��i�� ����*��9 �P��"�������R�WA:t�5���xUຖ�En���0 ����;14'��z����W�P������|��B��H���-M;�SC}�@�ֶ���y��Z�5vL�Mک�>4���eR�l�������1���U�a#����O^��H�`=�lr�r��1h��c�#�}Ȉ]�hgzfq-��ِ�e6��YŔ�r�jT ��%~P�-l�w�y�gl":�{/���|���Ѵ�*y^���v���>��UC]/�É��d p���&Dz3�� ��`wl�c��� =�����8YVLn�ꎟ��������m���Fċht��e��ܰ����t���?̳X� �9 ��戙W��.���D������([��j<���������>@���; ]0��q}�Q8�o���8ʚ��ڸ�X�4�'-�R�Cw �{ן��E�����h�����l_���N�����Z���0�� ��V_� ��vE����s�GaCg�+��/�P�o�-�ռ{�;�AQ���� ]����[NЏT�r�歚�F�(N����\J��;�#����&1�&o<����}�\'�ԉ�PWNm"�(V�1� {bx������b)��:�F�)���P�%�퇺(��;�4?�>�泑��J��Na<jU�&���� [� ��/�퓉������t��^��!1�ƚ&���˯��/�n6u�Ow8�I�A��-fc�S�hZ��������|lؿ\�g|�uZ�$������9B'?Y���_�A0����tn�q~@�q����o[R4�8D=�1���4��7�t�T �}�qX����<,1�~8��Cf��b�ׅ��3ma������d�.��6�K�a�x��,���a b�G5T5�{q��t�O�(�#�r��>-��2�`^��3$"����� _����7��/�#a��9;}���.3 ��)Z\��L���UM1�@T��KtZ���lBd.���9^�8��̪D�����N�=nē,�쓺���l�Z�����\[!��X�i���oB��1��� ���fG�gly b�%I��g�����<�%��=�D*���@�?� �x��N@�6Y� Ղ�N�cN^��S������ ���!�ղ��f'�VA�7�Q+��]V7���ӓ)�A؟{�3�-���f"��{3��{��&��N��� .�-�< S�ğƸ��P��XPS(�Sˆ��C`^g��Y\ȕ${���+}�NKf�U-a����U駘�sc*8d�o>u��F��Xm��ZST��������x�6u���c��꾰���d0�vr�~�%{��N� ��Wi��\X-:܋ڨ;��]阇�4Pm�l]�r����tO��d8a���T�Q�,y������L���?<����]��������L�O���m/�Ժم����1v8Jx�Qk,���&D:y ڽćy��/� P�? S��)���l�� �:�,Wx������S�k{]�����t�룎\}V��d��R�e���,oǮ��=X�n�#��&j9E���o-���ቧ2�6���Z�u ��q%jN8��z$�Ɗ�ݑD���`�+�<����z��kC즻����/�� �:���A㆞�����`���|?���&���'@8Y_���k\����d!���mI/P��Ԩ��^0�`�����r�鮧UR�� ����O�fO˻���1�Y���Cr�M��F%L���[�ŁT�$/��W,���a��Z=�H&����4�A���oE0���f��9����>ߝ��+`�jM:�Of&�*�,�Dp�n1#@~�3�*�f���o������]��Ȝ��k�*<O�+�bt�a]����t������Rf��d��e����EOZg�z��� �����_^6{��r�?.�`�C,U74><o-~��;/ިB1J�.�Q�m����^�EN����-���-f5K���<{X�l���K�z�+lc��}@|q��C��(sGFj컔�:RD~��{@�7�k��n|�W_U�d��^\�+�T����4��x��� �i�Q��(䖴�v�i�����������n�����Pͪ�#dĸ����S�f����[J�BZ�.�S��t7;�gM|$M�u�ZmUZ�RxM"�|�ÕT�Z�Ka�]T/A�W�³!/V}o��(�7��������3�����G�K*�BKtZH���4F��!BkZ��������y�O����C����<[���ݔ"*+G�fz׀�� �?�� �0sZ␗ʜ�L8�A�N�-!^K�2��H�27����M6DԄ�اڎ��"�4�T%�B���`|���5"=��b� �E�+|m -�of������l'��rΊ�4^����8�`��\��Q�l_�!WNP�B����<�k���{�&�������n�%��;��n~��e1`�tC�lw�57����X�����,�ܶ�d����5o���^�j����M�l��m�68t���6�5��Q���s��Ύ�5R�+�m�V���j-���s���=�U�rk�zpcr�ڿ��P��,�,���!�GH��m������q�S���m� �=��5�wlH���>�~��e��=�-bƆ!��Ĭpjr�qM���M��6tP���~�?�c� ңz8���:��##,uޟ��! ��-��m*ҍa~�_��?|�[��<,䊢�M9�#"�pX��>��^z$u��r&�j�2�=��&��_x���-g[����ٲj��%_�ġ T�"�����cr�]�n7q?��ɒ|�:ԯ)�<���j�%��VA����*�_/J��ڬc�I����sG� ]t�l�B�e���S-p�=���ɆX��n9���\-?�~�ށ�15�D�x*v+�H ��:�����Zg�2�s/�Ur�D��[@�l1�����e�(�L���)?�J ,��T��P�����*τ�V>�~��; C��#]▌ע���(e��+:qQ��}�[�o��8 �
Static task
static1
Behavioral task
behavioral1
Sample
fc97e74868de7bb35d025a83d423f26e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fc97e74868de7bb35d025a83d423f26e.exe
Resource
win10v2004-20231215-en
General
-
Target
fc97e74868de7bb35d025a83d423f26e
-
Size
140KB
-
MD5
fc97e74868de7bb35d025a83d423f26e
-
SHA1
6ebbc5cd126ac64802a56fcf433e37d99a20a8c0
-
SHA256
e9d09a66838ef57f7ccada809ec7db4238093f23805b0c358aca55db7bd92585
-
SHA512
cb35b27fa3a3437a337d479afd713686e6b8fff4b47cb1f3f24361ee11b3520825c036e50aa5aecd5d51eaa5df2b996deaa60b2122ef17f4555b2b38a4c01a1c
-
SSDEEP
1536:/EUUij0xJE9kPy7w9LP8nK47StE6pg6ybzRA/aTPBN3lZDNR4rewQvzsqQmRoIOE:cioStSGKASuygWozD/hw0zs8JO97ep7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc97e74868de7bb35d025a83d423f26e
Files
-
fc97e74868de7bb35d025a83d423f26e.exe windows:4 windows x86 arch:x86
88477450ab2c7e9aee3bf6c1f561a894
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaInStr
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xxxx0 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xxxx1 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xxxx2 Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ