�����j7-��lƊ�� �\w�C_�ie{��D��i��(�ȝ���1����U��"��l�9D��>�F5uǯ[�7���7�<�D��w�B l#z{������W)�2R\�����?���kIߙ�'�'Gp/�[``��8�R��G�3$�����Se�:����ix�( �I ��]wif�{ۅSݟ4 �oK� �8m��&�<d�.{4mʶ��V�\`ŗ���+�"����p�R��1$ܐp4,[J���n������"��B��f����"��ES]�XQ�=�S�7~�h,fu����͍ ~E�#�V��xB_�(��+1������]&ĔO�GA,�J�ژ^}�d�S�W2&O-���,\X Ƣt�����y��{����C]���Dʚ�Z�p.�V�?�Lɽ6P.&�kHqTy��0mX0'>�R������8v���6��f�S�خQ7X �P,��/W�Ԡ�s:�`���=+?L��;v�".hUݠ$�;�CqD�m9�D��X2Z�Q�YI�(t�I_QD|���bm��n[����#&Y��jq/������4�����0�f�H��7�l�dahF��Q�Z��>�ܵ6�rH>���t�yy�7�KV�S&�ا��h��4��:�VбZ���M��*ߛuc�l�L�}�����6 ¸�!�X�n�4�ؼ��l���AQ��맽�+�X��t�����6�~0�mѩu���_/�g��uN��W�F[&��2���{���Os�(O� �ւB�X5ӛaa+�o9����D�j��<\ǁM`b�#.>�A��? �S��(3JF}�uŢꘝ�<��E_Otں�mj��XR���h%�>������5)r�y%A��|���/p����W8kS�)��-/�ܲY�hU�2����WP ������ !�w��;���^ٹ�+X�L|��io�֑My�����]#��Hh�j���1�f����s~@{�Q����Q�+�v�]����oKC-�����G1I��nM��4E8�r����N�Y�Ny���e~��,���6����I!�7� 9��4l�v��L̫ ��+2��ܐ�+6�7�'@�묙sȗ���N2c>�mݧh�N(e���Y3�9����(�A�n��m���o7Y�g����Մ�做�{-�#��{n�9Ț�c%�t�؋w�K+m�]!/��� @�ر�x�?D����*��(�eX�L�LĿ@�� ��b�3�����хc�LKt�t�g�!��Գ/�0�*G���0����ª�z����Pm����k&'�@�A���8��ܽ"q�^:ķ)Yt0# <��-/��%�MG�m���}I|G��Jo��^$��?�Hq�B��N���[�O1THc�<� [Z���!ۣ�W�X���R�k`V�`�X�C�����^ �[r<u�b�f^���y����Q[}#�kQ���=5Mkp�XNe�`����?�5��Zl�H˄w�QC���_�=�"�=������7"M�V6�����q�{����=39�p���(�q���p _��XrI��B.���~�vJs,�R��z�n]��ڂ2��=*��B�i ���������"W����Z0A'�z+pZf��:Xd�9�-҅�CܲYs����/4�8}��i�"�y]�"�\<�k�8fsgS&eR�x���F����c�X��n����!|��S�*!OJTӍ��hnq�����cC�����S��пP��B ���yԇf�/>Z� �V�}`��gٱB��C���D�1 �ަ� �����=S�S'lڟx'�Q�~9J R Z�����j��(�6�qrf���,~��U���_��uP�����F���J�Y���,?N���%4�\����*L�a��m�b�k�Z�xBǓK�SU,��{���+��v�4g`sU[��/,DM��U:���jqR��u�gtHXS� �������p���"�����_}������ѕ|�iUV��#3!��O&.���W��}������)�CN�<�R��d�5��#J8�o���"��К~I����S�lF�YU��8�t�d�ժ��+(=0H�}��D��RX�Z���Hc������k��lva7�Q�f��ok�>�ߥe�Td�L���^/��p�Y���L��_Q�a�8l0k��}���/&[M}�x�����#0����;�`���i�ӂMUv0?�J��4F�c�A�I��5�쓫���.o`�gC���p�+�d�_���B{��U�W�N��.:������r��+Y�v '���E�|7�� �6��={N�[�7���5�E�f�(������S0�M�����Ӄx�<kvH�FL�a��LU��Gf�I0W�3�I� �z��nkǒ#��/ɹ�z�Ǯ�'��A&���[�ب�R�ơ�r�!>����TM"F��:q�!���Ql�ӏ��җ�f?���z�5�m���z�V��A� 7]�P�j����$@9�p����z<Ht��d�F����h4>A٠�Ye�@ov� �/����m��<Jr̨�cNH�12Q�zXl�JF)����O�z9#�~_���'R#Z1V8���i���� ����6{� �Ǻ� ���}J�x��e��6>Y�hT���Ϊ�F;�7/!Œ���Sf:�t�.Y��+�;��� H� ���1G��i!����J����=;��T�����Ϳn���!��Q��֣�&�E��gG�EAu�<%�d�s����m2�F�J_d�63p���E�k�I���{��0�?�K��c����z�ڊ���go3�r����H7++:$�����m�S�.�|$��R�G�г�m"��� ����=1&�����v�xԝ�:��{9���]���<\���_�Y���Hz���ܡ�$�4Y"oU*��((�e�H�}4f�eW7'�;�tX����W������n�]��{���]�NQ"h�J�Rχ����ۘ�֘�O������xG�'�di�2������Ț6�������3��D�����3��H>��ŝ�pB���Y�C^MkhuS�݅<�:o�����,0
Static task
static1
Behavioral task
behavioral1
Sample
107738a61a596e70efc94af947c7398d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
107738a61a596e70efc94af947c7398d.exe
Resource
win10v2004-20231215-en
General
-
Target
107738a61a596e70efc94af947c7398d
-
Size
6.3MB
-
MD5
107738a61a596e70efc94af947c7398d
-
SHA1
8b6d9913683faf6641feaf2f57353e09e4e3ea77
-
SHA256
6b07933f1f4a009c59f39a027eb5579632244fcec0fb782bd623d19b934d148e
-
SHA512
2ce49142856edb8b9ab48e4dbe76b3b64a5b7bbc8b46efc0870218321c37b9b33cf8b46d846dc5aadc26981210d973531f4f4dec902eb264eaca8ee4afbee35e
-
SSDEEP
98304:QHj5X6LW7Z26DHZhTS16oYSWJtUcC29kct7TX3LXGI02CFGliBy6mKVF+5lkxe:QHca7XFNSQUckct/X37105QI6KVAIe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 107738a61a596e70efc94af947c7398d
Files
-
107738a61a596e70efc94af947c7398d.exe windows:6 windows x86 arch:x86
9e3b00e6ed5ca1e2dd608e2354e44c92
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
GetModuleFileNameW
LocalFree
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongW
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteW
imm32
ImmGetContext
xinput1_4
ord4
ws2_32
ntohl
crypt32
CertOpenStore
wldap32
ord200
normaliz
IdnToAscii
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 648KB - Virtual size: 647KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.agL0 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.agL1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ