GN��� EU�waP:��ln"��^���2X$¢�VZK����ic.�=��8�:,z���6bI~OdX�C��-1�hh�SA�Ac�A���R��\tyM�^N6:���o��<�X=� ��) N�i�Х���s,���fuɸ�tH��z��ו�ZXy���='I���`��ݯa��Х,2��`��/̸L*�OQy��nN�o�ݝ[��݁7��+i��~xVQ�Z�S�1�-�D�W�in �ʢ��G��������]��q%%�[��aC1��$�^*#:d�4���+��ċE7�u��.�{��T�LD�D!i����L ,��Mol�����3r�3���9���*�'�����qY�yI!��&-^A���o��m�[�?žI߮FL��je��A�\q 4U&�����pLjn��']�jR��� ܧ�<��t6���R����(���pi�uV2=_$��-�e���Ǚ����N�fF2���n}�c�)z|sࡸ��y�����nB�B~�l�҅1Nw]C�l/0 ���� ���ݿ������ |�1c;>:�%sAs� 5C(��L9#G�Po$�O���t�G@���(�E�A������$Q�k�C_@$�=x>A)D?u����b}�2d�:tJMTn�ďזw��QU��ôۈ7���$� �Qk��K`1� �>X�Uنi>�P��0d��n�g������,g{pheNi%&�A��6��yg�H�٩�?v, �fw������m�s��\������N�q����p2� f'&Ϙ�F�h� �Ud�qj6g�9k����F=�O��7��MĪF��-F��� .Ab���tT�EH-�:8Tݸ\V��H������FW ���9v���c��=�L�X���S(��1���m�������^�$�0�� <鋗k5H�~�l���EŐk-����>��1�Q���k-K��U��������2���Q�S���cd��2m1���C�}~��r��t�XLs��k��8(V\�adǴ[�=�iy5W��ixf��Ɯ߁�GU .I����x2�:�T(�q�}�"E������ 4���븣�9�+� 첡�/��d}���ζ5�jV�ӏ\����kd���.���8.��8�a�0�l��s��yݹʓa�x/G)���`��[�k��.06����dqc12��X�!gfX���d�p Y�H���Ie���b�������!i�8�������BY��cX��}�VA0s��)F��b������ϧ����J� 8T�k�Ә�T���xN��:7�,C7�����ފJ���~�zw%Ca5��<�z�pF��� !`��N �<4�����"ɥ����!i �gJ<ny��m�������iG����� d&� U~[��c.-�^�N���� $5��{�� �%Vm��+�<\�Z����5��;�:����/yքBLm9���NJDمGA��������Nc�+�=U�{]��`��jD���b&s�K7�|5�qRb�\{�����r���%���Lia����c���kO>��m�c[jxT�wZ������9o-��1��s(�n�c����$�w؉���߇��V%���(ĨcV�,{x�,�'��.h�%X��#�>|}��#v��"�̏�D���O>�z�G���ec���4�75(��_<�d�s'ʖu����Ư��?L&��, k�����ɘ���1ˊ��A�8� x=U� [{�������b�VW�����rr[d�ף����^I6p�;9~F{�����ܭ5L��+�[�-${�Y��p#ɩ������Z�ZU1�'@t��(\5#v� ���˦+N�I��s�U��� #M&�'���"$$("O�4"0�U/^͟���N"HJ����oԳ�j�.�嵩��oh #��c����9�9-�d0u�p��0߱ �(���� �6�@u.(�&�6О�X�d�� dA��5��1z�XC�l�<�� iUSv�8Y�伵��ɼ�m�+�^z[��c#��=�t�Z�{�G�h��Ɍk����,��ܼD+���[��~�0/jP[�S�?�T����UG8�x�r*��2�H�%�\��A�⹝���e��5n/~�M��vq�X�H��J���c��d�(� �Ѽ:S4GLn닏�ee�,��?ϳ7�%��8��e1�e&�GVF�Dr�pe��d��O��r��WI=,GT�A�XEE��F���,�^_<�u��`�Nj�D֮ �Y�����uB�;R�H�Qv.-�})�9�L��I)�g��'��t�4�Ę�#6��0�cZ`ng�`��$2�xJ�O� �Ҷ��aO�� �a���=�S��&?��a9͇���=\ȭ�t���q��LYh3�D��KR���;�}*�.����$�1-�hC3G��j�3�Nܧ���Q\����A+d.yT���u)�~j�oA���r��ǵD����K�cq��&�� ���^�z��T�r��I��(�Ɩ�j�?6&�v|�c������q��-�T���T�D���?�A�2�!��G�_�v��>e�b�^m(����z���F���z��i����m�� ���C�2`��3�H�ض�Fx �<�����ZP<i��9b/&��(Z(DyĠ�^3t�&�!��N���l��+����sy)��`���ڴʟ����&Xԅ*��EdÊ��� �2��/��rx�����˸|?f�Ș��� ����0�귀�9���r�Z�}�E�5����j~>�3�S����t'C~@��Lk9�H�lQ:�`#K���>$���i��c���w�x-.��(�����2��k[*�~("� h�Q\�g�P�C��qV���V�7H�4��"���:I{F�uR�y�|�M�=�+�}��R��[�*ښ�)?�1&!E�6�~��� C#���=V:<2���v�e/�UTX��^@��<�@.�#N]a�T�w��sr�5�>D(~�"��&�Slc�k�p��n�&�wM�>ʏƐBu&^�ݎgA���9�\��C"�E؟�h�5 ���;��?�d+-
Static task
static1
Behavioral task
behavioral1
Sample
79bfc3464add785fd6e2346ceaa31c63.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
79bfc3464add785fd6e2346ceaa31c63.exe
Resource
win10v2004-20231222-en
General
-
Target
79bfc3464add785fd6e2346ceaa31c63
-
Size
332KB
-
MD5
79bfc3464add785fd6e2346ceaa31c63
-
SHA1
ed31d91d74912ce753cb7b1f1af935c32fe00756
-
SHA256
e755c0a6215b2d330487e5345d287fab84d7eb3f53eac250b26ac7631291711e
-
SHA512
c2e891ab1462f0e17ceadf7be39c533a23488571e148573533fd47690ea40ce5da3e814278347bd24dd8f88a64555d1e4587b617fa7d7d5821bb1a7e81cdd186
-
SSDEEP
6144:F6AbePOSYrGTvOL2i3inobinO7j86SkegXoaiN1nCds270FSBRwtw8:YgSTO73Nbinyj8sesAQds27wL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79bfc3464add785fd6e2346ceaa31c63
Files
-
79bfc3464add785fd6e2346ceaa31c63.exe windows:4 windows x86 arch:x86
e46043660bbdae57b9701d51d9750b9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4837
msvcrt
exit
kernel32
CreateToolhelp32Snapshot
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
shell32
ShellExecuteA
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.luis020 Size: - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.luis021 Size: 320KB - Virtual size: 318KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE