�/B����"|' ��^�+����ix�/�[^di�8�ю�����'R&���Ѣ�0�}����6�3�#G� ���ww�I����.e��π>�����2���6q��[E��_ώ�ވ�H�֜��_��j�묁g��D��Z<�T�$e[=��~$�y+<Ҹ���|Q��� ȼK�0G��z���$�k����Y_<�ihi�n~�����2/��u��5���+=*Gwj��#��q��O�T�n�m賠(�Q���I��Ti9�ݿ���ʹ��P1���٥���es*�(��-D��Ya��_?�� �:�'��Xw\��v,�K� wįZ��a���Z72fX���=ػ���,/��1���Yd}�-X���^۾S�!��7j|�4��o�uZ���il��o�1b����'���4�@�(~�|m[�ON[�ɔ���ݸ�{eLQ�%V�K[X��Ctu�-c������R -j�ݱJ0���I��L_Y[\�A�1)e53��'��M[7�L-��]�P(|:�H��� �����`��ԟ��o�}�� �l������ਫ�����,� Qk�ߥ�ҷ����?@����?/h��������w��Wp����N�B;�+3���ߺ,�����5�Z$��D/&�QX�P+��YK�k6m^��j��4ф�b/?7���J ����v�`���}���9^�/��,���K�K�r��[t�J��R,d@�Ho ��V���3Z������9��F2�5=h�or�b��w�$��b ��qg&��WP0Tv!z��D6�֬8.r�˘�] �1��Ҽk�%�^b����_&%���#� /X��x����� �� E�u���q�[�?ˍ"H��w[9�.!�U��4�8`:ʹZ��/ku�RY����#_��CK�U}�p&�*��U��z�ː��������e����������U�C�J�� XU �T��֧tzeG*�O�=ƚ6��HJ�6�2��t�T��������@�U^��y�*۬4p�s5�_#p"�����'��/ŝ���+>� g/�N�ɶ���|^@5%TȦ^�:��J�o�;s<wc�#!����\Rw�m ����{gc�jO���N�؞U�!btZ'����$��L���z��v���^���JxE�A���sTp��>����RÕ�˧��4Ug�l4j�h�@F��a��,�]��ѥ�N�v������t5!��*�"@I �������n�hu�z(�O��<������W�:�BY��p�)���(?B��G�E@a/�XSXך������1�М��p�1��\������ ���AjΎ����(^�����!!J���]��������h�pB�{!' v��G�\8WA�����Z�����j�ў<�o���A�ƴ{����h[�S���"�(B�uj��$�E_:����5����a���b�� \���_��+��f$=Ƕx3���Yaۃjj0�:r��Z-�N6����k�=��i���,���P���� ~z� �i`�g�������_k.�[|"� ��)�rk�"A#�ok��A�i�(}*[�:y{9z���_#g-c�T��t��A���Ր�8�z�Ŋx�e+�����*c<�2�Q�iK���*�3�0��0�T��s��s`RUt�m��1�*���S�������T�?����QKY\)f�`�6�O�0]K��&R1� d���$��X���L�H� S��Ξ�/�m�t��@�i�-Q�j��Br�ב�I��-������N}��A1�ZVS�`�F�>�FU?�k"�ԣO� M��}�g�c�W�O&�[�%v l�^�����\4ńlKǧ���l����l����p�<��Y<AD�9m`A���t#xH��������K*c��Tߜ<F���5��"*��u��7�X���W��|6:i���qK��@Iq�'�$+\�U!mE��d&~�� �|�=@ien�<�=o9��7ɰ���?nTUY_b1���˻\�ņߌn�9\��`=�����r�Bҍ�ND�����&?A�yţ���B���n'�!(F��פ�iՅ�d%�`,ƛ�n���� LM����=H-bn�׳�SRχ�����oy�%N�����K|q��]/`T)Y�E����:>t?�r[ ����HD��|R�Љ�W5b�kUr/j`4����e����]e��f��uћC _�́�������` ��vC�q˸�(*��B\;�6ɦs��,K(}�v�Α2�kݒ��'g�B���3z��a�5���z��n�� �+��ɖ VkN�6�� �S`D!/�el��'J�fp�8K>/X��ׂW���Ϡ�~N�ZO�����|T��f�l�_�D�%�ِ�6S -R�>m�^Z��d{�[e��$�mY�%JG��I��a�.U�;��1��:%q3U{I���>R�l���IF3�(�ܱu��p�#=��,�^���NL?u�:���:M���.3��y jZJ�(�����y�;���c����@��=̬�<���?�2ý�L�(��HݙhC*��ը�Q����� ��:�#�l���|3�2�P�� ����f���� �:#��Z�U9���Oi���\�\�1;8� d�&�t�|D��\�u�-RWj��iW2�����$�����b��kwla)�7�Y F�Ԣ%��$��N�u�ƬP��]�P��Q<w����(�{3B�Jd��A"~������jߢ&U :�Y��T`��q*e����r�`�(���$&S��?������n=^��_�9Z�"��7CD{���Qњ�^��P�88�������r�D>��ͭ183��}�]� ����^���=��>+\9�/��Q���;}��Ղ�(����:��)�ւ}��,:���p��:9��8��W FA�q|�T���y1�+]0kU� fe,<�r����E���It[ "����4^m��fdTa����h�� #u(δ�y�����7��וp"��l˙*��{�~D�_R��g�B�@P�|��D�w4N�v�~A
Static task
static1
Behavioral task
behavioral1
Sample
6df80836c03114f97f171d33d6ef3543.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6df80836c03114f97f171d33d6ef3543.exe
Resource
win10v2004-20231215-en
General
-
Target
6df80836c03114f97f171d33d6ef3543
-
Size
14.2MB
-
MD5
6df80836c03114f97f171d33d6ef3543
-
SHA1
d62a858c33dcc307ec8f14ec2a46a2f12379926d
-
SHA256
30792972da815c12ea9e811e729aad35946fb9f2bf5babf9b734b13b17116064
-
SHA512
e3d1bff7056d9634d231c10f51c15b681f52b4a0df2cd27b8fabaeffc16c1ae40d89b4bfc40230b7934da2cfc14937b39a72a49d63740c16bcc8c9dcf2fb3aee
-
SSDEEP
393216:fyULl0mv5+kiUCPfcpbARNfZmvLxDnE7aHwpDXLafsi:fnKEfAcpbAvZALxbiaQva
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6df80836c03114f97f171d33d6ef3543
Files
-
6df80836c03114f97f171d33d6ef3543.exe windows:5 windows x86 arch:x86
ee41572ed27c07b5206eed17fc3d45b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
CreateWindowExA
CreatePopupMenu
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
CreateCompatibleDC
LineTo
gdiplus
GdipCreateFromHDC
ole32
CreateStreamOnHGlobal
imm32
ImmAssociateContext
shell32
SHAppBarMessage
SHGetSpecialFolderPathA
shlwapi
PathFileExistsA
winmm
PlaySoundA
midiStreamOut
ws2_32
WSAAsyncSelect
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
GetSaveFileNameA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 638KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RTSmtU0 Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
RTSmtU1 Size: 14.1MB - Virtual size: 14.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ