�}&��h"c�XJII��E�0��������,��\�b����6Z�N�n�3�Z@�L�vh)k��;�4"m�^ �͛�5��%R�R�������KW�����>3�C�l���o����e.��L|[��mr�e�ɉ.����;g��LR���]�c^���>Roҁ5e�-��{��^Ԓ�̋��Z��]�t:�������l�'e�bv�w=�{����e���V�\H�W2��j�q���'>nD Es��lj) �����s^��ZˊMc ·QK�lt�)o ��b���\,�����qo�Xa>i��QUor�����~�?&��0�V{j��|i��ҴX*ϙ�5O�:������k����z���`:҉{�-oÔ�|����jyн#�?{�H��: ����m��� ��GW���� ��$ُ'����q��`W� F�m�P�����du�`2�!���XM'[���c�t��u�y9%_k����a��y������/���g\�43�!�E��W��;J��կWݣ�8�3�u����~p��碶���m3����z! �EMl�A�v_��~F��= �@��>kê���{&����<;2n�E���cK��WI&}��F�Gf�Z%�P���^Α�Ӽ�w�n��+����"8˞�`�Sfr�M�cȕNcU�/��1՜�n�'���[���p�9��'�@����X��b��\#���*2�(X�\p��Mrw=w.KFHIW��aU�����j�֬&��?��������r�N��M6�,��Ur�~b}pԭ*��¥�NV�H�z��_�š�Z���,�'��-�� �:3�"�̒�y�τV�������oi���yT���G�l�鏎�V��������=G_���*R���f�N���0S�!C/+�*���l�����Q^;�/��r��"��~A�O�M�nI{Ju�"����>kq���.��ˊ.Ԇ'�̆�c��������.t��*yEL*����|��cD�W�}Uj������d;{���V%�I�'}7^$���b�1�c���K�"�ǧ��Es�ԁ��$�ј���p��N���k�=�i3I<{R#G����'�P�<v��(A�$��8#�p�wVI�_����8*?ǘ��+fO��Zw[��p�3�K��Qm�{j�n�9oc�H,��8N��I����,�]W�];{Lb�&A(3�#�����Լ>��w��+%��Ф9��ڐjtǵ��U9����-�Rd-�<�{��) e�YR�4�T*����6�L��CqT�PQ�1yW���BC�V+���D��L�C��R�p�c9��%br��a���q�o� )?�j�8bAu�0�oe� ��^aovk N=�F����۠���@X�o�'R@U�z���?0,�ۭ���O�p���p6Bqz'�E�@Nʾ�� _�CVU����Yl�� �0:}��ʺ����0[��}���C�E'])�w*��?��L�n/5���:�: �d��(_i?�=!�.�)f�J\D^l1s�:x bWT��S����@j��=fy�o���$��.�tD�ց���g^^�����U|�C1?HF�LV�{O5�Dk��}s�v�&4���ݱ#����M[������la�S�[��.����dS[�3���4���+�.+Qi�Mt Eu��dh/�V�F��@���ш+�:�J�+WD�Īe���m����3�Cb�H��o���1kxI�?+ ��~���\m4j$5��\)�����p[֔lc���-:=���$-�ؿ�o g�E�YA�Z�P,2���S���al���.A����I�1Ox�K ���B����{�ϐ�f��a9 'g@ �E��&�F[& k� l]d������B�P�hM_�ͮ�r4���#U��]��|}��i�!������LՌyS�@ۧi)-�=�t�+�9q�sL"�P2豤��˳l/V�0���K�px�!绳��P/��*��6S����`�l�6�����bV&���D�W���f���, �������r��?�i�Wlu� oD�x�(m����7$P�r�Kc�����M��*���sw^�~ �X1b,ӵ|$�L������XՙhY��R�j��MU�ԥ?�6} V�����F��J(�����8��,�<i��^A��>kP�'+���z�h;-�h�:�O��T��Ja�B��PZvgu�zt/�Я敇j����L��X��%R�X��@gO@V�:J���K?1�;���h@� �|3��vdhF����}7���Ҧ��r���O�`��9�6f.??!��w+�9������֡�`� �ŕ������>5��|��$�xEg�v��ҿ�jݡ���!z�R��\�'o����'z���9�����\��`��r�]S���[��V�����u�9�QA�����1�!Zx5q6�� ���߫÷�(�T `��Eů�h-�mw%!*��K�����\O,�P0ۼ#�-�[��8�)@,�ڵY0��)X�a�6�VG�u���(��c��t��`x(�2�J����&���t<�W&d�!��q��f��gX���]�f�f�+<��Z���Mv���7R]d�h�bnt3�[�YPk���+���c�}����T��Ɠ�v�ҎtBOۮ��� HV�/:V� $[p��c���7b�j���0�����o����;��x�����,���\�&W�*+�KĻ�I�\������<R�J�3u�z�G��\��#�^5i-��o4pP:S�Hj[ �. 5)��� s�z��,R�&~ע��`[�?z@���U�>"�~�'IPp�����WI*U�T�V�*�$"�{;!�?M��Ty}���z��t)�ud�0�Ȧ��ug�J}��G�#<w�J9�$��Z8�Wד�by!!���sl�ǾQ�=bF��^'a�������7�7�D�^#��-����k�S��2�Ř���h��1ɠa�-fvl�'p�� Ρ��z|oW�[�� �dmO�~v�'�h7̇�<Z`�jD�?��4�}��9����'#m���&R<�
Static task
static1
Behavioral task
behavioral1
Sample
1d6d98ad5e8cd8fe47b359aded6d65d6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1d6d98ad5e8cd8fe47b359aded6d65d6.exe
Resource
win10v2004-20231215-en
General
-
Target
1d6d98ad5e8cd8fe47b359aded6d65d6
-
Size
188KB
-
MD5
1d6d98ad5e8cd8fe47b359aded6d65d6
-
SHA1
d76c0f77ba7a25b3553f1e7ba4ea17430186f298
-
SHA256
c0b94baf61a3d2300d22a324570c880afaa2c343467681f9e1d7aa9ea36f331b
-
SHA512
53b6df0f60ae96645e17c1adbe0dfaf5d8af17fbe5053380b31e645098304cbdcc8f724a705fc009258ba3675432b1009137e91c9f4712aceaef934ce6ed3931
-
SSDEEP
3072:+aZRR6HP2zYRCKPH5PM/q0Ex06Or00XtfsyiUjJn2ImuSOUMVPKPGu/2EOgBM1:RR6HP4E1v50ix06400ddBNn2ImubVPKI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d6d98ad5e8cd8fe47b359aded6d65d6
Files
-
1d6d98ad5e8cd8fe47b359aded6d65d6.exe windows:4 windows x86 arch:x86
71bf67c30c168abad1490f7931c883cc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
kernel32
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
RegisterServiceCtrlHandlerA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ