕ����f#U������G4�d"g3�/6�(�ZΥ�l�7+���d�똼J腐6DTK�@~�T��Ti�ʄO��D����]|D�� O�Hr�C�s"xx�Ge�F�r�=��+�� Ix�V�C�-�0Y�~�D�s�Ôt�tp��@�_�Rxzr#,L�['�X=G/�';��wd35���N�� :i��Pi���Y4��r��Ӓ��6�[�]�U��I�4o#M,��_��ӫ�T�K~@�[�����JMb�F�5u��#�v-v-ӻny w����������z ��Dž�l݂?G�7�3ɍx�bR E�����:/�������ZOZz1Ayq���Π�P���W��m{��-;��p���@橚c�%���$�J]hEp3<�-�wn��HH���9� (�¨�T�@��zf�H����Bғ�}(�l�r;�XމB7�ds��tk��~:�L�"ow3�'����9[�����雿�8�iC1�\ja��Be�e9�6>�~�����O����-��BC���n\�5��eܛ�����(PU�BՆ���/�[�|Q+����鷢s��ʤ���? �暎��A��+(0�!M��%�b�"^�o�)�f��K}�l'O���U sF 4��LH�ZW�W����1vb>!%�ٱ���dM�$CB�Wx��ol �0G����mjWJ�{G���~J((~=Nez\�^T%c�I!%pb��K^Xo%᭲�̦��6�Z�w]�T��B�H�u�SQ�u��fe�O`o7t��vq�జ�z���x;FT"��{X��s~)��p���Ղ�'��§iZE���2���]͓$t3gOl��>���gA.��VcD2�ݶ��ϵ�`Eh KZ"w^�3��O7!��m����~w@�T��m'm(�:�����e9jٚ� ��{X�ȴ�G�ԙ=V�@6�G�4t� (��*�� ��(7����S���XH�{���,����`ބ;L����!�9K]������B<��u���~d$�=�>���|?<D�0�E���o��MɄ-�K߄�(:ir��5��A�J��D�����y�(�n 7Y�".R�K9�}�꧖&�l�����-�9<∾6�¯��kM��9� e���
Behavioral task
behavioral1
Sample
604299c4624ffba32504ca7beb65b9ae.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
604299c4624ffba32504ca7beb65b9ae.exe
Resource
win10v2004-20231215-en
General
-
Target
604299c4624ffba32504ca7beb65b9ae
-
Size
644KB
-
MD5
604299c4624ffba32504ca7beb65b9ae
-
SHA1
48031cc42b8979799bb3da78c67e3b8ca911fc47
-
SHA256
e05501b6c29b78b7c9a00e482fef3d38571e1df980905fe488c976e47f2b2496
-
SHA512
ccc0cce3d8171525b3427964824ffa0ee42349a3644b4345345275807c192667a58969bcca46bb9b73e3d236aa6d5a152b50f15479bfd77eeac5b5fb4040f4bc
-
SSDEEP
12288:dKuR5XRGVv3/Nj8y81svlcOj2l/GlOBqj4PODD62jPmnNSUaG/:8u3XRGFVQrWcSIqx6y8SjA
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 604299c4624ffba32504ca7beb65b9ae
Files
-
604299c4624ffba32504ca7beb65b9ae.exe windows:4 windows x86 arch:x86
877185c43c2f699b230516bbd9bc4b40
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaR8Str
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 624KB - Virtual size: 622KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ