���魰9�a+�$F؎�%`t�I}D G�#n��\��� ��I���?U��ѧ�gH����N+{�,�h���Z&�{`e��l�} RɆ�]��il��_d(x&���~�h��9�W��&@�4�߀R�l�1?52Z��fL��%���ۅ�M���X%� ��.0�q܉� �� �����1����_�Q��]�I7�����LA���C���Qq�i9̫��)�a��v���Fp��ϐ���B3�ϗg��kf��m��Z(������n��^�����G�4�����0��P��m���a@J�n�S}OW�-��!�:N�:-m��Ę��|}ә~�<�^2΅Z)9z�����F/��ӭz��9'��2-�����fI���V�H��w�F�o�γO ��R�8 S��k�U�啍Ԏ����ڞ���hݙ��ݸ����؉��� �aW���*���b�ɼ��s�L^iQ��V�M�dgь;�TK�Ʌkrk�y�ţF�j��++G1�B��|/&2V@�W �<�C�*P�/0H ���t�êC���S����|�=����D.B�?R¥p!I����=$#8q��ʙ�4ʯ�vHXў^q�h�$�� fP|x�Ưi�b����V��h���^��h� ����A=\��w�;cyER��)?�����6�z���ښ�LO��+!T�J��4�YV��q��R�o�F�P�҅������Fy��D�8`t˼�%�<��Zye��I���3etN�1$<&��NPi��!(;.�L#��X�i��� ��-�'���ZC@ؗd��`0���B+�4�4Uev1ZF�8��LZ�=�Z]O��`L�V_��8����!����I|zW��'�є6E|��~�u)v�����������q�w)y���]51 pW����v�;?a(X�����q�D��_�P���(�#ե���X!���,d襏�`6z��,t�s���4ց���Ѕ��uRJ�wB9"�Z��Y�~|@㕆�JG����o�Ik*�����7<s�/�1)u��1x�@N��gH�Շ���ź�RO�� A�y|�ծ��K��o�']���K�H&�,��pl��˰��c�p$e3�WL�����Z�i�,@�8�v��/d�����?�C�3t<�Q�j���6Ł�i��p����$��HRM���B��e�WO^�(�/���p�����OKz�������Ve���e�$>��iZ;�ڐ:@d���v�6Y�s��T�p�;n���9�5�o��J�;��cS��� *X�`�[8���ԗO'�mKx�y�<۱�D��WejxV���:�kH2��dx� s"�4! �d�bz@?V@L�G�����G�B��t;�ť2�(o8u>=ځz:�C�鋍�8�������)���G��ׇ�'e���j��Z?���3���� �&6i&)���B4f"K�����Esp~����T�>l�H;�Y>��.���؊O�,�5���u6Z>���bb*L��M8z�>�!Wx��IE)]U ��Ȁ�^���VQ$OP�U1��̽��z�y���[�Mn�������5����g�������"p�U~�a�F'��#_zF; R j�p��s�D��Zݵ�"��h�:3S�.'|uԛ0`,��%��bwT��V4�<��^@���SM���H������2<a�O�H^$\��#X�(;tP��OJqq���A%]��>R�S��W�fO��?�5<�*�Q�f���������pU��X&���cl�e��I��Ǽ8�"I�.;�l�M��}Q!O��'���j�j���DHֽ���s�A�b��t�1lH��+���29���VI;O���Jv������n���pU,��,��>� �c`koN0��߱WDq����L��UQ��IJq��|� ��0�Z@��li��V��M��PŇ��x<{L���'ʟj�:�J��A�Z4*:�����^�m��!��{ţ�� rN�3�C�W����ǏhO�DM�Mq�د���_O�FZ���*�Y����r�a�!�%nb�V(I�g����H�����a�- N�����Wsf937�t J "����k��{z0�9�WNA7��H# �[uS��(�'ְ�h���3���l�T[����|���6�3��yu��RA��y] ���8�a&�B�?���V��Z/ �Qb�C?���ظ�!%�����FcA ��q�Q�D����/:����� ��z��~�c�y��:J��ӓ� pѽs�P-��� ���z������� -^��e�헖��CG}lC��>Yp)E{�<υ*�%"��x�F��^��:�1y�Zs��\����!����iF�����x�g�0��p�]}c$��RO�(F�7e����ɝ����!���ۣ�$���+�w�w�ԗȓ�����Q�d�Y�b���cfW{��k]�On r��H��EH�6 �$Ƨ��go�p�4N�#^��a������7���9YS���"m�6F7d���_�(����X��,)�3:v��#Yӱ�!?�2�%�R���'�YS�Ӝ/2Sy�LQֺ��:�x^�/K������ ;�8؏�ŋ$�N�SI�Y�X��{�tv��{������X�x�DZ��d���)bic�y7D���n���ddU��W��~��#��OP�K�ޭ�#�?�7�>�<r�����F������Y)��W��Y$7�K=���LZ}�sp�&DI�C�ʳ��9�jz�/���a0�3��=�z� v|=&c,�����l+�;��YN oY�W0���-�Ud+�s�D�@JJ�{ ��>W���������M���k�ЙI�"���\e�y�DŽUڥ��;���2�����,z������ ��fS�E�H�"1~���=��G�k��KP���7+>e=�@�c,I'��F��5SE_v�C��MQ*�Uf_z��bهv'x� �7��qmU-)��̷�ޥ�D=�}�O���*%P�@+NHiI�O��]������*�ٕ�VTy��9siކu�J ��4����g�;�u�)�Ա�b�z\0�
Static task
static1
Behavioral task
behavioral1
Sample
63be80d61b531be63d73cbb183354d13.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
63be80d61b531be63d73cbb183354d13.exe
Resource
win10v2004-20231222-en
General
-
Target
63be80d61b531be63d73cbb183354d13
-
Size
946KB
-
MD5
63be80d61b531be63d73cbb183354d13
-
SHA1
6835a5e610ec48f45041ea7fe1e316c8c9399b4b
-
SHA256
79ed9fbba2c69d1b0f8d033ae9a42ee64e37fca7f693de24deda743aa561c604
-
SHA512
6571d20effb21944c484c097a262bdbef04a19744e095deef8ac73d2c4c5e3af829d5df2cd7dcf594ea9665139e42ecf4752fe592d3aaf72e8a1af673bdb03eb
-
SSDEEP
24576:g7Hiib+wU9/ckJGGDdjxgGXrPcxtWbiq4S5+tn:sCaxA/ckJGGhP7cx6YS5+tn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63be80d61b531be63d73cbb183354d13
Files
-
63be80d61b531be63d73cbb183354d13.exe windows:4 windows x86 arch:x86
dc44811c3d616e06aee27f7a65f2d596
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
ActivateKeyboardLayout
advapi32
EnumServicesStatusA
oleaut32
SysReAllocStringLen
version
GetFileVersionInfoA
gdi32
LineTo
comctl32
ImageList_EndDrag
shell32
ShellExecuteA
winmm
waveInStart
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibOpen
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx2 Size: - Virtual size: 517KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.upx3 Size: 878KB - Virtual size: 877KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ