0�q9s]��f4��"ɀ��MN�� #���5hYg��l�P`�r�����t��2�T�h%�(KP�V/)"�%��\��XJ+z�Ml�_�бß�B����ϣڅ��~����T����)gb��xL\�#�hݢ�إ3�'H��D�r5� ���]+��u̢%o����U��vk�Ē5��Zf�˚���:�]��O�� ����K�oaU��/9������h�z`�쾵\Y�1������{_�Ͽ!��67��C��Z��2}L5 �KT� �h��#�qGr����^חj˻����b ��}��<:>����z��b��9LڥЋ�cc��AfX��O4�j�����)��N���=|�yNc¡}�HoZ��H�:�G=��(�� ^ֵ��yo�W��ۅ��5�.5�L��ȍVX��;G�!���<P�(�k�ޤ�ʖΆ��#���ɧ�sƦ-|/���'�ЛAv��0�QZ��܅���8'�}`ǖG��=����@�΄�|"�c��=��C�:Z�������pG�kM�q���PZL�N�����Pf�h�bS�T+��Ѵ�@S~Z�EF�����W�#ql��#|B&v:ӄ۱أ����<j-�w��6��#��}n/Ȯ��_���S�3����~+�SaNU�a��Xt�G]Ԅ�te�2�����=ƜG��>So�죸��~���:����-�\�I��0���C����x�r���֛��[땝���f���fy���˷~��/b�L�U��5���1��%��t�+�r"�� u��|<�А����^_6� 4���%߯�������V�hb�yޥ(}\��S.M�6Yb�I�l� ���EB7���!Qr�E���#�FF� γ+�Ff���7�4,h�"O�dnɠӘ�`V����nV�w���֜��cǨ��h�3ɧDrM�������M.d$Ha�=q(������հ}0��bV\�\��(�'���ұ�;%�6�~ �E�gY�nн55*����bt�O�w�d���ʋ U#\/�/�5�\@�zu���k6��v���< /�v���*:����!v+T8�74�����f��D����r�t�/�s�*���|YQ��u �lCpmvF;lk�a��5F��gq�^�tH.�ړw�:;�F�%�\6�`z��ύ��N"����v�� d���j�=��ܛ��C�����[�Sv�^EY �������>-^)����q��q���3E¢������q����T/��sZĕW���\�OPH4?ġ�X�KU�dK ����V�Y�Ϯ�Gᴏ�<�>+&f��3&�h�'<��r��}'?0&�e����G�/��U�)DĆ�J����B�VZ��D�\��6 2��ٽ=y^N�|�I3�4����%���l�Q�n�S��f�~�u��������.�vpNl�g��7���2�:��>7�t���՝�¾����?#w�����F�M� �X�|�8�T�1����B����\g�)^fg}y�Z�p���*�a{�Ʃ���9�"�)u;G���3N"�����dW��$��62zyo���ӡX^',�[.8� �B��>IM� �+8&H7��^أS�>bF=Z�L�n[$Oq�s7þ���E����zms�́��N�v��Wh3�읢����=#��K�q,��J�O��TTq!��n6��}-���}��o������R��Gے9(�Oz�t�D'�E�BsI������'�'�znT.�잊�Ƶ\�^�=j�K��ᇐ�G^)5��:en��f��b�0���B��2��B��Ki�e|��[b�>�b1I���V��'�`�L<b��d�yY�̕7?���t��� ۚiQ��bJTMR��C�g�ݳohe!�����G%�&&,� �bd���aU���ޢ����G�5�>�Q�G�1J���,�F�l+U�4e>P����5����U���23�E~\��r���,��Lz)��o�h[0~ٝ�`P�qt�%�D)�Kc�.�b�����l0�`����K�k���)%?E}��/�n���;q���A�v_�A�}gI�a-z���_vE�W�E��;����O ]�Wy� �r��'!���j��q�"���!��! �����S�'�J^�}y�j��*���=<�y�8���0� "E�~�J�����X}�n�D��!2d��U�`��[� ������`����__P������-_�*(Ul��[�6dIN4@���'��&����䅘�A���eŠ��fZ���{K�\�tb`jɀ�f[�6�Z�����c}@)���>�Kw)Pagl͢w>�����a�P�YF����j���B�?)="Y�k:m��UZܼ �ق>��j����d�#���Z2��B" L�*����)�� z{�����n�tA@]��J3���0����}ޝݪ(�UCq����D4�$�Qw �S9F�_��,O�;�`��<�w��¡N��`22��Nv��q!�u&����S�Z=�2˥�q����ݝ�=� ;;T 9s�9C�� (�v������Kr��M�$Y��������n���u��R���#-8'ձj�m���LZ)�?N�VI´pi��k}\k��#\�u�3�2g |ו��iם���֞�����3�2�6P `S��+������!Y��M����G�~�5?�_�&;��3�%�ۖw�l�uQ��Z_� �Kv��Kk�}>�2L����'��xX���Q�wl!�k�IZ2ߢ��w�-����Cm̆���уv~؟�ڀ��[l�����`i�OG�y� �ͱᬓ��K�_ʬ��}C��ⲙx5G{s�q���,X�({�M�f@DŽ<N�FZe@��gS�2c>��Q��D��ƪ�7� ��@T7%�z�o`9�����[���4�(ש?O��N8Q �����,��Ë%�l�~� .��W��r�\��AF��!�HDN�+�lJ�4a?Ï��N�cr�+~K1�7�=������ı�&R�S�b������4��a?��ὑG<�����e ���ɲ \�T7�i�@c����,цA��,�f
Static task
static1
Behavioral task
behavioral1
Sample
74e11b3b9591f05feeac3c8d79072588.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
74e11b3b9591f05feeac3c8d79072588.exe
Resource
win10v2004-20231215-en
General
-
Target
74e11b3b9591f05feeac3c8d79072588
-
Size
1.8MB
-
MD5
74e11b3b9591f05feeac3c8d79072588
-
SHA1
ed82a3775b72ac7466bf38818c0e28325df6af3e
-
SHA256
dd560cfd7797140905f1946254cfe9db409e68453368b0adc85144cb0201243f
-
SHA512
bd9d2c2526ba765ac300bb874ffe9cb936ef6f2712c737400e8cf48e6a1ec1d8a4f06ff369dae0eabfb77b83d4cb25cb16be892905dff8c044033c0041c2370c
-
SSDEEP
49152:gNDWAZxnkPW1E/d2Vrp3e1yM7XF6Tajh4:ghDx91EQ2A+16Ti
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74e11b3b9591f05feeac3c8d79072588
Files
-
74e11b3b9591f05feeac3c8d79072588.exe windows:5 windows x86 arch:x86
53d612d008b3f4877f05abed779571e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayPtrOfIndex
advapi32
RegReplaceKeyW
user32
IsWindowUnicode
kernel32
IsDebuggerPresent
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
SetWinMetaFileBits
version
GetFileVersionInfoW
ole32
CoGetClassObject
comctl32
ImageList_GetImageCount
wininet
InternetOpenUrlW
shell32
SHGetSpecialFolderLocation
comdlg32
GetOpenFileNameW
winspool.drv
EnumPrintersW
winmm
mixerGetLineInfoW
dsound
DirectSoundCreate
wsock32
WSACleanup
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 26KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 934B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 72B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 630KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
alldata0 Size: - Virtual size: 895KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
alldata1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE